Bad pixel lists are derived mostly from the internal calibration exposures, acquired at regular intervals since the beginning of the mission via dedicated automatic monitoring scripts at the SOC.
Exposures without on-board bad pixel masking, acquired at much lower frequency are also used to detect monitor defects from micrometeoroid impacts: high energetic hot pixels with a very high recurrence frequency, that create small dead area (3x3 or 3x4 pixels).
Diagnostic and science exposures can also be used to identify bad pixels. Diagnostic exposures can also be used to confirm the presence of previously identified and up-linked bad pixels.
The integration of the data over each exposure can be used to identify
hot or flickering pixels (pixels with repeated occurrence in excess of
the local Poisson probability distribution of X-ray events), for example
running SAS task 
or 
.