Active Exploitation

1. Purpose & Scope

• Purpose:

  Provide a structured response for confirmed vulnerability exploitation. Use this playbook to validate exploitation evidence, scope affected assets, preserve evidence, contain attacker access, eradicate persistence, and coordinate recovery.

• Scope:

  Applies when exploitation is confirmed against organisational systems, applications, endpoints, cloud workloads, SaaS platforms, network services, exposed infrastructure, or third-party managed environments.

2. Incident Identification & Criteria

Incident Type: Active Exploitation

Trigger Conditions:

Initiate this playbook when any of the following occur:

• Successful exploitation is confirmed by telemetry, forensic evidence, vendor notification, or responder validation
• Exploit activity results in code execution, web shell deployment, credential access, persistence, data access, privilege escalation, or lateral movement
• Threat actor activity is observed on an asset affected by a known vulnerability or misconfiguration
• Active exploitation is confirmed after vulnerability or zero-day response triage

Severity Levels:

3. Roles & Responsibilities

• Incident Commander: Sets severity, coordinates response, approves containment, and owns escalation decisions.
• Technical Lead: Directs investigation, containment, eradication, and recovery across affected teams.
• Incident Responder / Forensic Analyst: Validates exploitation, preserves evidence, scopes affected assets, and analyses attacker activity.
• Communications Lead: Coordinates internal, executive, legal, customer, vendor, and stakeholder communications.
• Other Roles:
  • Vulnerability Management Team: Confirms vulnerability details, affected versions, remediation options, and patch status.
  • System / Application Owners: Support asset validation, service impact analysis, containment, patching, and recovery.
  • Cloud / Network / Platform Teams: Support infrastructure containment, logging, segmentation, and provider coordination.
  • Legal / Compliance: Assesses customer, regulatory, contractual, or law enforcement obligations.

4. Initial Actions

• Immediate Steps:

  • Validate that exploitation was successful, not merely attempted.
    • 📘 RB-TRIAGE-007: Active Exploitation Validation
  • Triage associated endpoint, identity, cloud, or web alerts as applicable.
    • 📘 RB-TRIAGE-002: EDR Alert Triage
    • 📘 RB-TRIAGE-003: Identity Alert Triage
    • 📘 RB-TRIAGE-011: Cloud Platform Alert Triage
    • 📘 RB-TRIAGE-012: Web Application Attack Triage
  • Identify affected asset, vulnerability, exploit path, first observed time, and whether exploitation is ongoing.
  • Preserve evidence before disruptive containment where safe.
  • Engage IR leadership, system owners, application owners, platform teams, and vulnerability management.
    • 📘 SOP-001: Paging an Engineering Team's On-Call

  Decision Point:

  • If exploitation is not confirmed → continue under PB-017: Vulnerability Response or PB-018: Zero-Day Response, as applicable.
  • If exploitation is confirmed → continue this playbook and begin containment planning.
  • If attacker activity is ongoing → contain affected access paths in parallel with evidence preservation.

5. Investigation & Analysis

Common Failure Modes:

• Treating attempted exploitation as confirmed exploitation without evidence
• Containing before preserving volatile evidence when safe preservation is possible
• Focusing only on patching while missing persistence or follow-on attacker activity
• Failing to scope additional affected assets
• Restoring systems before validating exploit path closure

• Evidence Collection:

  • Collect host, process, command-line, file, persistence, and endpoint telemetry for affected systems.
    • 📘 RB-EVIDENCE-002: Host-Based Log Acquisition
  • Collect identity, authentication, MFA, session, and privileged access telemetry.
    • 📘 RB-EVIDENCE-003: Identity & Authentication Log Acquisition
  • Collect cloud control plane, workload snapshot, or web application logs where relevant.
    • 📘 RB-EVIDENCE-004: Cloud Control Plane Log Acquisition
    • 📘 RB-EVIDENCE-005: Cloud Workload Snapshot Acquisition
    • 📘 RB-EVIDENCE-006: Web Application Log Acquisition

• Analysis Steps:

