Cybersecurity glossary

Attackers gaining control of user accounts on shadow IT services due to weak passwords or lack of multi-factor authentication. This can allow them to…

An APT is a sophisticated, long-term cyberattack in which an attacker gains unauthorized access to a network and remains undetected for an extended p…

Adware is software that displays unwanted advertisements on a user's computer, often without their consent. Some forms of adware have been known to i…

The use of statistical methods and machine learning algorithms to identify unusual patterns in firewall logs. This can help detect potential security…

Anti-emulation techniques are methods used by malware to detect and evade emulated environments. These techniques can include checking for specific h…

Attack surface reduction is the process of minimizing the areas of a system or network that are exposed to potential attackers. Network segmentation…

Honeypots assist in attack vector analysis by revealing how attackers attempt to compromise systems. This information helps organizations understand…

Authentication bypass vulnerabilities allow attackers to gain access to an application without providing valid credentials. Burp Suite can be used to…

Logs that record user authentication attempts, including successful logins, failed logins, and password changes. Analyzing authentication logs helps…

AST analysis can be used to automate the process of generating exploits for identified vulnerabilities. This allows security researchers to quickly a…

Using machine learning or other techniques to identify unusual patterns in backup behavior. This can help detect ransomware attacks or other security…

Monitoring backup logs for suspicious activity, such as unauthorized access attempts or unusual backup behavior. This can help detect security incide…

Behavioral analysis involves monitoring endpoint activities to identify deviations from normal or expected behavior. EDR systems use behavioral analy…

A bootkit in a virtual machine is a type of malware that infects the VM's boot sector or boot process. It allows the attacker to gain control of the…

CDNs can employ bot mitigation techniques to identify and block malicious bots that may be scraping content, performing credential stuffing attacks…

A botnet is a network of computers infected with malware that are controlled by a single attacker (the bot herder). Botnets are often used to launch…

Honeypots can be used to identify botnet activity by attracting infected machines. This allows security teams to track botnet behavior and disrupt th…

Bypassing a firewall refers to techniques used by attackers to circumvent the security measures implemented by the firewall. This can be achieved thr…

Bypass techniques are methods used by attackers to circumvent security controls, such as AppLocker. Understanding these techniques is crucial for har…

Cache poisoning occurs when an attacker injects malicious content into the CDN cache, which is then served to legitimate users. This can lead to wide…

Data leakage can occur if sensitive information is inadvertently exposed through the CDN, such as in HTTP headers or error messages. Careful configur…

Attackers can try to exhaust CDN resources by flooding the network with requests, leading to service disruptions. Proper rate limiting, traffic filte…

Security misconfigurations in CDN settings, such as improper access controls or caching policies, can expose sensitive data or allow attackers to byp…

Regular vulnerability scanning of the CDN infrastructure helps identify and address security weaknesses before they can be exploited by attackers. Vu…

Certificate mis-issuance refers to the incorrect or unauthorized issuance of a digital certificate. This can occur due to errors, vulnerabilities in…

Clickjacking is an attack where an attacker tricks a user into clicking something different from what they perceive, often by overlaying a transparen…

SSRF can be exploited to retrieve credentials stored in cloud environments, such as AWS IAM roles or Google Cloud service account keys. These credent…

ASTs can be used to sanitize user inputs and validate code structures, preventing code injection attacks. By analyzing the code's structure, it's pos…

A collusion attack involves combining multiple copies of watermarked content, each with a slightly different watermark, to statistically estimate and…

Compromised credentials are usernames and passwords that have been stolen or leaked. DLP solutions, combined with other security measures, can help d…

Cookie theft is a common objective of JavaScript injection attacks, where the injected script steals a user's cookies containing session information…

A copy attack involves copying watermarked content and redistributing it without authorization, thus bypassing copyright protection. Watermarks can h…

Credential stuffing uses stolen usernames and passwords from previous breaches to gain access to accounts on other systems. Jump servers are vulnerab…

The unauthorized use of someone else's computer to mine cryptocurrency. While not directly ransomware, it is a related threat that can indicate a com…

Cyber threat intelligence involves gathering and analyzing information about potential cyber threats, including reflection attacks. This information…

Honeypots can detect data exfiltration attempts by monitoring for unauthorized data transfers. This helps organizations identify and respond to data…

The process of logging Distributed Denial-of-Service (DDoS) attack events detected by the firewall. This includes capturing information about source…

An attack that aims to make a system or network unavailable to legitimate users. DoS attacks can exploit vulnerabilities or simply overwhelm the syst…

A DoS attack is an attempt to make a machine or network resource unavailable to its intended users by overwhelming it with traffic or requests. Distr…

