Pre-CVE Threat Detection: 8 Examples Identifying Malicious Activity Prior to Public Disclosure of a Vulnerability

The article argues that anomaly-based threat detection is essential for identifying risks before public CVE disclosures, because vulnerability exploitation can precede disclosure and signatures alone may miss pre-exploitation activity. It highlights Darktrace’s autonomous, self-learning AI approach and real-world pre-CVE detections (e.g., Fortinet, Ivanti, ConnectWise, and SAP NetWeaver campaigns) to show how attackers operate days or weeks before vulnerabilities are announced. #Fortinet #PANOS #SAPNetWeaver #Ivanti #ConnectWise #Darktrace #ChinaBasedThreatActor

Keypoints

Anomaly-based detection can identify threats before CVE disclosures, reducing reliance on signatures.
Darktrace’s Self-Learning AI and multi-layered approach adapt to an organization and detect malicious activity before vulnerabilities are public.
Retrospective analyses link detections to CVE disclosures, offering broader context across campaigns.
Pre-CVE activity is often ‘low and slow’ and used by sophisticated actors before less skilled attackers exploit disclosures.
Autonomous Response can contain compromises by blocking connections and enforcing patterns of life before public disclosure.