  • Analyse exploitation timeline, exploit vector, payloads, attacker actions, and post-exploitation behaviour.
    • 📘 RB-ANALYSIS-034: Exploitation Activity Analysis
  • Identify initial and additional affected assets.
    • 📘 RB-ANALYSIS-035: Affected Asset Identification
  • Verify the vulnerability exploited, affected versions, exposure path, and whether exploitation is repeatable.
    • 📘 RB-ANALYSIS-041: Exploitation Verification
  • Analyse process trees, commands, scripts, LOLBins, malware, persistence, and outbound traffic as applicable.
    • 📘 RB-ANALYSIS-006: Process Tree Analysis
    • 📘 RB-ANALYSIS-023: Command-Line Analysis
    • 📘 RB-ANALYSIS-024: LOLBin Abuse Investigation
    • 📘 RB-ANALYSIS-025: Script Execution Analysis
    • 📘 RB-ANALYSIS-014: Malware Persistence Mechanism Hunt
    • 📘 RB-ANALYSIS-015: Malware Analysis
    • 📘 RB-ANALYSIS-018: Outbound Traffic Analysis
  • Assess whether sensitive data was accessed, staged, or exfiltrated.
    • 📘 RB-ANALYSIS-019: Data Staging Investigation
    • 📘 RB-ANALYSIS-021: Sensitive Data Impact Assessment

  Decision Point: Run the post-detection phases (Analysis → Recovery) of any relevant sibling playbook concurrently alongside this one based on what was observed:

  • If malware or suspicious execution is identified → execute PB-003: Endpoint Malware Infection or PB-011: Suspicious Execution concurrently.
  • If account compromise or credential abuse is identified → execute PB-004: Account Takeover concurrently.
  • If data exposure, staging, or exfiltration is identified → execute PB-005: Data Exfiltration concurrently.
  • If cloud compromise is identified → execute PB-007: Cloud Compromise concurrently.
  • If web application compromise is identified → execute PB-008: Web Application Attack concurrently.
  • If privilege escalation is identified → execute PB-009: Privilege Escalation concurrently.
  • If lateral movement is identified → execute PB-010: Lateral Movement concurrently.
  • If exploitation is widespread or business-critical → execute PB-019: Major Security Incident Management concurrently.

6. Containment, Eradication & Recovery

• Containment Actions:

  • Reduce or block exploitation paths using network, application, cloud, access, and exposure controls.
    • 📘 RB-CONTAIN-012: Exploitation Surface Containment
  • Isolate affected hosts, workloads, or application access where compromise is confirmed or integrity is uncertain.
    • 📘 RB-CONTAIN-004: Host Isolation
    • 📘 RB-CONTAIN-015: Cloud Workload Isolation
    • 📘 RB-CONTAIN-016: Web Application Access Restriction
  • Lock compromised accounts and revoke sessions/tokens where identity abuse is suspected.
    • 📘 RB-CONTAIN-001: Account Lockdown
    • 📘 RB-CONTAIN-005: Session & Token Revocation
  • Apply vulnerability exposure reduction controls if the exploited weakness remains present.
    • 📘 RB-CONTAIN-014: Vulnerability Exposure Reduction

• Eradication Steps:

  • Remove web shells, malware, persistence, unauthorised accounts, attacker tooling, modified files, exposed secrets, and backdoors.
  • Patch, reconfigure, disable, or replace vulnerable components once containment is stable.
  • Rotate credentials, keys, certificates, and tokens exposed through exploitation.

• Recovery Steps:

  • Rebuild or restore compromised systems where integrity cannot be validated.
    • 📘 RB-RECOVERY-002: Clean System Rebuild
  • Coordinate staged restoration of affected services and dependencies.
    • 📘 RB-RECOVERY-001: Recovery & Restoration Coordination
  • Validate remediation and confirm the exploited vulnerability is no longer exploitable.
    • 📘 RB-RECOVERY-007: Vulnerability Remediation Validation

7. Communication & Escalation

• Internal Communication:

  • Notify security leadership, vulnerability management, system owners, application owners, platform owners, and impacted business teams.
  • Use geo handoff where the incident spans shifts.
    • 📘 SOP-002: Incident Handoff Between Geos

• External Communication:

