HB-04Level 4 · Breach scenarioDBIR: System Intrusion · VERIS: Hacking
Vulnerability exploitation
- Level 4 · Breach scenario
- 7 signals
- 2 risk domains
A breach that begins with an exploited vulnerability on a device or an internet-facing system, where the human contribution is the deferred patch, the unmanaged device or the exception that kept it exposed.
Classification
- Fed by risk domains One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Dimensions Every signal answers one of 3 questions.
- Evidence level
- Anchor
-
- DBIR: System Intrusion · VERIS: Hacking
- NIST CSF 2.0
-
- ID.RA-01
- PR.PS-02
- MITRE ATT&CK
-
- T1190
- T1133
-
0
Sequences
End in this breach scenario.
-
3
Cohorts
Predict it.
-
7
Signals
Feed it.
-
2
Risk domains
Where those signals come from.
Sequences that lead here
No sequence ends here.
None of the 11 sequences in this version ends in Vulnerability exploitation. The 3 cohorts below predict it, and 7 signals feed it.
-
CR-EP-02
Malicious-site visitor on a vulnerable device
WC-B-01 + EP-T-02
-
CR-EP-03
Patch deferrer owning internet-facing systems
EP-B-06 + EP-A-02
-
CR-RR-01
Exception holder who clicks
RR-A-01 + SE-B-04
The definition, in detail
Definition
It is counted inside the System Intrusion pattern in the Verizon DBIR and the Hacking action in VERIS.
Example
An edge device whose owner postponed a critical patch four times is exploited the week after the proof of concept is published.
How it is measured
- Anchor
- DBIR: System Intrusion · VERIS: Hacking
- SOC signals
- Vulnerability exceptions, exploit alerts
- Fed by
- 7 signals across 2 risk domains
How it is used
Programs measure toward Vulnerability exploitation by counting the 7 signals, 3 cohorts and 0 sequences that point to it, and tie them to the incidents the SOC records as vulnerability exceptions, exploit alerts.
A breach scenario names what the evidence beneath it points toward. The organization’s own incidents confirm it; the signals, cohorts and sequences show where it is likely.
Technical mappings
Framework mappings; validate for your use case.
Continue exploring
"Vulnerability exploitation" (HB-04), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/breach-scenarios/hb-04-vulnerability-exploitation
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one breach scenario.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.