Isotope

7 of 7 entries

ID	Risk	Title	CVSS	CWE
`IS-001`	CRITICAL	Known malicious file hash ({classification}) A file's cryptographic hash (MD5, SHA1, or SHA256) matches a known threat indicator in the pr0t31n threat intelligence d...	9.8	CWE-506
`IS-002`	MEDIUM	Encrypted file detected A file exhibits very high Shannon entropy (>7.99 out of 8.0), strongly indicating encryption. The encryption method is e...	5.3	—
`IS-003`	LOW	Possibly encrypted file detected A file exhibits elevated Shannon entropy (7.5–7.99), suggesting possible encryption or heavy compression. The boundary b...	—	—
`IS-004`	LOW	GPS coordinates embedded in file metadata A file (typically an image) contains GPS coordinates embedded in its EXIF metadata, potentially revealing the physical l...	3.7	CWE-200
`IS-005`	MEDIUM	Packed/obfuscated executable detected ({packers}) An executable file contains signatures of known packers (UPX, Themida, ASPack, PECompact, Petite, NsPack, MEW, MPRESS). ...	6.1	CWE-506
`IS-006`	HIGH	Information Disclosure: Secret in File A sensitive credential, token, API key, private key, or connection string was detected in a file's contents. The specifi...	7.5	CWE-798 CWE-312
`IS-007`	HIGH	Weak cryptographic key ({key_bits} bits) A certificate or private key file uses a cryptographic key shorter than 2048 bits. Keys below this threshold are conside...	7.4	CWE-326

Detailed View

CRITICAL IS-001 — Known malicious file hash ({classification})

Description: A file's cryptographic hash (MD5, SHA1, or SHA256) matches a known threat indicator in the pr0t31n threat intelligence database, indicating the file is associated with malware, exploits, or other malicious activity.

Impact: A confirmed malicious file on the system indicates active compromise or staging for an attack. The attacker may have already achieved code execution, data exfiltration, or persistence. Business impact includes potential data breach, regulatory violations, and incident response costs.

Remediation: Quarantine this file immediately. Investigate its origin and any systems it has touched. Perform a full malware scan on the host. Review access logs to determine how the file arrived and whether it was executed. Rotate any credentials that may have been exposed.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1204 (Execution), T1059 (Execution)

NIST 800-53: SI-3, SI-4

PCI DSS 4: 5.2.1, 5.3.1

MEDIUM IS-002 — Encrypted file detected

Description: A file exhibits very high Shannon entropy (>7.99 out of 8.0), strongly indicating encryption. The encryption method is estimated based on file structure patterns (block size alignment, magic bytes).

Impact: Encrypted files may indicate data exfiltration preparation (encrypted archives for staging stolen data), ransomware activity, or the presence of encrypted command-and-control communications. If unexpected, this warrants investigation into the file's purpose and origin.

Remediation: Determine whether encryption is expected for this file. If not, investigate the file's origin and purpose. Check for ransomware indicators. Attempt to identify the encryption algorithm and key management approach.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1027 (Defense Evasion), T1486 (Impact)

NIST 800-53: SC-13, SC-28

PCI DSS 4: 3.5.1

LOW IS-003 — Possibly encrypted file detected

Description: A file exhibits elevated Shannon entropy (7.5–7.99), suggesting possible encryption or heavy compression. The boundary between compressed and encrypted data is not always clear at this entropy range.

Impact: While potentially benign (compressed data naturally has high entropy), this finding warrants review to rule out encrypted payloads, obfuscated malware, or staged exfiltration archives.

Remediation: Verify whether the file is a known compressed format. If not, treat as potentially encrypted and investigate further.

Effort: Easy

MITRE ATT&CK: T1027 (Defense Evasion)

NIST 800-53: SC-13

LOW IS-004 — GPS coordinates embedded in file metadata

Description: A file (typically an image) contains GPS coordinates embedded in its EXIF metadata, potentially revealing the physical location where the file was created.

Impact: Exposed GPS coordinates can reveal sensitive locations such as office buildings, data centres, employee homes, or secure facilities. This information can be used for physical reconnaissance, social engineering, or targeted attacks.

Remediation: Strip EXIF metadata before sharing files externally. Use tools like exiftool -all= to remove metadata. Implement organisational policies requiring metadata stripping for outbound files.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1592 (Reconnaissance)

NIST 800-53: SC-28, SI-12

MEDIUM IS-005 — Packed/obfuscated executable detected ({packers})

Description: An executable file contains signatures of known packers (UPX, Themida, ASPack, PECompact, Petite, NsPack, MEW, MPRESS). Packing is a technique used to compress or obfuscate executable code, commonly employed by malware to evade antivirus detection.

Impact: While some legitimate software uses packing for size reduction or intellectual property protection, packed executables are a strong indicator of malware attempting to evade signature-based detection. The presence of packing increases the difficulty of static analysis and may indicate active evasion of security controls.

Remediation: Unpack the executable and analyse the underlying binary. Determine if packing is legitimate (software protection) or suspicious. Submit to malware analysis sandbox for dynamic analysis. Block execution pending investigation.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

MITRE ATT&CK: T1027.002 (Defense Evasion), T1045 (Defense Evasion)

NIST 800-53: SI-3

PCI DSS 4: 5.2.1

HIGH IS-006 — Information Disclosure: Secret in File

Description: A sensitive credential, token, API key, private key, or connection string was detected in a file's contents. The specific type varies (AWS keys, GitHub tokens, Slack tokens, JWT, Bearer tokens, database connection strings, etc.).

Impact: Exposed credentials provide direct access to systems, APIs, or data stores. An attacker who obtains these can impersonate legitimate users, access cloud resources, exfiltrate data, or pivot to additional systems. The severity depends on the credential's scope and privileges.

Remediation: Remove the secret from the file immediately. Rotate the credential — treat it as compromised. Check git history for prior exposure and use tools like truffleHog or git-secrets to prevent future leaks. Implement a secrets management solution (Vault, AWS Secrets Manager, etc.).

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

OWASP API: API2:2023 - Broken Authentication

MITRE ATT&CK: T1552.001 (Credential Access), T1552.004 (Credential Access)

NIST 800-53: IA-5, SC-12, SC-28

PCI DSS 4: 2.2.7, 8.3.2

HIGH IS-007 — Weak cryptographic key ({key_bits} bits)

Description: A certificate or private key file uses a cryptographic key shorter than 2048 bits. Keys below this threshold are considered weak and potentially vulnerable to factoring attacks with modern computing resources.

Impact: A weak cryptographic key can be factored by a well-resourced attacker, allowing them to decrypt intercepted traffic, forge signatures, or impersonate the certificate holder. This undermines the entire trust chain built on the certificate.

Remediation: Regenerate the certificate with at least 2048-bit RSA or 256-bit EC key. Update all systems and services that reference this certificate. Revoke the old certificate.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: A02:2021 - Cryptographic Failures

MITRE ATT&CK: T1557 (Credential Access)

NIST 800-53: SC-12, SC-13

PCI DSS 4: 4.2.1