Skill: CVE Attribution (Intel ICS)

CVE attribution cross-references your completed investigation narrative and common operating picture for version and behavior signals to identify likely known vulnerabilities explaining observed attacker techniques.

Confidence-based vulnerability mapping correlates version-confirming artifacts with exploitation mechanisms to produce High, Moderate, or Low confidence CVE conclusions, safely falling back to CWE statements when evidence is insufficient.

You map behaviors by correlating version-confirming artifacts like software versions, installer strings, and registry or amcache entries with exploitation patterns described in your investigation report and common operating picture.

Yes, CVE attribution requires finalized investigation_report.md and cop.md files to cross-reference version signals and exploitation patterns, functioning as a post-investigation step rather than a standalone analysis tool.

The skill generates a dedicated cve_attribution.md artifact and instructs how to merge Section 3B back into the investigation report while updating timelines, the common operating picture, and IOC tables.

Yes, when evidence is insufficient for specific CVE identification, the skill safely falls back to CWE or vulnerability-class statements without inventing CVE IDs, ensuring accurate but conservative attribution.