Discover new exploits and monitor exploit-provider forums
An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. The adversary may need to discover new exploits when existing exploits are no longer relevant to the environment they are trying to compromise. An adversary may monitor exploit provider forums to understand the state of existing, as well as newly discovered, exploits. 
Detectable by Common Defenses (Yes/No/Partial): No
Explanation: Public source external to the defender's organization.
Difficulty for the Adversary
Easy for the Adversary (Yes/No): Yes
Explanation: Many public sources exist for this information.