Hunt

CISA Adds Six Known Exploited Vulnerabilities to Catalog

Hunt Strategy & Objective

Identify telemetry consistent with CISA Adds Six Known Exploited Vulnerabilities to Catalog.

⏱️ Lookback: 30 days

Observable activity related to Known may be present where the documented behavior occurred.

Windows macOS Linux Cloud

Publicly documented behavior and indicators only.

process creation network/DNS logs authentication logs

1 Scope: identify affected technologies and telemetry coverage.
2 SIEM/EDR Logic: run the attached Sigma, SPL, and KQL triage logic and pivot on cited indicators.
3 Triage & Containment: validate matches, isolate confirmed suspicious assets under local procedures, and preserve evidence.
4 Forensic Validation: confirm timestamps, parent-child process lineage, network pivots, and source provenance.

Query Pattern 1

Triage on keyword Known and cited indicators

✓

● Matches to cited public indicators or documented behavior

● Legitimate administrative or software activity

Preserve logs and timestamps

Confirm the source URL and evidence IDs

Corroborated matches across independent telemetry