Hunting pre-patch compromise when the signal is KEV plus internet exposure

"Known exploited" in the CISA KEV catalog means active exploitation has been observed in the wild. When the affected service is internet-facing, the question is not only whether a patch has been applied — it is whether exploitation occurred during the window between vulnerability disclosure (or silent exploitation) and patching.

Patching without hunting is insufficient for high-confidence incident response. The patch removes the attack vector; it does not remove an attacker who used the vector before the patch. This post structures the hunt by asset class using the October 2026 KEV additions as the reference set.

Hunt philosophy: window times exposure times capability

Three variables determine the required hunt depth:

KEV catalog addition implies "High" on the known exploitation axis. Combine with the exposure window and internet exposure level to determine hunt depth.

Hunt artifacts by asset class

Web application runtime (PHP — CVE-2026-109618 / CVE-2026-109619)

# Web access log: requests without '=' in query string to PHP (CGI injection vector)
grep -E '\?[^=&]+ HTTP' /var/log/apache2/access.log | grep '\.php'

# Look for shell-like queries (common in PoC testing)
grep -E 'cmd=|exec=|system=|passthru=|shell_exec=' /var/log/apache2/access.log

# auditd: execve calls from php-cgi or php-fpm processes
ausearch -c 'php-cgi' --syscall execve | grep -A5 'type=EXECVE'
ausearch -c 'php-fpm' --syscall execve | grep -A5 'type=EXECVE'

# Unexpected file creation in web root during window
find /var/www/html -newer /var/www/html/index.php -name "*.php" 2>/dev/null

Media server (Plex — CVE-2026-96652 through CVE-2026-96656)

# Plex log: unusual metadata fetch destinations
grep -i "fetch\|metadata" ~/.config/Plex/Logs/*.log | \
    grep -vE "plex\.tv|themoviedb|thetvdb|music\.plex\.tv|fanart\.tv"

# Plug-in directory: files modified during exposure window (use actual window date)
find /var/lib/plexmediaserver/ -name "*.py" -o -name "*.bundle" | \
    xargs ls -la 2>/dev/null | grep "Oct [0-9 ][0-9]"

# Plex data directories for unexpected files
find ~/.config/Plex -newer ~/.config/Plex/Logs/ -type f 2>/dev/null

WAF appliance (SiteGuard — CVE-2026-106931)

Endpoint/workstation (Siemens Software Center — CVE-2026-110936)

# Sysmon: DLL loads from user-writable paths for Siemens process
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" |
    Where-Object { $_.Id -eq 7 -and $_.Message -like "*SiemensUpdateManager*" } |
    Select-Object TimeCreated, Message

# Windows Security: process creation from Siemens process
Get-WinEvent -LogName Security |
    Where-Object { $_.Id -eq 4688 -and $_.Message -like "*SiemensUpdateManager*" }

Hunt prioritisation matrix

Negative evidence and log gaps

A clean artifact review is not proof of no compromise — it is absence of observed evidence. Document the hunt scope:

• Which logs were available and for what time range
• Which artifacts were checked and what was found
• Explicit log retention gaps (e.g., "access logs retained for 7 days; exposure window was 14 days — first 7 days cannot be reviewed")

Log retention gaps are themselves a finding for the report. BOD 26-04 compliance requires demonstrable hunt capability, not just intent.