Set an Exploit to Catch an Exploit: Compiling Public Proofs of Concept into Threat Hunting Rules

Muhammad Shoaib, Alexander Suh, Joshua Andrew Tomiak +1

Public exploit code for a newly disclosed vulnerability usually appears before any published rule that detects its exploitation. Of the 45 CVEs we evaluate, 37 ever received a Sigm…