Exploiting vulnerabilities in differential backup processes to inject malicious code. Attackers target the incremental nature of differential backups…

Digital forensics involves the investigation of digital evidence to identify the cause and scope of a security incident. Contextualizing forensic fin…

A DDoS attack is a type of DoS attack where the malicious traffic originates from multiple, often compromised, sources. This makes it harder to mitig…

A ransomware tactic where attackers not only encrypt the victim's data but also steal it and threaten to release it publicly if the ransom is not pai…

Drive-by mining is a form of cryptojacking where malicious code is injected into websites or advertisements to mine cryptocurrency using the resource…

Dynamic analysis emulation executes a program and monitors its actions in a simulated environment to detect malicious behavior. This technique is com…

Emulation-based detection uses emulation to identify malicious code by observing its behavior in a simulated environment. This is an effective way to…

A piece of code or a technique used to take advantage of a vulnerability in a system or application. Exploits are used by attackers to gain unauthori…

An exploit kit is a software package containing a collection of exploits that target various software vulnerabilities. Exploit kits are often used to…

Exploit mitigation refers to techniques used to prevent attackers from successfully exploiting vulnerabilities in software. These techniques can incl…

Exploit prevention technologies aim to block the exploitation of software vulnerabilities. EDR solutions often include exploit prevention capabilitie…

The failure of a security system to detect a malicious event. Minimizing false negatives is crucial to prevent security breaches.

An alert generated by a security system that incorrectly identifies a benign event as malicious. Reducing false positives is a key goal of SIEM tunin…

The act of intentionally altering or deleting firewall logs to conceal malicious activity or cover up security breaches. This is a serious security t…

Enriching firewall logs with geographic location information based on IP addresses. This can help identify traffic originating from suspicious or une…

A type of attack on watermarks that involves altering the geometry of the watermarked media, such as rotation, scaling, or cropping. Robust watermark…

Heuristic analysis involves identifying suspicious code or behavior based on predefined rules. EDR solutions use heuristic analysis to detect potenti…

Honeypot emulation involves creating a decoy system that appears vulnerable to attract attackers. This allows security teams to study attacker behavi…

Honeypot evasion techniques are methods used by attackers to identify and avoid honeypots. Understanding these techniques is crucial for designing ef…

Honeypots are decoy systems designed to attract and trap attackers. Contextualizing honeypot activity with network traffic patterns and attacker beha…

Information disclosure vulnerabilities occur when sensitive information is unintentionally exposed to unauthorized users. Burp Suite can be used to i…

An insider threat refers to a security risk posed by individuals within an organization, such as employees or contractors. DLP is crucial for mitigat…

Integrity monitoring involves regularly checking the integrity of log files to detect any unauthorized changes. This is especially important for encr…

The process of monitoring firewall logs for signs of malicious activity, such as port scanning, brute-force attacks, and exploit attempts. This can h…

Logs generated by intrusion detection systems that record detected security threats and anomalies. Analyzing IDS logs helps identify malicious activi…

An IPS goes beyond detection and actively blocks or prevents malicious activity from reaching the network. It can automatically respond to threats ba…

IoT device emulation recreates the environment of an Internet of Things device. This is used to analyze firmware, test for vulnerabilities, and under…

IP address spoofing is the creation of Internet Protocol (IP) packets with a false source IP address, often used in DDoS attacks. Blackholing can be…

IP blacklisting is a security practice where specific IP addresses known for malicious activity are blocked from accessing a network or system throug…

IP reputation is a measure of the trustworthiness of an IP address based on its historical behavior. IP addresses with poor reputation are often blac…

JavaScript obfuscation is the process of making JavaScript code difficult to understand, often used by attackers to hide malicious code. While not di…

Kernel exploits target vulnerabilities in the operating system kernel to gain elevated privileges or compromise the system. Both containers and VMs r…

Key compromise occurs when the private key associated with a digital certificate is exposed or stolen. This allows attackers to impersonate the certi…

A software or hardware device that records keystrokes. Penetration testers may use keyloggers to capture sensitive information, such as passwords.

Keylogging is the act of tracking (or logging) the keys struck on a keyboard, typically in a covert manner, so that the person using the keyboard is…

Likelihood assessment determines the probability of a threat exploiting a vulnerability. It considers factors like threat actor capabilities, attack…

Analyzing logs from systems in the DMZ can help identify security incidents. Log analysis tools can detect suspicious patterns and alert administrato…

Machine learning algorithms can be used to analyze endpoint data and identify anomalies that may indicate malicious activity. EDR systems leverage ma…

Malvertising involves using online advertising to spread malware, including cryptojacking scripts. Attackers inject malicious code into advertisement…

Malware is a broad term for malicious software designed to disrupt, damage, or gain unauthorized access to a computer system. It includes viruses, wo…

