CompTIA CySA+: key terms

Flashcards for this exam CompTIA CySA+ guide Class dates

• Account LockoutDisabling an account temporarily or permanently after a set number of failed login attempts.Foundational
• Account Takeover (ATO)Unauthorized control of a legitimate user account, typically through stolen credentials or session tokens.Intermediate
• Advanced Persistent Threat (APT)A well-resourced, stealthy adversary that gains long-term access to a target to steal data or prepare for disruption.Intermediate
• Adversary EmulationTesting defenses by replicating the specific TTPs of a known threat actor.Advanced
• Adversary-in-the-Middle Phishing (AiTM)Phishing that proxies a real login session to steal both credentials and session cookies, bypassing traditional MFA.Advanced
• After-Action Report (AAR)A formal document summarizing an incident or exercise, its timeline, outcomes and recommendations.Intermediate
• Agent-Based ScanningVulnerability assessment using software agents installed on endpoints that report findings to a central console.Intermediate
• Alert FatigueDesensitization of responders caused by too many, too noisy, or non-actionable alerts, leading to missed real incidents.Foundational
• Anomaly-Based DetectionDetecting threats by identifying deviations from an established baseline of normal behavior.Foundational
• Anti-CSRF TokenA secret, unpredictable value tied to the user's session that must accompany state-changing requests, proving they originated from the application.Foundational
• Anti-ForensicsTechniques used to hinder forensic investigation by destroying, hiding or falsifying evidence.Intermediate
• Antimalware Scan Interface (AMSI)A Windows interface that lets antimalware products scan script content and in-memory buffers at runtime.Advanced
• Application InventoryA maintained catalog of an organization's applications, APIs and components with owners, data classification and risk ratings.Foundational
• Asset CriticalityA rating of how important an asset is to the business, used to prioritize protection and response.Foundational
• Asset InventoryA complete, current record of hardware, software, cloud resources and data assets an organization owns or uses.Foundational
• Atomic Red TeamAn open-source library by Red Canary of small, ATT&CK-mapped tests that simulate individual adversary techniques.Advanced
• ATT&CK NavigatorA MITRE web tool for visualizing and annotating ATT&CK matrices as layers.Advanced
• ATT&CK TacticA column in the MITRE ATT&CK matrix representing the adversary's tactical goal, the "why" of an action.Intermediate
• ATT&CK TechniqueAn entry in MITRE ATT&CK describing how an adversary achieves a tactical goal, identified by a T number.Intermediate
• Attack SurfaceThe total set of points where an unauthorized user could try to enter or extract data from a system.Foundational
• Attack Surface Management (ASM)Continuous discovery, inventory and monitoring of an organization's internet-facing assets and exposures.Intermediate
• AttributionIdentifying the threat actor responsible for an attack based on technical evidence, TTPs and intelligence.Advanced
• AuditdThe Linux Audit daemon that records system calls, file access and security-relevant events based on configured rules.Intermediate
• AutopsyAn open-source digital forensics platform and graphical interface for The Sleuth Kit.Intermediate
• AWS CloudTrailAWS service that records API activity and account events for governance, auditing and security investigation.Foundational
• BackdoorA hidden method of bypassing normal authentication or security controls to access a system.Foundational
• Banking TrojanA trojan designed to steal online banking credentials and manipulate financial transactions.Intermediate
• BaselineA documented reference of normal system, network or user behavior used to identify anomalies.Foundational
• BeaconingRegular, periodic outbound communication from a compromised host to attacker command-and-control infrastructure.Intermediate
• Behavioral DetectionDetecting threats by analyzing actions and sequences of activity rather than static signatures.Intermediate
• Blind SQL InjectionSQL injection where the application does not return query results or errors, so impact is inferred from behavior or timing.Intermediate
• Blue TeamThe defensive security team responsible for detecting, responding to and preventing attacks.Foundational
• Breach and Attack Simulation (BAS)Automated platforms that continuously run safe simulated attacks to validate whether security controls detect and block them.Intermediate
