Attack Timing Intelligence

5 automated security scanners

Activity Spike Correlation

Purpose: The Activity Spike Correlation Scanner is designed to detect attack campaigns, seasonal targeting, and event-driven attacks by analyzing activity spikes in web traffic, security logs, and public disclosures. It aims to identify patterns that suggest coordinated or timed attacks based on specific events or seasons.

What It Detects:

Seasonal Attack Patterns: Identifies increased attack attempts during holiday seasons or fiscal quarters.
Event-Driven Attacks: Correlates spikes in activity with major company events, such as product launches or mergers and acquisitions.
Campaign Detection: Recognizes repeated patterns of attacks over time that indicate a coordinated campaign.
Public Disclosure Analysis: Scans for mentions of security incidents in public statements to correlate with traffic spikes.
Log Anomaly Detection: Analyzes server logs for unusual activity that may indicate an attack.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com) - This parameter is essential for identifying the web traffic and public disclosures related to the company’s activities.
company_name (string): Company name for statement searching (e.g., “Acme Corporation”) - This input helps in filtering relevant information from public statements, making it easier to correlate events with the company’s operations.

Business Impact: The scanner is crucial for proactive security measures as it helps in identifying potential threats that could lead to significant disruptions or data breaches. By detecting seasonal spikes and event-driven attacks, organizations can better prepare their defenses against known patterns of malicious activity.

Risk Levels:

Critical: Conditions that directly indicate a severe cyber threat, such as unauthorized access attempts on the system or public disclosures of security incidents without prior warning.
High: Significant spikes in traffic or unusual activities observed in server logs that could be indicative of an attack but do not necessarily pose immediate critical threats.
Medium: Moderate increases in activity patterns that might suggest targeted attacks during specific events, requiring attention for further investigation and mitigation strategies.
Low: Minimal fluctuations in normal operations that can be attributed to routine activities or legitimate traffic spikes without clear indications of malicious intent.
Info: Informal findings related to seasonal trends or minor anomalies detected through public disclosures that do not significantly impact the security posture but are still worth monitoring for future analysis.

If specific risk levels are not detailed in the README, it can be inferred that critical and high risks would typically indicate severe threats requiring immediate attention, while medium and low risks suggest manageable issues that could be addressed with routine updates or adjustments to detection mechanisms.

Example Findings: The scanner might flag a significant spike in login attempts around product launch dates as an example of how it detects event-driven attacks. Additionally, seasonal spikes in certain types of cyber threats during holiday seasons would also be considered critical findings due to the heightened risk period for such activities.

Maintenance Window Exploitation

Purpose: The Maintenance Window Exploitation Scanner is designed to identify potential vulnerabilities and weaknesses in a company’s security posture during scheduled downtimes or change windows. By analyzing mentions of planned outages, maintenance schedules, and related policies within the company’s documentation and public pages, this scanner helps organizations assess whether their downtime periods are being exploited for malicious activities.

What It Detects:

Scheduled Downtime Indicators: The scanner identifies mentions of scheduled downtimes, maintenance windows, or planned outages in company documents and policy pages. Key patterns include “scheduled downtime,” “maintenance window,” and “planned outage.”
Change Window Targeting Patterns: This detection point focuses on identifying references to change management processes that could be exploited during downtime periods. Examples of such patterns are “change management,” “change request,” and “deployment schedule.”
Security Policy Gaps During Downtime: The scanner looks for gaps in security policies related to maintenance or change windows, particularly focusing on mentions of incident response, data protection, and access control within these documents.
Compliance Certifications and Maturity Indicators: By checking for compliance certifications such as SOC 2, ISO 27001, penetration tests, and vulnerability scans during downtime periods, the scanner helps identify potential weaknesses in security practices.
Trust Center Information: The scanner analyzes information provided in trust centers regarding security practices and operational resilience to detect any indications of risks or vulnerabilities during downtimes.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com) - This is the main website address that will be scanned for potential issues related to downtime periods.
company_name (string): Company name for statement searching (e.g., “Acme Corporation”) - Used in search queries to find relevant company documents and policies.

Business Impact: Identifying vulnerabilities during maintenance or change windows is crucial as it can directly impact a company’s operational efficiency, customer trust, and regulatory compliance. Early detection of potential issues through this scanner helps organizations mitigate risks associated with downtime exploitation, ensuring better security posture and resilience against cyber threats.