Honeypots can be used to attract and capture malware samples for analysis. This allows security researchers to understand how malware operates and de…

Malware emulation is the process of running malware in a controlled environment to analyze its behavior and characteristics. This helps in understand…

Malware prevention involves employing various techniques and tools to prevent malicious software from infecting systems. AppLocker plays a critical r…

A MitM attack is a type of cyberattack where an attacker intercepts communication between two parties without their knowledge. The attacker can eaves…

A man-in-the-middle attack is a type of cyberattack where an attacker intercepts communication between two parties without their knowledge. The attac…

The MITRE ATT&CK framework is a knowledge base of adversary tactics and techniques based on real-world observations. EDR solutions often use the MITR…

Network anomaly detection involves identifying unusual patterns in network traffic that may indicate a security threat. Significant spikes in traffic…

An open redirect vulnerability allows an attacker to redirect users to an arbitrary website. Burp Suite can be used to identify and exploit open redi…

Phishing is a type of social engineering attack where attackers impersonate legitimate entities to trick individuals into revealing sensitive informa…

Phishing simulations are used to test employees' susceptibility to phishing attacks. The results of these simulations inform risk assessments by iden…

Users of shadow IT applications may be more susceptible to phishing attacks due to a lack of security awareness training and the use of personal emai…

PowerShell is a command-line shell and scripting language developed by Microsoft. It can be used by attackers for various malicious activities, inclu…

Exploiting a bug or design flaw in an application or operating system to gain elevated access to resources that are normally protected from an applic…

Process injection is a technique used by malware to inject malicious code into legitimate processes. EDR systems monitor process activity to detect a…

A message displayed to the victim after their files have been encrypted, providing instructions on how to pay the ransom and receive the decryption k…

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment to restore access. It often spreads through phishing emai…

Ransomware frequently targets backup systems to prevent data recovery. Protecting backups with air-gapping, immutability, and strong access controls…

Shadow IT environments can serve as entry points for ransomware attacks, which can then spread to other parts of the organization. Proper endpoint pr…

A business model where ransomware developers lease their malicious code to affiliates, who then carry out attacks and share the profits. RaaS makes r…

Techniques like AST obfuscation are used to hinder reverse engineering efforts by making the code more difficult to understand. This can protect sens…

Reverse tabnabbing is a phishing attack where a malicious website that is linked to from a legitimate website modifies the original website when the…

A rogue CA is a fraudulent or compromised Certificate Authority that issues certificates without proper authorization. These certificates can be used…

A rootkit is a type of malware that hides its presence and the presence of other malicious software on a system. Zero-day exploits can be used to ins…

Sandbox analysis involves executing suspicious files or processes in a controlled environment to observe their behavior. EDR systems can integrate wi…

Sandbox emulation involves running potentially malicious code within a controlled environment that mimics a real system. This allows security analyst…

The use of statistical and machine learning techniques to analyze security data and identify anomalies or patterns indicative of malicious activity…

Session hijacking is a type of cyberattack in which an attacker takes control of a legitimate user's session. The attacker can then use the hijacked…

A shadow VM is a malicious, unauthorized virtual machine created within a legitimate virtualized environment, often by an attacker who has compromise…

A side-channel attack exploits information leaked during the execution of an encryption algorithm, such as power consumption or timing variations. Th…

Attacks that exploit information leaked during the watermark embedding or extraction process, such as power consumption or timing variations. These a…

Side-channel attacks exploit information leaked from the physical implementation of a cryptographic system or algorithm. VMs are potentially vulnerab…

Attacks that use common signal processing techniques like filtering, compression, and noise addition to remove or weaken the watermark. These attacks…

Signature-based detection relies on comparing files and processes against a database of known malware signatures. While useful for detecting well-kno…

The art of manipulating people into divulging confidential information. Penetration testers may use social engineering techniques to gain initial acc…

A social engineering audit tests employees' awareness of social engineering tactics through simulated attacks. It identifies weaknesses in employee b…

Attackers may use AST manipulation techniques to obfuscate source code, making it harder to analyze and understand. This technique is used to protect…

Spoofing is the act of disguising a network packet to appear as if it originated from a different source. In DoS attacks, attackers often spoof IP ad…

An attack that targets vulnerabilities in a vendor's network to compromise the vendor's customers. Ransomware can be spread through supply chain atta…

Supply chain risk refers to the risks associated with third-party vendors and suppliers. Risk assessments should extend to the supply chain to identi…

Tamper detection mechanisms identify unauthorized modifications to log files. This can be achieved through cryptographic hashing or digital signature…

Threat hunting is a proactive security activity that involves searching for threats that have evaded automated detection systems. EDR solutions provi…