• Broken Access ControlOWASP Top 10 category (A01) for failures to enforce what authenticated or anonymous users are allowed to do.Foundational
• Buffer OverflowWriting more data into a memory buffer than it can hold, overwriting adjacent memory and potentially enabling code execution.Intermediate
• Bug Bounty ProgramA program in which organizations reward independent researchers for responsibly reporting security vulnerabilities.Foundational
• Business Email Compromise (BEC)A fraud in which attackers impersonate or take over business email accounts to trick staff into sending money or data.Intermediate
• Chain of CustodyDocumentation that records every person who handled evidence, when, why and how, from collection to presentation.Foundational
• Cloud ForensicsForensic investigation of incidents in cloud environments, relying on provider logs, snapshots and APIs.Advanced
• Cobalt StrikeA commercial adversary simulation framework whose Beacon payload is widely abused by real attackers for command and control.Advanced
• Command and Control (C2)Infrastructure and channels attackers use to communicate with and control compromised systems.Intermediate
• Command InjectionInjecting operating system commands through an application input that is passed to a system shell.Intermediate
• Common Event Format (CEF)A standardized text-based log format developed by ArcSight for interoperable security event reporting.Advanced
• Common Information Model (CIM)Splunk's shared semantic model that normalizes field names across data sources into standard data models.Intermediate
• Common Vulnerabilities and Exposures (CVE)A public dictionary of unique identifiers for publicly disclosed cybersecurity vulnerabilities.Foundational
• Common Vulnerability Scoring System (CVSS)An open standard for rating the severity of vulnerabilities on a 0.0 to 10.0 scale, maintained by FIRST.Foundational
• Common Weakness Enumeration (CWE)A community-developed catalog of software and hardware weakness types, maintained by MITRE.Intermediate
• Communication PlanThe part of the IR plan defining who is notified, how, when and by whom during an incident.Foundational
• Compensating ControlAlternative control used when a primary control cannot be implemented, providing equivalent risk reduction.Intermediate
• Concurrent Session UsageAn indicator where the same account has simultaneous active sessions from different devices or locations.Foundational
• Confidence LevelAn assessment of how reliable an intelligence finding or indicator is, based on source reliability and corroboration.Intermediate
• Container Image ScanningScanning container images for vulnerable OS packages and libraries, misconfigurations, secrets and malware before and after deployment.Intermediate
• ContainmentThe incident response phase that limits the spread and impact of an incident while preserving evidence.Foundational
• Content Security Policy (CSP)An HTTP response header that tells browsers which sources of scripts, styles and other content are allowed, mitigating XSS and data injection.Intermediate
• Coordinated Vulnerability Disclosure (CVD)A disclosure model where a researcher privately reports a flaw and publication is delayed until the vendor can release a fix.Intermediate
• Correlation RuleSIEM logic that combines multiple events, possibly across sources and time, to identify suspicious patterns.Intermediate
• Credential DumpingExtracting account credentials such as password hashes or plaintext passwords from an operating system or software.Advanced
• Credential HarvestingCollecting usernames and passwords from victims, usually through fake login pages or malware.Foundational
• Credential StuffingAutomated use of username-password pairs leaked from one breach to log in to other services.Intermediate
• Credentialed ScanA vulnerability scan that logs in to targets with valid credentials to assess installed software and configurations accurately.Foundational
• Cross-Site Request Forgery (CSRF)An attack that tricks an authenticated user's browser into sending unwanted requests to a site where they are logged in.Intermediate
• Cross-Site Scripting (XSS)An attack that injects malicious script into web pages viewed by other users, executing in their browsers.Foundational
• CrowdStrike FalconCrowdStrike's cloud-native endpoint and XDR platform delivered through a single lightweight sensor.Intermediate
• CryptojackingUnauthorized use of a victim's computing resources to mine cryptocurrency.Foundational
• CVSS Base MetricsCVSS metrics describing a vulnerability's intrinsic exploitability and impact characteristics.Intermediate
