Cisco CBRCOR: Performing CyberOps Using Cisco Security Technologies: key terms

Flashcards for this exam Cisco CBRCOR: Performing CyberOps Using Cisco Security Technologies guide Class dates

• Atomic Red TeamAn open-source library by Red Canary of small, ATT&CK-mapped tests that simulate individual adversary techniques.Advanced
• ATT&CK NavigatorA MITRE web tool for visualizing and annotating ATT&CK matrices as layers.Advanced
• ATT&CK TacticA column in the MITRE ATT&CK matrix representing the adversary's tactical goal, the "why" of an action.Intermediate
• ATT&CK TechniqueAn entry in MITRE ATT&CK describing how an adversary achieves a tactical goal, identified by a T number.Intermediate
• BeaconingRegular, periodic outbound communication from a compromised host to attacker command-and-control infrastructure.Intermediate
• Command and Control (C2)Infrastructure and channels attackers use to communicate with and control compromised systems.Intermediate
• Detection EngineeringThe discipline of designing, building, testing and maintaining threat detections as code.Advanced
• Domain Generation Algorithm (DGA)An algorithm in malware that generates many pseudo-random domain names to locate its command-and-control servers.Advanced
• Full Packet Capture (FPC)Recording complete network packets, including payloads, for detailed analysis and forensics.Intermediate
• Hypothesis-Driven HuntingA threat hunting approach that starts with a testable hypothesis about adversary behavior in the environment.Advanced
• Lateral MovementTechniques attackers use to move from one compromised system to others within a network.Intermediate
• Living off the Land (LotL)An attacker technique of using tools already present on the target system to blend in and avoid detection.Intermediate
• Living Off the Land Binaries (LOLBins)Legitimate, signed operating system binaries that attackers abuse to download, execute or hide malicious activity.Advanced
• MITRE ATT&CKA globally accessible knowledge base of adversary tactics, techniques and procedures based on real-world observations.Foundational
• NetFlowA Cisco-originated technology that exports metadata about traffic flows, such as addresses, ports and byte counts, to a collector.Intermediate
• Network Detection and Response (NDR)A solution that analyzes network traffic to detect threats and enable response, often using behavioral analytics.Intermediate
• Network Traffic Analysis (NTA)Monitoring and analyzing network traffic to detect anomalies, threats and performance issues.Intermediate
• PersistenceTechniques attackers use to maintain access to a system across reboots, credential changes and other interruptions.Intermediate
• Pyramid of PainA model by David Bianco ranking indicator types by how much pain denying them causes the adversary.Intermediate
• Security Operations Center (SOC)A centralized team and facility that monitors, detects, analyzes and responds to cybersecurity incidents around the clock.Foundational
• SigmaA generic, vendor-neutral signature format for writing log-based detection rules that convert to SIEM queries.Advanced
• SOC Analyst TiersThe tiered structure of SOC roles, typically Tier 1 triage, Tier 2 investigation and Tier 3 hunting and advanced response.Foundational
• Stack CountingA hunting technique that counts occurrences of values across many hosts to find rare outliers.Advanced
• SysmonSystem Monitor, a free Microsoft Sysinternals tool that logs detailed process, network, file and registry activity to the Windows event log.Intermediate
• Tactics, Techniques and Procedures (TTP)The patterns of adversary behavior: tactics are goals, techniques are methods and procedures are specific implementations.Intermediate
• Threat HuntingProactively searching for threats that have evaded existing detections, based on hypotheses, intelligence or analytics.Intermediate
• YARAA pattern-matching tool and rule language for identifying and classifying malware based on textual or binary patterns.Intermediate
• ZeekAn open-source network security monitoring tool that generates detailed logs of network protocol activity.Intermediate