Attack Surface Evolution

5 automated security scanners

Defensive Bypass Research

Purpose: The Defensive Bypass Research Scanner is designed to detect EDR evasion and detection bypass techniques by analyzing domain-related threat intelligence feeds. It aims to identify potential security vulnerabilities and malicious activities associated with domains, helping organizations stay informed about the risks they may face.

What It Detects:

CVE Indicators: Identifies Common Vulnerabilities and Exposures (CVE) related to the domain, using patterns like CVE-[0-9]{4}-[0-9]+.
Malware Indicators: Detects mentions of malware, ransomware, or trojans in threat intelligence feeds, with patterns such as malware|ransomware|trojan.
Command and Control (C2) Indicators: Identifies references to command and control servers or channels, using patterns like command\\s*(?:and|&)\\s*control|c2|c&c.
Phishing and Credential Harvesting Indicators: Detects mentions of phishing attempts or credential harvesting activities, with patterns such as phishing|credential\\s+harvesting.
Exposure Indicators: Identifies indicators of data exposure, leaks, or breaches, including patterns like exposed|leaked|breached, unauthorized\\s+access, and data\\s+dump.

Inputs Required:

domain (string): The primary domain to analyze, such as acme.com.

Business Impact: This scanner is crucial for organizations aiming to enhance their security posture by proactively identifying potential vulnerabilities and malicious activities associated with domains. Understanding these risks can help in implementing preventive measures and improving overall cybersecurity strategies.

Risk Levels:

Critical: Findings that directly indicate critical vulnerabilities or imminent threats should be considered critical, such as known exploits of unpatched CVE vulnerabilities.
High: High-risk findings include widespread malware indicators, significant exposure to data breaches, or highly probable phishing activities.
Medium: Medium-risk findings involve less severe vulnerabilities or suspicious but not yet confirmed malicious activities.
Low: Informal and less impactful findings that may require further investigation for confirmation are considered low risk.
Info: Informational findings provide context about the domain’s reputation without immediate security implications.

Example Findings:

A CVE indicator of CVE-2021-44228 suggests a critical vulnerability in Apache Log4j2, which could be exploited for remote code execution.
Detection of malware or ransomware indicators might indicate an active compromise of the domain’s systems.

This structured approach helps users understand the scanner’s capabilities and limitations, guiding them on how to interpret its findings for effective security decision-making.

Novel Attack Vector Research

Purpose: The Novel Attack Vector Research Scanner is designed to detect cutting-edge techniques and new vulnerability classes by analyzing threat intelligence feeds from sources like Shodan, VirusTotal, CISA KEV, and the dark web. This tool helps organizations stay ahead of emerging threats by identifying novel attack vectors and previously unknown vulnerabilities.

What It Detects:

Emerging Threat Indicators:
- CVE Identifiers: Patterns matching CVE numbers (e.g., CVE-[0-9]{4}-[0-9]+).
- Malware Signatures: Keywords related to malware, ransomware, and trojans (e.g., malware|ransomware|trojan).
Command & Control Activity:
- C2 Indicators: Phrases indicating command and control activities (e.g., command\\s*(?:and|&)\\s*control|c2|c&c).
- Phishing Attempts: Keywords related to phishing and credential harvesting (e.g., phishing|credential\\s+harvesting).
Exposure Indicators:
- Data Breach Terms: Phrases indicating data breaches, leaks, or unauthorized access (e.g., exposed|leaked|breached).
- Access Control Issues: Keywords related to unauthorized access and data dumps (e.g., unauthorized\\s+access, data\\s+dump).
Known Exploited Vulnerabilities:
- CISA KEV Matches: Identifiers from the CISA Known Exploited Vulnerabilities list.
Dark Web Activity:
- Dark Web Indicators: Patterns and keywords indicating presence on dark web marketplaces or forums.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com).

Business Impact: Staying ahead of emerging threats is crucial for maintaining a robust security posture. This scanner helps organizations not only identify vulnerabilities but also anticipate and respond to novel attack vectors, ensuring that their defenses are always one step ahead of potential adversaries.

Risk Levels:

Critical: Conditions that directly lead to severe data breaches or the execution of zero-day exploits.
High: Conditions where sensitive information is exposed or unauthorized access points are identified.
Medium: Conditions indicating a medium level of risk, such as the presence of known vulnerabilities but no direct exposure to critical data.
Low: Informal findings that do not pose significant risks but may indicate potential areas for improvement in security practices.
Info: Non-critical findings providing informational insights into the domain’s online footprint without immediate threat implications.

Example Findings:

The scanner might flag a domain with multiple CVE identifiers, suggesting a high risk of known vulnerabilities being exploited.
It could also detect command and control activities indicating potential malicious use of the network for phishing or other illicit purposes.

Offensive Tool Development

Purpose: The VigilGuard Scanner is designed to identify custom exploitation attempts and targeted tooling by leveraging threat intelligence feeds. It analyzes domain data from various sources to detect potential security threats, ensuring organizations can proactively address vulnerabilities and mitigate risks.

What It Detects:

CVE Indicators: Identifies Common Vulnerabilities and Exposures (CVE) entries in the domain data, indicating known security issues that may be exploited.
Malware and Ransomware Indicators: Detects mentions of malware, ransomware, or trojans, which are common tools used in targeted attacks.
Command and Control (C2) Indicators: Identifies references to command and control servers, which attackers use to manage compromised systems.
Phishing and Credential Harvesting Indicators: Detects mentions of phishing attempts or credential harvesting activities, which are common methods for gaining unauthorized access.
Exposure Indicators: Identifies instances where data has been exposed, leaked, breached, or dumped, indicating potential security breaches.

Inputs Required:

domain (string): The primary domain to analyze (e.g., acme.com).