• CVSS Environmental MetricsCVSS metrics that adjust a score for a specific organization's environment and security requirements.Advanced
• CVSS v4.0The 2023 version of CVSS that adds Attack Requirements, splits impact into vulnerable and subsequent systems and renames Temporal to Threat metrics.Advanced
• Cyber Kill ChainLockheed Martin's seven-stage model of an intrusion from reconnaissance to actions on objectives.Foundational
• Cyber RangeA controlled virtual environment that simulates networks, systems and applications for security training, testing and exercises.Foundational
• Cyber Threat Intelligence (CTI)Evidence-based knowledge about threats and threat actors that informs security decisions.Foundational
• Dark Web MonitoringWatching underground forums, marketplaces and leak sites for stolen data, credentials or threats targeting an organization.Intermediate
• Data BreachA security incident resulting in confirmed unauthorized access to or disclosure of sensitive data.Foundational
• Data Breach NotificationLegal or contractual obligations to inform regulators, affected individuals or partners after a qualifying data breach.Intermediate
• Data EnrichmentAdding context, such as threat intelligence, asset criticality, user identity or geolocation, to events and alerts.Intermediate
• Data ExfiltrationThe unauthorized transfer of data out of an organization to an attacker-controlled location.Intermediate
• DCSyncAn attack that impersonates a domain controller to request password hashes from Active Directory via replication.Advanced
• ddA Unix command-line utility used to create raw bit-for-bit copies of disks and partitions.Intermediate
• Deception TechnologySecurity tools that deploy decoys, lures and fake credentials throughout an environment to detect attackers.Intermediate
• Default CredentialsFactory-set usernames and passwords on applications, devices or services that are publicly documented.Foundational
• Detection and AnalysisThe incident response phase focused on identifying potential incidents, validating them and determining scope and impact.Foundational
• Detection EngineeringThe discipline of designing, building, testing and maintaining threat detections as code.Advanced
• DetonationExecuting a suspicious file or opening a URL in a sandbox to trigger and observe any malicious behavior.Intermediate
• Diamond Model of Intrusion AnalysisAn analytic model describing every intrusion event by four core features: adversary, capability, infrastructure and victim.Intermediate
• Digital ForensicsThe scientific collection, preservation, analysis and presentation of digital evidence in a legally defensible manner.Foundational
• Directory TraversalAn attack that manipulates file paths with sequences like ../ to access files outside the intended directory.Foundational
• DLL Side-LoadingPlacing a malicious DLL alongside a legitimate signed application so the application loads it.Advanced
• DNS SinkholeA DNS server configuration that returns a controlled IP for known malicious domains to block and identify infected hosts.Intermediate
• DNS TunnelingEncoding data or command-and-control traffic inside DNS queries and responses to bypass network controls.Advanced
• DOM-Based Cross-Site ScriptingXSS that occurs entirely in client-side JavaScript when it writes untrusted data from a source into a dangerous sink.Intermediate
• Domain Generation Algorithm (DGA)An algorithm in malware that generates many pseudo-random domain names to locate its command-and-control servers.Advanced
• Double ExtortionA ransomware tactic that both encrypts data and threatens to leak stolen copies unless a ransom is paid.Intermediate
• DropperMalware whose purpose is to install another malicious payload that it carries within itself.Intermediate
• Dwell TimeThe length of time an attacker remains undetected in an environment from initial compromise to detection.Intermediate
• Dynamic Malware AnalysisExecuting malware in a controlled environment to observe its behavior, network activity and system changes.Intermediate
• Egress FilteringRestricting outbound network traffic from systems to only approved destinations and protocols.Intermediate
• EmotetA modular malware family that evolved from a banking trojan into a major spam-distributed loader for other malware.Intermediate
• Endpoint Detection and Response (EDR)Security software that continuously records endpoint activity, detects malicious behavior and enables investigation and response.Foundational
• Endpoint Protection Platform (EPP)An endpoint security solution focused on preventing threats with antimalware, firewall, device control and exploit prevention.Foundational