  • Coordinate customer, regulator, legal, executive, vendor, provider, and law enforcement communications through approved processes.
    • 📘 SOP-003: Escalation, Legal & Executive Communications
    • 📘 SOP-005: Vendor Communication During a Security Incident

• Escalation Criteria:

  Condition	Escalate To
  Malware or suspicious execution identified	PB-003: Endpoint Malware Infection / PB-011: Suspicious Execution
  Account compromise or credential abuse identified	PB-004: Account Takeover
  Data exposure, staging, or exfiltration identified	PB-005: Data Exfiltration
  Cloud compromise identified	PB-007: Cloud Compromise
  Web application compromise identified	PB-008: Web Application Attack
  Privilege escalation identified	PB-009: Privilege Escalation
  Lateral movement identified	PB-010: Lateral Movement
  Widespread exploitation or major business impact	PB-019: Major Security Incident Management

8. Post-Incident Activities

• Lessons Learned:

  • Conduct a PIR covering vulnerability exposure, detection timing, attacker actions, containment speed, remediation quality, and recovery decisions.
  • Review patch management, exposure management, detection coverage, logging, segmentation, and asset inventory gaps.

• Documentation Updates:

  • Update detections, vulnerable asset inventory, remediation records, runbooks, and this playbook based on lessons learned.

9. References & Linked Resources

• Playbooks:

  • PB-003: Endpoint Malware Infection
  • PB-004: Account Takeover
  • PB-005: Data Exfiltration
  • PB-007: Cloud Compromise
  • PB-008: Web Application Attack
  • PB-009: Privilege Escalation
  • PB-010: Lateral Movement
  • PB-011: Suspicious Execution
  • PB-017: Vulnerability Response
  • PB-018: Zero-Day Response
  • PB-019: Major Security Incident Management

• Runbooks:

  • RB-TRIAGE-002: EDR Alert Triage
  • RB-TRIAGE-003: Identity Alert Triage
  • RB-TRIAGE-007: Active Exploitation Validation
  • RB-TRIAGE-011: Cloud Platform Alert Triage
  • RB-TRIAGE-012: Web Application Attack Triage
  • RB-EVIDENCE-002: Host-Based Log Acquisition
  • RB-EVIDENCE-003: Identity & Authentication Log Acquisition
  • RB-EVIDENCE-004: Cloud Control Plane Log Acquisition
  • RB-EVIDENCE-005: Cloud Workload Snapshot Acquisition
  • RB-EVIDENCE-006: Web Application Log Acquisition
  • RB-ANALYSIS-006: Process Tree Analysis
  • RB-ANALYSIS-014: Malware Persistence Mechanism Hunt
  • RB-ANALYSIS-015: Malware Analysis
  • RB-ANALYSIS-018: Outbound Traffic Analysis
  • RB-ANALYSIS-019: Data Staging Investigation
  • RB-ANALYSIS-021: Sensitive Data Impact Assessment
  • RB-ANALYSIS-023: Command-Line Analysis
  • RB-ANALYSIS-024: LOLBin Abuse Investigation
  • RB-ANALYSIS-025: Script Execution Analysis
  • RB-ANALYSIS-034: Exploitation Activity Analysis
  • RB-ANALYSIS-035: Affected Asset Identification
  • RB-ANALYSIS-041: Exploitation Verification
  • RB-CONTAIN-001: Account Lockdown
  • RB-CONTAIN-004: Host Isolation
  • RB-CONTAIN-005: Session & Token Revocation
  • RB-CONTAIN-012: Exploitation Surface Containment
  • RB-CONTAIN-014: Vulnerability Exposure Reduction
  • RB-CONTAIN-015: Cloud Workload Isolation
  • RB-CONTAIN-016: Web Application Access Restriction
  • RB-RECOVERY-001: Recovery & Restoration Coordination
  • RB-RECOVERY-002: Clean System Rebuild
  • RB-RECOVERY-007: Vulnerability Remediation Validation

• SOPs:

  • SOP-001: Paging an Engineering Team's On-Call
  • SOP-002: Incident Handoff Between Geos
  • SOP-003: Escalation, Legal & Executive Communications
  • SOP-005: Vendor Communication During a Security Incident

10. Appendices

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Contributed to the Arcana Incident Response Documentation Framework.