RB-ANALYSIS-034: Exploitation Activity Analysis

Document Control

1. Prerequisites

• Suspected or confirmed exploitation event
• Affected asset, service, endpoint, or workload identified
• Investigation time window defined
• Access to relevant application, host, network, identity, cloud, and SIEM telemetry
• Known vulnerability, exploit indicator, alert, request, process, or event that triggered analysis

2. Step-by-Step Instructions

1. Define the Analysis Scope

   • Record affected asset, exposed service, suspected vulnerability or weakness, source indicators, and investigation time window.
   • Include pre-exploitation, exploitation, and post-exploitation time ranges.

2. Identify the Initial Exploit Event

   • Locate the earliest event consistent with exploitation.
   • Record timestamp, source, target, endpoint/service, payload, request, command, process, alert, or log entry.

3. Determine the Exploitation Method

   • Identify whether the activity used a vulnerability, misconfiguration, weak credential, exposed interface, insecure file upload, injection, deserialisation, SSRF, path traversal, or other weakness.
   • Record the evidence supporting the method.

4. Assess Exploit Success

   • Determine whether exploitation failed, partially succeeded, succeeded, or remains inconclusive.
   • Look for response changes, errors, new processes, file writes, session creation, privilege changes, command execution, callbacks, or data access.

5. Identify First Post-Exploitation Action

   • Determine the first confirmed action after exploitation.
   • Classify it as command execution, reconnaissance, persistence, credential access, privilege escalation, lateral movement, data access, staging, exfiltration, or cleanup.

6. Correlate Host and Runtime Activity

   • Review process trees, command lines, script execution, file writes, service changes, scheduled tasks, containers, serverless execution, and runtime logs.
   • Separate activity caused by the exploit from unrelated background activity.

7. Correlate Network and Callback Activity

   • Review inbound exploit traffic, outbound callbacks, DNS lookups, C2 patterns, reverse shells, unusual protocols, and external destinations.
   • Tie network activity back to the exploited asset and timeline.

8. Correlate Identity and Access Activity

   • Review logins, sessions, tokens, API keys, service accounts, privilege changes, and access failures around the exploit window.
   • Identify whether exploitation created, stole, or reused credentials or sessions.

9. Scope Related Activity

   • Search for the same payloads, commands, source IPs, user agents, file names, hashes, accounts, endpoints, and destinations across related assets and historical logs.
   • Identify additional affected assets, accounts, services, or data stores.

10. Record Analysis Output

    • Document exploitation method, exploit success status, confidence level, first post-exploitation action, attacker timeline, affected assets, affected accounts, indicators, and evidence references.
    • Clearly separate confirmed facts, likely conclusions, and unresolved questions.

3. Post-Action

• Preserve supporting evidence and analysis artifacts.
• Attach timeline, indicators, confidence level, and findings to the incident record.
• Document containment, remediation, monitoring, and detection gaps identified during analysis.

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Contributed to the Arcana Incident Response Documentation Framework.