• EradicationThe incident response phase that removes the threat, including malware, backdoors and compromised accounts, from the environment.Foundational
• EscalationTransferring an alert or incident to a higher tier, specialist team or management according to defined criteria.Foundational
• Event ID 1102The Windows Security event recorded when the audit log is cleared.Intermediate
• Event ID 4624The Windows Security event recorded when an account successfully logs on.Intermediate
• Event ID 4625The Windows Security event recorded when an account fails to log on.Intermediate
• Event ID 4688The Windows Security event recorded when a new process is created, optionally including the full command line.Intermediate
• Event ID 7045The Windows System event recorded when a new service is installed.Advanced
• Evidence IntegrityAssurance that evidence has not been altered since collection, typically demonstrated by cryptographic hashes.Foundational
• ExploitCode or a technique that takes advantage of a vulnerability to cause unintended behavior, such as code execution.Foundational
• Exploit KitA toolkit hosted on malicious or compromised websites that automatically probes visitors' browsers for vulnerabilities and delivers malware.Intermediate
• Exploit Prediction Scoring System (EPSS)A FIRST data-driven model estimating the probability that a CVE will be exploited in the wild within the next 30 days.Intermediate
• Extended Detection and Response (XDR)A security platform that correlates telemetry across endpoints, network, cloud, identity and email for unified detection and response.Intermediate
• External Attack Surface Management (EASM)Continuous discovery and monitoring of an organization's internet-facing assets as an attacker would see them.Intermediate
• False Negative (FN)A failure to alert on activity that is actually malicious.Foundational
• False Positive (FP)An alert that flags benign activity as malicious.Foundational
• Fast FluxA DNS technique that rapidly changes the IP addresses associated with a domain to hide malicious infrastructure.Advanced
• File CarvingRecovering files from raw data based on content signatures such as headers and footers, without file system metadata.Intermediate
• File HashA fixed-length value computed from file content by a hash function, used to identify files and verify integrity.Foundational
• Fileless MalwareMalware that runs in memory and abuses legitimate system tools instead of writing malicious executables to disk.Intermediate
• Forensic ImageA bit-for-bit copy of a storage device, including unallocated space and slack, used for analysis instead of the original.Foundational
• Forensic ReportA formal document presenting the methods, findings and conclusions of a forensic investigation.Intermediate
• FTK ImagerA free Exterro (formerly AccessData) tool for creating forensic images and capturing memory on Windows.Intermediate
• Full Packet Capture (FPC)Recording complete network packets, including payloads, for detailed analysis and forensics.Intermediate
• Fuzz TestingAn automated testing technique that feeds large volumes of malformed, unexpected or random input to a program to find crashes and bugs.Foundational
• Golden TicketA forged Kerberos TGT created with the KRBTGT account hash, granting unrestricted domain access.Advanced
• Hard-Coded CredentialsPasswords, API keys or cryptographic keys embedded directly in source code, scripts or binaries.Foundational
• HoneyfileA decoy file, often with an enticing name, that triggers an alert when accessed.Foundational
• HoneypotA decoy system designed to attract attackers, detect intrusion attempts and study their techniques.Foundational
• HoneytokenA fake credential, record or data item planted to detect unauthorized access or use.Intermediate
• Host IsolationDisconnecting an endpoint from the network except for the security management channel to contain a threat.Foundational
• HTTP Security HeadersResponse headers that enable browser security features such as HSTS, CSP, frame restrictions and MIME sniffing protection.Intermediate
• HttpOnly Cookie AttributeA cookie flag that prevents client-side scripts from reading the cookie, reducing session theft via XSS.Foundational
• Hypothesis-Driven HuntingA threat hunting approach that starts with a testable hypothesis about adversary behavior in the environment.Advanced
• Identification and Authentication FailuresOWASP Top 10 category for weaknesses in confirming user identity, authentication and session management.Foundational