Risk Levels:

Critical: Conditions that are absolutely critical to address immediately as they pose an immediate threat to the company’s operations or assets.
High: Important conditions that require high attention due to their significant impact on security practices but may not be time-critical for immediate action.
Medium: Conditions that should still be addressed, albeit with a lower urgency compared to critical issues.
Low: Informative findings that provide valuable insights but do not necessarily indicate urgent risks or vulnerabilities.
Info: Informational findings that are useful for understanding the overall security landscape but may not directly impact risk assessment.

Example Findings:

The company’s maintenance policy mentions a scheduled downtime next week, which lacks specific details about what systems will be affected and how long the downtime will last.
A public document references a change management process without detailing any security measures or procedures during this transition period.

This structure provides a comprehensive overview of the scanner’s purpose, detection capabilities, required inputs, business impact, risk levels, and illustrative findings based on typical scenarios from the internal README documentation.

Business Cycle Targeting

Purpose: The Business Cycle Targeting Scanner is designed to identify potential vulnerabilities and increased operational changes in organizations during financial reporting periods, M&A activities, and product launches. By analyzing SEC filings, M&A announcements, new product releases, subdomain discovery from Certificate Transparency logs, and job board analysis for technology stack disclosures, this scanner aims to detect attack windows where cybersecurity focus may be diminished.

What It Detects:

Financial Reporting Periods: Identifies quarterly and annual financial reporting cycles, with a particular focus on SEC filings that indicate upcoming or recent earnings reports.
M&A Activity: Discovers mergers and acquisition announcements by searching for relevant news articles and press releases.
Product Launches: Detects new product launches through analysis of company websites and social media platforms, including mentions in press releases, blog posts, and marketing materials.
Subdomain Discovery: Uncovers subdomains using Certificate Transparency logs to assess potential vulnerabilities or unusual activities associated with these domains.
Job Board Analysis: Scrapes job boards to identify changes in technology stack or hiring patterns that may indicate new projects or expansions within the organization.

Inputs Required:

domain (string): The primary domain of the organization under analysis, which is used for searching SEC filings and detecting subdomains.
company_name (string): The official name of the company, essential for specific searches such as M&A activity tracking and earnings statement lookups via SEC EDGAR.

Business Impact: This scanner’s findings are crucial for security teams to monitor organizational vulnerabilities during critical business periods. By identifying potential attack windows, organizations can prioritize cybersecurity efforts and mitigate risks associated with heightened operational changes and reduced focus on traditional cyber defenses.

Risk Levels:

Critical: Findings that directly impact high-profile financial reporting cycles or significant M&A activities may be considered critical if they reveal imminent deadlines for sensitive information disclosure.
High: Issues detected during product launch periods, such as sudden changes in website content related to new products, are considered high risk due to the direct involvement of customer-facing operations and potential impact on market positioning.
Medium: Subdomain discoveries that suggest increased activity or unusual access patterns could be considered medium risk if they indicate broader operational shifts not previously reported by the organization.
Low: Job board analysis findings, while informative about internal changes, are generally considered low risk unless specific technologies mentioned indicate significant strategic shifts in a highly regulated industry.
Info: Informational findings such as routine updates to job descriptions or minor subdomain additions might be labeled as informational if they do not directly impact the organization’s security posture significantly.

If detailed risk levels are not specified, inferred risk levels could include:

Critical: Imminent financial reporting periods where any deviation from normal activity patterns would be highly significant.
High: Major M&A announcements or product launches that disrupt usual business operations and cybersecurity practices.
Medium: Subdomain additions or changes in technology stack disclosures during routine maintenance phases, which could still indicate operational adjustments.
Low: Minor updates to job descriptions that do not reflect broader strategic shifts but may suggest internal restructuring.
Info: Routine activities like domain name system (DNS) updates or minor subdomain discoveries that are part of standard business operations.

Example Findings:

During the financial reporting period for Acme Corporation, unusual spikes in DNS queries were detected on critical subdomains, potentially indicating internal pressure to disclose sensitive information ahead of schedule.
A recent M&A announcement by XYZ Corp led to a significant increase in outbound network traffic from the acquisition target’s servers, raising concerns about potential data exfiltration attempts during integration phases.