Business Impact: This scanner is crucial for organizations aiming to proactively detect and mitigate risks associated with custom exploitation attempts and targeted tooling. By identifying known vulnerabilities and malicious activities, the VigilGuard Scanner helps in securing networks against potential threats, ensuring a more robust security posture.

Risk Levels:

Critical: The scanner identifies critical indicators such as CVE entries that are actively exploited or highly probable to be exploited based on threat intelligence.
High: The scanner detects mentions of malware, ransomware, trojans, and other malicious tools commonly used in targeted attacks.
Medium: The scanner flags potential command and control servers indicating ongoing attacks or reconnaissance activities.
Low: Informational findings such as exposure indicators may not pose immediate threats but are indicative of potential vulnerabilities that require attention.
Info: Findings related to phishing attempts, credential harvesting, and other less severe forms of exploitation that might indicate preparatory stages for more significant security incidents.

Example Findings:

The scanner flags a domain mentioning “CVE-2021-44228” in its data, indicating the presence of a known vulnerability exploited by Apache Log4j, which poses a critical risk to systems using this software version.
A detected command and control server suggests ongoing malicious activities that could lead to unauthorized access or data breaches.

Vulnerability Research Capabilities

Purpose: The Vulnerability Research Capabilities Scanner is designed to detect zero-day discoveries and exploitation research by analyzing threat intelligence feeds to identify potential vulnerabilities and exposures in a given domain. This tool helps organizations stay informed about potential cyber threats, ensuring their security posture remains robust against emerging risks.

What It Detects:

CVE Identifiers: The scanner identifies Common Vulnerabilities and Exposures (CVE) identifiers in threat intelligence data, which are crucial for understanding known vulnerabilities in software and hardware products.
Malware Indicators: It detects mentions of malware, ransomware, or trojans in threat intelligence feeds, alerting users to potential malicious activities targeting the domain.
Command and Control (C2) References: The scanner identifies references to command and control servers or infrastructure, which are critical for understanding how cyber threats operate within a network.
Phishing and Credential Harvesting: It identifies mentions of phishing attacks or credential harvesting activities, crucial for protecting sensitive information from theft.
Exposure Indicators: The scanner detects indicators of data exposure, leaks, breaches, unauthorized access, and data dumps, which are critical for assessing the risk associated with compromised data.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com). This input is essential for directing the scanner’s analysis towards a specific target, ensuring focused assessment of potential vulnerabilities within that domain.

Business Impact: Understanding and addressing the vulnerabilities detected by this scanner is crucial for maintaining the integrity and security of digital assets. It helps organizations mitigate risks associated with cyber threats, protect sensitive information, and comply with regulatory requirements related to data protection.

Risk Levels:

Critical: Findings that indicate critical vulnerabilities or imminent threats should be addressed with immediate attention. This includes high-severity malware detections, unauthorized access attempts, and significant data exposure.
High: High-risk findings include the detection of malware and potential phishing activities that pose a substantial threat to security and data integrity.
Medium: Medium-risk findings involve moderate threats such as command and control references or exposure indicators that could lead to less severe consequences but still require attention.
Low: Low-risk findings are informational in nature, providing insights into minor vulnerabilities or potential risks that can be addressed at a later stage.
Info: These are purely informative and do not pose an immediate risk but provide valuable context for understanding the overall threat landscape of the domain.

Example Findings:

A critical vulnerability identified as CVE-2023-1234, which could lead to unauthorized access if exploited.
High-risk malware detected on command and control servers, indicating a significant security breach.

Attack Chaining Analysis

Purpose: The Attack Chaining Analysis Scanner is designed to detect multi-stage attacks and identify kill chain innovations by analyzing exposed services, vulnerabilities, and threat intelligence feeds. It aims to uncover potential attack vectors and track their evolution over time.

What It Detects:

Exposed Services and Vulnerabilities: Identifies open ports and services using the Shodan API and detects known vulnerabilities associated with these services from the NVD/CVE database.
Domain/IP Reputation: Evaluates domain reputation using the VirusTotal API and checks IP addresses for malicious activity using AbuseIPDB.
Known Exploited Vulnerabilities (KEV): Cross-references identified vulnerabilities against CISA KEV to determine if they are known exploited vulnerabilities.
Threat Intelligence Indicators: Searches for specific threat indicators such as CVE numbers, malware types, command and control references, and phishing activities. It also identifies exposure indicators like data breaches, unauthorized access, and data dumps.
Kill Chain Evolution: Analyzes the sequence of attack stages to identify innovative or evolving kill chain patterns by correlating different threat intelligence sources.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)

Business Impact: This scanner is crucial for organizations looking to enhance their cybersecurity posture by identifying potential vulnerabilities and attack vectors that could be exploited in multi-stage attacks. Understanding these risks allows for proactive measures to be taken to mitigate potential threats, protecting sensitive information and critical infrastructure from unauthorized access and data breaches.

Risk Levels:

Critical: Conditions where the scanner identifies a vulnerability with known exploitability through CISA KEV lists or other high-impact indicators.
High: Conditions where the scanner detects malware, command and control activities, or significant exposure to unauthorized access in domain content.
Medium: Conditions where the scanner identifies vulnerabilities associated with common services that could be exploited but do not meet critical severity criteria.
Low: Conditions where the scanner flags informational findings such as potential phishing activities or minor exposure indicators without immediate impact on security.
Info: Conditions where the scanner detects general threat intelligence signals, which may require monitoring for future developments but are currently of low risk.

Example Findings:

A critical finding could be a known vulnerability in an exposed service that has been confirmed as exploited by CISA.
A high finding might include detection of malware or command and control activity indicative of active exploitation attempts on the network.
A medium finding could involve exposure to unauthorized access through data breaches or leaked information from the domain’s web content.