Does a vulnerable system prove it was exploited?¶
No. A vulnerable system does not by itself prove that exploitation occurred.
Avoid the dangerous assumption¶
The dangerous assumption is that an unpatched or exposed weakness explains the incident automatically.
It may be only one possible route.
A system may be vulnerable but never targeted.
An exploit attempt may fail.
The vulnerability may require conditions that were not present.
Security controls may have blocked the effect.
The incident may have begun through stolen credentials, phishing or another service.
Investigators should ask:
- was the vulnerable component exposed
- was it reachable by the suspected source
- did the relevant version exist at the time
- are there matching requests or events
- did the expected result occur
- were there artefacts of successful access.
Evidence of exploitation may include unusual application requests, process creation, file changes, new accounts, command execution, crashes or other behaviour consistent with the vulnerability.
Do not rely only on a scanner report produced after the incident. It may show current exposure rather than the historical state.
Preserve patch history, configuration, version data and logs covering the relevant period.
A vulnerability can remain an important hypothesis even where exploitation cannot be proved.
Report it as a possible route rather than a confirmed point of entry.
Check whether responders altered the system before examination. Patching, rebuilding or configuration change may remove the vulnerable state and make later testing an unreliable guide to what existed during the incident.
Operational takeaway¶
Treat vulnerability as evidence of opportunity, and require incident-specific records before concluding that it was the route of compromise.