Identifying Exploited and Likely-to-Be-Exploited Vulnerabilities
summary
VulnCheck describes a workflow that finds exploited or likely-to-be-exploited bugs lacking CVEs by correlating live evidence, exploit code, vendor advisories, detection telemetry and third-party feeds such as ShadowServer. The team audits sources, maps findings (about 200 un-CVEd Metasploit modules), assigns identifiers (151 CVEs from ~800 candidates), builds vulnerable containers and detections to validate exploitation, and uses a short-form dibs process to coordinate CNA assignment and push high-confidence issues into CISA KEV.
AI-written summary · about
chapters (15)
- 0:00Speakers and VulnCheck
- 1:07VulnCheck research and CVE services
- 3:13Known exploited vulnerabilities
- 5:19Shadow Server tracking
- 7:07Exploited vulnerabilities without CVEs
- 9:55Metasploit modules as exploitation
- 13:28Security advisories and disclosure
- 15:11CVE coordination process
- 16:57Adding to CISA KEV
- 17:18Coordinating with Project Discovery
- 19:26CVE assignment conflicts
- 22:36Vulnerability reports in forums
- 24:47One year of CVE assignments
- 26:54Auditing Exploit DB modules
- 27:39Q&A
related talks
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
58mCISA’s Known Exploited Vulnerabilities (KEV) Catalog
27mExploited CVEs of 2024: Lessons for Vendors and Defenders
57mSeeing the Vulnerable Forest Through the Exploited Trees
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
15mKeynote
28mAdversarial Intelligence: Redefining Application Security Through the Eyes of an Attacker