<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-zero-day-vulnerability-indicators
description: >-
  Detect indicators of zero-day vulnerability exploitation through anomaly-based
  monitoring, canary deployments, behavioral analysis, and threat intelligence
  correlation before CVE assignment and patch availability.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - zero-day
  - threat-detection
  - anomaly-detection
  - threat-intelligence
  - behavioral-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Detecting Zero-Day Vulnerability Indicators

## Overview

Zero-day vulnerabilities have no CVE, no patch, and often no signature. Detection
relies on behavioral anomalies, exploitation artifacts, threat intelligence feeds,
and honeypot/canary signals. This skill covers proactive detection strategies that
surface exploitation indicators before the security community has formal advisories.

## Prerequisites

| Requirement | Install |
|---|---|
| Suricata | `apt install suricata` |
| YARA | `apt install yara` |
| nuclei | `go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest` |
| Python 3.10+ | Agent tooling |
| Sigma | `pip install sigma-cli` |
| OpenCanary | `pip install opencanary` |

## Key Concepts

### Behavioral Anomaly Detection

```yaml
# Sigma — Unusual child process from web server
title: Web Server Spawning Suspicious Child Process
id: 3b8f4a2c-9d1e-4f7b-a3c6-8e2d1f5b4a7c
status: experimental
description: Detects web server processes spawning shells — possible zero-day exploitation
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/nginx'
      - '/apache2'
      - '/httpd'
      - '/java'
      - '/node'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/perl'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - CGI scripts (should be inventoried and excluded by path)
  - Health check scripts executed via web server
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
```

### Suricata Anomaly Rules

```yaml
# /etc/suricata/rules/zero-day-indicators.rules

# Detect unusual outbound connections from DMZ servers
alert tcp $DMZ_SERVERS any -> $EXTERNAL_NET any (
  msg:"POSSIBLE ZERO-DAY — DMZ server initiating outbound connection";
  flow:to_server,established;
  threshold: type threshold, track by_src, count 5, seconds 60;
  classtype:trojan-activity;
  sid:9000001; rev:1;
)

# Detect encoded payloads in HTTP requests
alert http any any -> $HOME_NET any (
  msg:"POSSIBLE ZERO-DAY — Base64 encoded payload in URI";
  content:"base64"; http_uri; nocase;
  pcre:"/[A-Za-z0-9+\/]{50,}={0,2}/U";
  classtype:web-application-attack;
  sid:9000002; rev:1;
)
```

### YARA Rules for Exploit Artifacts

```yara
rule ZeroDay_WebShell_Indicator {
    meta:
        description = "Detects common webshell patterns from zero-day exploitation"
        severity = "critical"
        author = "defconxt"
    strings:
        $eval1 = "eval(base64_decode(" ascii nocase
        $eval2 = "eval($_POST[" ascii nocase
        $cmd1 = "passthru(" ascii nocase
        $cmd2 = "shell_exec(" ascii nocase
        $cmd3 = "system($_GET" ascii nocase
        $obf1 = /\$[a-z]{1,3}=chr\(\d+\)\.chr\(\d+\)/ ascii
    condition:
        any of ($eval*) or any of ($cmd*) or $obf1
}
```

### Canary-Based Detection

```bash
# Deploy OpenCanary honeypot to detect probing
opencanaryd --start --config /etc/opencanary/opencanary.conf

# Monitor canary alerts
tail -f /var/log/opencanary/opencanary.log | \
  jq 'select(.logtype == "opencanary.alert") | {src_host, dst_port, logdata}'

# nuclei — scan for recently disclosed zero-day templates
nuclei -u https://target.example.com -tags 0day,recent -severity critical \
  -json -o zero_day_check.json
```

### Threat Intelligence Correlation

```bash
# Query OTX for recent pulses mentioning zero-day
curl -s -H "X-OTX-API-KEY: $OTX_KEY" \
  "https://otx.alienvault.com/api/v1/search/pulses?q=zero-day&limit=10" | \
  jq '.results[] | {name, created, tags, indicators_count}'

# Check IP against threat feeds
curl -s "https://api.abuseipdb.com/api/v2/check?ipAddress=$SUSPECT_IP" \
  -H "Key: $ABUSEIPDB_KEY" -H "Accept: application/json" | \
  jq '{ip: .data.ipAddress, score: .data.abuseConfidenceScore, reports: .data.totalReports}'
```

## Workflow

1. **Baseline** — Establish normal behavior profiles for critical services
2. **Monitor** — Deploy Sigma rules, Suricata anomaly rules, and YARA scans
3. **Canary** — Place honeypots near high-value assets to detect probing
4. **Correlate** — Cross-reference anomalies with threat intelligence feeds
5. **Investigate** — Triage alerts: confirm exploitation vs. false positive
6. **Contain** — Apply virtual patching (WAF rules, network segmentation) pending vendor fix

## Verification

| Check | Method |
|---|---|
| Sigma rules loaded | `sigma check rule.yml` returns valid |
| Suricata rules active | `suricatasc -c rule-reload-rules` succeeds |
| YARA scanning | `yara -r rules.yar /var/www/` produces output |
| Canary responsive | `opencanaryd --status` shows running |
| TI feeds current | API responses contain data from last 24h |

## References

- [MITRE ATT&CK T1190 — Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)
- [Suricata Rule Documentation](https://docs.suricata.io/en/latest/rules/)
- [YARA Documentation](https://yara.readthedocs.io/)
- [OpenCanary](https://github.com/thinkst/opencanary)
