RB-ANALYSIS-042: Vulnerability Threat Intelligence Assessment

Document Control

1. Prerequisites

• Completion of Vulnerability Validation
• CVE, advisory, or finding identifier available
• Access to threat intelligence platforms
• Access to commercial threat intelligence feeds (if available)
• Access to open-source threat intelligence sources
• Access to vulnerability databases
• Access to SIEM
• Access to vulnerability management platform
• Incident or tracking ticket created

2. Step-by-Step Instructions

1. Review Vulnerability Details

   • Collect:
     • CVE identifier
     • Vendor advisory
     • CVSS score
     • Vulnerability description
     • Exploitation requirements
   • Document key vulnerability characteristics.

2. Review Public Threat Intelligence

   • Review:
     • CVE databases
     • Security advisories
     • Threat intelligence reports
     • Security researcher publications
   • Document relevant findings.

3. Determine Exploit Availability

   • Assess whether:
     • Public proof-of-concept code exists
     • Functional exploit code exists
     • Metasploit modules exist
     • Exploit kits include the vulnerability
   • Document findings.

4. Identify Active Exploitation Activity

   • Determine whether:
     • Active exploitation has been reported
     • Exploitation campaigns are ongoing
     • Threat actors are targeting the vulnerability
     • Mass scanning activity has been observed
   • Document findings.

5. Identify Threat Actors

   • Review intelligence reporting to determine:
     • Known threat actor usage
     • Ransomware group activity
     • Nation-state activity
     • Criminal exploitation activity
   • Document associated threat actors.

6. Assess Attacker Objectives

   • Determine whether exploitation commonly results in:
     • Remote code execution
     • Credential theft
     • Initial access
     • Privilege escalation
     • Data exfiltration
     • Ransomware deployment
   • Document expected attacker objectives.

7. Assess Industry Targeting

   • Determine whether:
     • Specific industries are being targeted
     • Similar organisations have been affected
     • Industry-specific campaigns are active
   • Document findings.

8. Assign Threat Rating

   • Assess:
     • Exploit availability
     • Active exploitation status
     • Threat actor interest
     • Likelihood of exploitation
   • Assign a threat rating and confidence level.

9. Develop Intelligence Summary

   • Summarise:
     • Active exploitation status
     • Threat actor activity
     • Exploit availability
     • Industry relevance
     • Overall threat assessment
   • Prepare recommendations for stakeholders.

10. Escalate and Hand Off

    • Provide findings to the Incident Commander and Technical Lead.
    • Escalate to:
      • Exploitation Verification
      • Vulnerability Exposure Reduction
      • Active Exploitation response activities (if required)
    • Update the incident record with all findings.

3. Post-Action

• Ensure all intelligence sources are documented.
• Preserve supporting intelligence reports and references.
• Record threat ratings and confidence levels.
• Attach the intelligence assessment to the incident record.
• Update risk assessments as new intelligence becomes available.
• Support remediation and containment activities as required.

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Contributed to the Arcana Incident Response Documentation Framework.