• Immutable BackupA backup that cannot be modified or deleted for a defined retention period, even by administrators.Intermediate
• Impossible TravelDetection that flags sign-ins from geographically distant locations within a time too short for real travel.Intermediate
• Incident Commander (IC)The person who coordinates the overall response to a major incident, delegating work and managing communication rather than fixing the issue directly.Intermediate
• Incident Response (IR)The organized approach to preparing for, detecting, containing, eradicating and recovering from security incidents.Foundational
• Incident Response Plan (IRP)A documented set of policies, roles and procedures guiding how an organization responds to security incidents.Foundational
• Incident Response Team (CSIRT)The group responsible for handling security incidents, also called a computer security incident response team.Foundational
• Incident SeverityA classification of an incident's urgency and impact used to prioritize response and escalation.Foundational
• Indicator of Attack (IoA)Evidence of attacker behavior or intent in progress, focusing on techniques rather than specific artifacts.Intermediate
• Indicator of Compromise (IoC)Forensic evidence that a system or network has likely been breached, such as malicious hashes, IPs, domains or registry keys.Foundational
• Information Sharing and Analysis Center (ISAC)A sector-based organization that facilitates sharing of threat information among member companies.Foundational
• InfostealerMalware designed to harvest credentials, browser cookies, crypto wallets and other sensitive data from infected systems.Intermediate
• Initial AccessThe ATT&CK tactic (TA0001) covering techniques adversaries use to gain their first foothold in a network.Intermediate
• Initial Access Broker (IAB)A cybercriminal who compromises networks and sells that access to other criminals such as ransomware affiliates.Advanced
• InjectionOWASP Top 10 category for flaws where untrusted data is sent to an interpreter as part of a command or query.Foundational
• Input ValidationChecking that all untrusted input conforms to expected type, length, format and range before it is processed.Foundational
• Insecure Direct Object Reference (IDOR)An access control flaw where an application exposes an internal object identifier and does not verify the user is authorized for that object.Foundational
• Insider ThreatA risk posed by a current or former employee, contractor or partner who misuses authorized access, maliciously or by accident.Foundational
• Interactive Application Security Testing (IAST)Security testing that uses agents instrumented inside a running application to observe code execution and data flow during functional tests.Intermediate
• Jump BagA pre-assembled kit of tools, media and documentation that incident responders can grab immediately.Intermediate
• KerberoastingRequesting Kerberos service tickets for accounts with SPNs and cracking them offline to recover service account passwords.Advanced
• Known Exploited Vulnerabilities Catalog (KEV)CISA's authoritative list of vulnerabilities confirmed to be actively exploited in the wild.Intermediate
• Kroll Artifact Parser and Extractor (KAPE)A free triage tool that collects and parses forensic artifacts from Windows systems using targets and modules.Advanced
• Kusto Query Language (KQL)A read-only query language used in Azure Monitor Log Analytics, Application Insights, Microsoft Sentinel, and Azure Data Explorer.Intermediate
• Lateral MovementTechniques attackers use to move from one compromised system to others within a network.Intermediate
• Legal HoldA directive to preserve all potentially relevant information when litigation or investigation is reasonably anticipated.Foundational
• Lessons LearnedA review conducted after an incident to identify what happened, what worked, what failed and how to improve.Foundational
• Live AcquisitionCollecting evidence from a running system, capturing volatile data before it is lost.Intermediate
• Living off the Land (LotL)An attacker technique of using tools already present on the target system to blend in and avoid detection.Intermediate
• Living Off the Land Binaries (LOLBins)Legitimate, signed operating system binaries that attackers abuse to download, execute or hide malicious activity.Advanced
• LoaderFirst-stage malware that downloads or decrypts and executes additional payloads on a compromised system.Advanced
• Log AggregationCollecting logs from many systems into a central store for search, correlation, retention, and alerting.Foundational
• Log NormalizationConverting logs from different formats into a common schema so they can be correlated and searched consistently.Intermediate
