Key takeaway
Describe the flaw through version, configuration, reachability and impact. Investigate attack signals and take proportionate action under agreed authority.
Code, platform and configuration weaknesses
Code flaws such as buffer overflows can cause unintended data or code handling. SQL injection concerns database-command construction and handling, while cross-site scripting (XSS) concerns unsafe browser-page output handling; they should not be reduced to one remediation recipe. Overly broad firewall rules, unnecessary exposed services, weak API controls and weak segmentation may increase exposure. Unsupported platforms and hardware or firmware design flaws also warrant investigation. Record the actual version, configuration and verified impact rather than only a general category.
Malware and download paths
A compromised page may exploit a browser or plugin flaw to run code without a separate download command: a drive-by path. Not every visit or download causes infection. A resulting keylogger, information stealer or ransomware program is malware, rather than the vulnerability itself. Identify separately the flaw, permission or user action that enabled entry. Update browsers and operating systems and apply approved script, plugin and web controls; investigate suspicious activity through endpoint records.
Identity, phishing and social engineering
Phishing, targeted phishing, SMS deception and voice-call deception can induce users to share credentials, open attachments or change payments. These are attack techniques. Weak or reused passwords, insufficient authentication controls and excess permissions are separate weaknesses. Repeated password guessing targets login controls. Multifactor authentication (MFA), password managers, independent-channel verification, least privilege and training to report suspicious requests reduce risk; none provides a complete guarantee.
Lateral movement and application controls
After initial access, an attacker may try to move laterally, install a backdoor and exfiltrate data. Poor visibility between subnets, unrestricted outbound access and broad account permissions may make this easier. Segmentation, restricted application rights and correlated host, network and account logs support investigation. An unexpected process alone does not establish maliciousness. Preserve records, investigate context and choose proportionate containment under the incident plan’s authority.