Zero-day detection is the discovery of malicious activity, exploits, or malware linked to a previously unknown vulnerability. It relies on behaviour, anomaly, exploit-chain, or memory-based indicators instead of a known signature, so security controls can spot attacks before a patch or formal detection rule exists.
How zero-day detection works
Zero-day detection is not about matching a known signature. It looks for the effects of an attack, such as unusual memory activity, exploit-chain behaviour, process injection, abnormal parent-child process relationships, or suspicious network calls that often appear when an unknown flaw is being abused.
That makes the discipline valuable in the narrow window before defenders have a vendor patch or a formal detection rule. It is usually strongest when multiple weak signals are correlated, because any single anomaly can also arise from legitimate troubleshooting, software bugs, or unusual but harmless system activity.
Why zero-day detection is hard
The main difficulty is that defenders are trying to detect behaviour without knowing the exact vulnerability, payload, or indicator set in advance. Traditional controls can still help, but they are less reliable when the exploit path is novel or when the attacker uses a fresh chain of steps that has not yet been codified into a rule.
That is why zero-day detection often leans on behavioural analytics, memory inspection, exploit telemetry, sandboxing, and endpoint or network sensors that can surface deviations from a system’s normal baseline. The trade-off is clear: the broader the detection net, the greater the chance of false positives and analyst fatigue.
What strong zero-day hunting looks for
Good zero-day hunting focuses on evidence that attack logic is unfolding, not just that something looks unusual. Common signals include exploit delivery followed by a crash or restart pattern, unexpected child processes, suspicious script engines, LOLBin abuse, memory corruption indicators, and post-exploitation behaviour that suggests code execution succeeded.
One useful way to think about the problem is to follow the attack chain, not the initial flaw alone. MITRE D3FEND is helpful here because it frames defensive countermeasures around observable behaviour, which is exactly where zero-day detection has to operate.
When a zero-day is being used in the wild, detection may also depend on threat-led hunting and incident workflow discipline. MITRE ATT&CK Enterprise Matrix helps teams map those behaviours to known adversary techniques even when the underlying exploit itself is still unfamiliar.
Why detection still matters after patching
Finding the exploit does not end the story. A successful zero-day can leave behind dropped binaries, persistence artefacts, stolen sessions, altered configuration, or credential abuse that survives even after the vulnerable software is patched. That means detection and compromise review are tightly linked.
For that reason, zero-day response should include post-patch hunting, log review, and validation that the intrusion did not establish a second foothold. SANS Security Resources is a useful reference point for SOC and incident-response practice because it reflects the operational side of detection engineering and triage.
Risk and Threat Considerations
Zero-day detection exists because the most dangerous part of an unknown vulnerability is the time gap before defenders understand what to look for. During that window, attackers can exploit a product without tripping signature-based controls, which raises the chance of stealthy compromise, lateral movement, and delayed containment.
Failure mechanism: Defenders miss the initial intrusion because the exploit is novel, the malware is custom, or the observable behaviour is subtle enough to blend into normal activity until exploitation has already succeeded.
Impact: The result can be unauthorized code execution, persistence, credential theft, session abuse, or post-compromise movement that continues even after a patch becomes available.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1055 — Process Injection | Zero-day exploitation often surfaces through process injection and similar post-exploit behaviour. |
| T1204 — User Execution | Many zero-day chains still need user-triggered execution or interaction to begin. | |
| Recommendation — Map memory and injection telemetry to process-injection hunts and alert on suspicious remote execution paths. Correlate exploit delivery with user interaction signals and isolate endpoints that execute unexpected content. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Zero-day detection depends on continuous monitoring for anomalous activity and suspicious events. |
| RS.AN-01 — Analysis | Investigating zero-day alerts requires structured event analysis and attack validation. | |
| Recommendation — Expand telemetry coverage and tune anomaly monitoring to surface exploit-like behaviour before signatures exist. Triage suspicious activity by validating exploit chains, artefacts, and affected assets as a single incident. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Audit logs are foundational for spotting anomalous behaviour tied to unknown exploits. |
| Recommendation — Centralise and retain logs long enough to reconstruct pre-patch activity and confirm compromise scope. | ||
Practitioner Guidance
Why practitioners should care: Zero-day detection is only effective when teams accept that no single control will reliably catch every unknown exploit. Behavioural coverage, high-fidelity telemetry, and fast investigation paths matter more here than signature volume.
What to watch for: Prioritise alerting that ties together exploit delivery, unusual memory behaviour, abnormal process trees, and post-exploitation actions. The most useful detections often come from correlated weak signals rather than one perfect indicator.
Practitioner takeaway: Treat zero-day detection as a detection-engineering problem and a response-readiness problem at the same time, because the defender’s advantage is usually speed of recognition, not prior knowledge of the exact flaw.
Related resources from NHI Mgmt Group
- Guide: Zero-Day and Exploited Vulnerabilities Guide
- How do organisations know if zero-day detection is actually working?
- Why do zero-day vulnerabilities create such a difficult detection and response problem for cloud security teams?
- What happens when application intrusion detection is not available during a zero-day or supply chain attack?
- Why do zero-day vulnerabilities continue to create risk even when reporting and detection improve?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org