• Log RetentionPolicy defining how long logs are stored, balancing investigation needs, compliance requirements and cost.Intermediate
• Log TamperingModifying, deleting or disabling logs to hide malicious activity.Intermediate
• Log4ShellA critical 2021 remote code execution vulnerability (CVE-2021-44228) in Apache Log4j 2 caused by JNDI lookups in logged strings.Foundational
• LookupA Splunk knowledge object that enriches events by matching field values against an external table or source.Intermediate
• MAC Times (MACB)File system timestamps recording when a file was Modified, Accessed, Changed (metadata) and Born (created).Advanced
• Magic NumberA fixed sequence of bytes at the start of a file that identifies its true format regardless of extension.Intermediate
• MaltegoA graphical link-analysis tool that maps relationships between people, domains, organizations and infrastructure for OSINT.Intermediate
• MalvertisingThe use of online advertising to deliver malware or redirect users to malicious sites.Intermediate
• Malware SandboxAn isolated, instrumented environment where suspicious files or URLs are executed safely to observe behavior.Intermediate
• Man-in-the-Browser (MitB)An attack in which malware inside the browser intercepts and modifies web content and transactions.Intermediate
• Managed Detection and Response (MDR)An outsourced service providing 24x7 threat detection, investigation and active response using the provider's tools and analysts.Intermediate
• Managed Security Service Provider (MSSP)A third party that delivers outsourced security monitoring and management services.Foundational
• Mark of the Web (MotW)A Zone.Identifier alternate data stream Windows adds to downloaded files to mark them as originating from the internet.Advanced
• Mean Time to Detect (MTTD)The average time between when an incident begins and when it is detected.Foundational
• Mean Time to Respond (MTTR)The average time between detecting an incident and containing or resolving it.Foundational
• Memory ForensicsAnalysis of volatile memory captures to find running processes, network connections, injected code and other evidence.Intermediate
• Memory InjectionInserting malicious code into the memory space of a running process to execute it under that process's context.Advanced
• Metamorphic MalwareMalware that rewrites its own code on each propagation so no two copies share the same instructions.Advanced
• MFA Fatigue AttackRepeatedly sending MFA push requests to a user with stolen credentials until they approve one.Intermediate
• Microsoft SentinelMicrosoft's cloud-native SIEM and SOAR solution built on Azure Log Analytics.Intermediate
• MimikatzA post-exploitation tool that extracts plaintext passwords, hashes, Kerberos tickets and other credentials from Windows memory.Advanced
• MISPAn open-source threat intelligence sharing platform originally called the Malware Information Sharing Platform.Advanced
• Missing LogsAn indicator of compromise where expected log data is absent, suggesting tampering or deliberate clearing.Intermediate
• MITRE ATT&CKA globally accessible knowledge base of adversary tactics, techniques and procedures based on real-world observations.Foundational
• MITRE D3FENDA MITRE knowledge graph of defensive cybersecurity countermeasures mapped to offensive techniques.Advanced
• Mobile Device ForensicsAcquiring and analyzing data from smartphones and tablets, such as messages, location history and app data.Intermediate
• National Vulnerability Database (NVD)The US government repository, maintained by NIST, that enriches CVE records with CVSS scores, CWE and CPE data.Foundational
• NessusA widely used commercial vulnerability scanner from Tenable that uses plugins to detect vulnerabilities and misconfigurations.Foundational
• NetFlowA Cisco-originated technology that exports metadata about traffic flows, such as addresses, ports and byte counts, to a collector.Intermediate
• Network Detection and Response (NDR)A solution that analyzes network traffic to detect threats and enable response, often using behavioral analytics.Intermediate
• Network ForensicsCapturing and analyzing network traffic and logs to investigate security incidents.Intermediate
• Network Time Protocol (NTP)A protocol that synchronizes clocks across network devices and hosts, using UDP port 123.Foundational
• Network Traffic Analysis (NTA)Monitoring and analyzing network traffic to detect anomalies, threats and performance issues.Intermediate