Workforce Movement Impact

Purpose: The Workforce Movement Impact Scanner is designed to identify potential security risks associated with high employee churn and frequent changes in the workforce by analyzing public records, job boards, and other OSINT sources. This tool helps organizations detect staff turnover periods and contractor cycling within their organization.

What It Detects:

Staff Turnover Detection: Identifies recent job postings indicating high turnover rates and looks for patterns suggesting mass layoffs or restructuring.
Contractor Cycling Identification: Monitors job boards for frequent hiring of contractors and detects repeated postings for similar contractor roles within a short timeframe.
LinkedIn Activity Analysis: Analyzes LinkedIn profiles and company pages for recent changes in staff, including new hires, promotions, and departures.
SEC Filings Review: Examines SEC filings for mentions of workforce changes or restructuring, particularly focusing on risk factor disclosures related to employee turnover.
News Coverage Monitoring: Searches news articles for reports on company layoffs, hiring sprees, or organizational changes, detecting patterns indicating significant workforce movement.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: This scanner is crucial as high employee turnover and frequent contractor changes can lead to significant security risks, including data泄露、业务中断和声誉损害。 It helps organizations proactively assess their workforce stability and take necessary measures to mitigate potential threats.

Risk Levels:

Critical: Conditions that directly indicate imminent layoffs or restructuring with no prior warning signs are critical.
High: Significant changes in staffing patterns, such as mass layoffs or restructuring without clear communication from management, are high risk.
Medium: Frequent hiring of contractors or repeated postings for similar roles could be indicative of business needs but still warrant attention.
Low: Minor fluctuations in staff and contractor numbers that do not significantly impact organizational stability can be considered low risk.
Info: Informational findings about minor job changes or occasional contractor hires are considered informational.

Example Findings:

The scanner might flag a critical finding if it detects mass layoffs mentioned in SEC filings without prior indications from management. A high-risk example would involve multiple job postings for the same role on job boards, suggesting potential instability.

Geopolitical Timing Correlation

Purpose: The Geopolitical Timing Correlation Scanner is designed to identify and analyze political events, regulatory changes, and international tensions that could potentially impact a company’s cyber security posture. By monitoring mentions in various sections of the company’s website, including its trust center pages, this scanner helps in assessing potential risks associated with geopolitical factors influencing cyber threats and vulnerabilities.

What It Detects:

Political Event Mentions: Identifies mentions of significant political events or elections that might affect the company’s operations.
Regulatory Changes: Looks for references to new laws, regulations, or compliance requirements that could impact the company’s security policies.
International Tensions: Detects discussions about geopolitical tensions, conflicts, or diplomatic issues that may pose risks to the company.
Policy Updates: Identifies updates or changes in company security policies related to geopolitical factors.
Trust Center Information: Scans trust center pages for any mentions of geopolitical events affecting the company’s security stance.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com) - This is necessary to search and monitor relevant information across different sections of the company’s website.
company_name (string): Company name for statement searching (e.g., “Acme Corporation”) - Used in searches to ensure that findings are specific to the organization being analyzed.

Business Impact: Understanding how geopolitical events and regulatory changes can impact cyber threats is crucial for maintaining a robust security posture. By detecting such events early, companies can proactively adjust their strategies to mitigate potential risks and protect sensitive information.

Risk Levels:

Critical: Severe geopolitical tensions or significant regulatory updates that directly affect critical infrastructure or compliance requirements are considered critical.
High: Notable political events or changes in regulations that significantly influence business operations and could lead to substantial risk exposure.
Medium: Minor political mentions or minor regulatory adjustments that may require monitoring but do not pose immediate high risks.
Low: Informal discussions or tangential impacts on security policies, generally considered less impactful than higher risk levels.
Info: Minimal references that are primarily informational and unlikely to affect the company’s security posture significantly.

If specific risk levels are not detailed in the README, they have been inferred based on the general implications of each detection type.

Example Findings:

The scanner might flag a mention of “geopolitical tensions escalating in Asia” as an international tension, indicating potential risks to business operations.
A reference to “upcoming GDPR compliance requirements” could be flagged as a regulatory change, highlighting the need for immediate attention to policy updates.