Zero Day Vulnerability Response

---
name: zero-day-vulnerability-response
description: "Use when responding to zero-day vulnerabilities."
version: 1.0.0
author: Hermes Agent
license: MIT
metadata:
  hermes:
    tags: [zero-day, vulnerability, CVE, patch-management, emergency-response, exploit]
    related_skills: [security-incident-response, threat-hunting-methods, waf-web-application-firewall, identity-access-management]
---

# Zero-Day Vulnerability Response

Responding to zero-day vulnerabilities — from discovery and triage through emergency patching, virtual patching (WAF), and post-incident hardening.

## When to Use

- A zero-day CVE is announced affecting your technology stack
- Responding to active exploitation of an unknown vulnerability
- Implementing emergency mitigations before vendor patch is available
- Assessing exposure and risk across your infrastructure
- Communicating zero-day impact to stakeholders

## Response Framework

```python
ZERO_DAY_RESPONSE = {
    'triage': 'Assess impact: affected systems, exploitability, data exposure',
    'contain': 'Implement virtual patch, block exploitation vectors, limit exposure',
    'investigate': 'Check for signs of prior exploitation (logs, IOCs)',
    'mitigate': 'Apply vendor patch, workaround, or config change',
    'verify': 'Confirm mitigation effective, scan for residual exposure',
    'post_mortem': 'Update detection rules, improve patch process, document lessons',
}

class ZeroDayResponse:
    """Coordinate zero-day vulnerability response."""
    
    def __init__(self, cve: str, score: float, affected: List[str]):
        self.cve = cve
        self.score = score  # CVSS score
        self.affected = affected
        self.exploited_in_wild = False
        self.actions = []
    
    def virtual_patch(self, waf_rules: List[Dict]) -> List[str]:
        """Deploy WAF rules to block exploitation attempts."""
        # ModSecurity/WAF rule to block zero-day exploitation
        patched_endpoints = []
        for rule in waf_rules:
            # Deploy rule to WAF in blocking mode
            patched_endpoints.append(f"Deployed WAF rule: {rule.get('id', 'N/A')}")
        return patched_endpoints
    
    def assess_exposure(self, asset_inventory: List[Dict]) -> Dict:
        """Determine which assets are potentially vulnerable."""
        exposed = [a for a in asset_inventory if a.get('software') in self.affected]
        return {
            'total_assets': len(asset_inventory),
            'potentially_exposed': len(exposed),
            'critical_exposed': len([a for a in exposed if a.get('critical', False)]),
        }
```

## Common Pitfalls

1. **Panic patching without testing** — emergency patches that break production are worse than the vulnerability
2. **Only patching internet-facing systems** — attackers move laterally; patch internal systems too
3. **Not checking for prior compromise** — assume the worst; check logs for exploitation signs
4. **Only applying vendor patch** — virtual patching (WAF, IDS) provides defense-in-depth alongside vendor patch
5. **No communication plan** — executives, customers, and regulators need timely updates

## Verification Checklist

- [ ] CVSS score and exploitability assessed
- [ ] Virtual patch deployed to WAF/IDS
- [ ] Asset inventory checked for vulnerable systems
- [ ] Logs reviewed for signs of prior exploitation
- [ ] Vendor patch tested and deployed within SLA
- [ ] Internal and external communication sent
- [ ] Detection rules updated for exploitation attempts
- [ ] Lessons learned documented and patch process improved