• NIST Cybersecurity Framework (CSF)A NIST framework of cybersecurity outcomes organized into six functions: Govern, Identify, Protect, Detect, Respond and Recover.Foundational
• NIST SP 800-61The NIST publication providing guidance on computer security incident handling and response.Intermediate
• Non-Credentialed ScanA vulnerability scan performed without logging in, seeing only what is exposed over the network.Foundational
• Notable EventAn event generated by a Splunk Enterprise Security correlation search that requires analyst review.Intermediate
• NotPetyaA 2017 destructive wiper disguised as ransomware that spread from a compromised Ukrainian accounting software update.Intermediate
• ObfuscationMaking data or code difficult to understand without changing its function, to hinder analysis.Foundational
• Open Cybersecurity Schema Framework (OCSF)An open, vendor-neutral schema for normalizing security event data across tools.Advanced
• Open-Source Intelligence (OSINT)Intelligence collected from publicly available sources such as websites, social media, public records and search engines.Foundational
• Operational Threat IntelligenceIntelligence about specific impending attacks or campaigns, including actor intent, timing and capability.Intermediate
• Order of VolatilityThe sequence for collecting evidence from most to least volatile so short-lived data is not lost.Foundational
• Organized Crime GroupA structured criminal enterprise that conducts cyberattacks primarily for financial gain.Foundational
• Out-of-Band CommunicationCommunication through channels separate from potentially compromised production systems during an incident.Intermediate
• Out-of-Cycle LoggingLog entries generated at unusual times or outside expected patterns, indicating possible malicious activity.Foundational
• Output EncodingConverting untrusted data into a safe representation for the specific context where it is output, such as HTML, JavaScript, URL or SQL.Foundational
• OWASP Top 10OWASP's awareness document ranking the ten most critical web application security risk categories, updated every few years.Foundational
• PackerA HashiCorp tool that builds identical machine images for multiple platforms from a single HCL template.Intermediate
• ParsingExtracting structured fields from raw log data so events can be searched and correlated.Intermediate
• Pass-the-Hash (PtH)Authenticating to a remote system using a captured NTLM password hash instead of the plaintext password.Advanced
• Pass-the-Ticket (PtT)Using a stolen Kerberos ticket to authenticate to services without knowing the user's password.Advanced
• Passive OT Network MonitoringMonitoring industrial networks by analyzing copies of traffic, without sending packets to fragile control devices.Intermediate
• Password SprayingTrying a few common passwords against many accounts to avoid lockout thresholds.Intermediate
• Patch ManagementThe process of acquiring, testing, deploying and verifying software updates to fix vulnerabilities and defects.Foundational
• PersistenceTechniques attackers use to maintain access to a system across reboots, credential changes and other interruptions.Intermediate
• Phishing SimulationAn authorized fake phishing campaign used to measure and improve user resistance to email-based attacks.Foundational
• PlaybookA documented or automated set of steps for responding to a specific type of security incident or alert.Foundational
• Polymorphic MalwareMalware that changes its code appearance with each infection, often through encryption, to evade signature detection.Intermediate
• Post-Incident ActivityThe final incident response phase covering lessons learned, reporting, evidence retention and process improvement.Foundational
• PowerShell Script Block LoggingA Windows feature that records the content of PowerShell script blocks as they execute, including deobfuscated code.Intermediate
• PrecursorA sign that an incident may occur in the future.Intermediate
• PrefetchWindows files that record application execution details to speed up program loading, valuable as evidence of execution.Advanced
• PreparationThe incident response phase in which an organization establishes capabilities, tools, plans and training before incidents occur.Foundational
• Priority Intelligence Requirement (PIR)A high-priority question that stakeholders need intelligence to answer, guiding collection and analysis.Advanced
• Privilege EscalationGaining higher-level permissions than originally granted, such as moving from a standard user to administrator or root.Intermediate
• Process Creation LoggingRecording every new process with its command line, parent and user to support detection and investigation.Intermediate
• Process InjectionAn ATT&CK technique (T1055) in which malware executes code within the address space of another process.Advanced
• Proof of Concept (PoC)A demonstration that a vulnerability is real and exploitable, used to validate findings and prioritize remediation.Foundational
• Purple TeamA collaborative approach in which red and blue teams work together to improve detections in real time.Intermediate
• Pyramid of PainA model by David Bianco ranking indicator types by how much pain denying them causes the adversary.Intermediate
• RansomwareMalware that encrypts or locks a victim's data or systems and demands payment for restoration.Foundational
• Ransomware-as-a-Service (RaaS)A criminal business model in which ransomware developers lease their malware and infrastructure to affiliates for a share of ransoms.Intermediate
• RecoveryThe incident response phase that restores systems and operations to normal and verifies they are functioning securely.Foundational
• Red TeamA group that emulates real adversaries to test an organization's detection and response capabilities.Foundational
• Reflected Cross-Site ScriptingXSS in which a malicious script in a request is immediately echoed in the response without proper encoding.Foundational
• Registry Run KeysWindows registry locations that automatically launch programs at user logon or system boot.Intermediate
• ReimagingRestoring a system from a known-good image to remove compromise rather than attempting to clean it.Foundational
• Remote Access Trojan (RAT)A trojan that gives an attacker covert remote administrative control over an infected system.Foundational
• Remote Code Execution (RCE)The ability of an attacker to execute arbitrary code on a target system over a network.Foundational
• Resource ConsumptionAn indicator of malicious activity shown by unusual CPU, memory, disk, or bandwidth usage.Foundational
• Reverse EngineeringAnalyzing software to understand its design and behavior, typically by disassembling or decompiling compiled code.Advanced
• Risk-Based Alerting (RBA)A detection approach that assigns risk scores to entities for suspicious observations and alerts only when cumulative risk exceeds a threshold.Advanced
• Root Cause Analysis (RCA)A structured investigation to identify the underlying causes of an incident so they can be eliminated.Foundational
• RootkitMalware that hides its presence and other malicious activity by subverting the operating system at a deep level.Intermediate
• RunbookA documented procedure describing how to perform a routine operational task or respond to a specific alert.Foundational
• Runtime Application Self-Protection (RASP)Security technology embedded in an application's runtime that detects and blocks attacks in real time using application context.Intermediate
• Runtime Container SecurityMonitoring running containers and hosts for anomalous or malicious behavior such as unexpected processes, file changes or network connections.Advanced
• Sandbox EvasionTechniques malware uses to detect analysis environments and alter or delay its behavior to avoid detection.Advanced
• SANS PICERLThe SANS six-step incident response model: Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned.Intermediate
• SAST False Positive ManagementProcesses for triaging, suppressing and tuning static analysis results so developers trust and act on findings.Intermediate
• Scheduled TaskA Windows mechanism for running programs at specified times or events, frequently abused for persistence and execution.Intermediate
• ScopingDetermining which controls or requirements apply to a system, process, or assessment.Intermediate
• Secure Code ReviewManual examination of source code to find security flaws, often focused on high-risk components and guided by checklists and tool output.Foundational
• Secure Software Development Life Cycle (SSDLC)A software development life cycle that builds security activities into every phase, from requirements and design through deployment and retirement.Foundational
• Security BenchmarkA consensus-based configuration standard specifying secure settings for systems and applications.Intermediate
• Security Content Automation Protocol (SCAP)A NIST suite of specifications for automating vulnerability management, measurement and compliance checking.Advanced
• Security Data LakeA centralized repository that stores large volumes of raw and normalized security telemetry for analytics and long-term retention.Advanced
• Security EventAny observable occurrence in a system or network that may have security relevance.Foundational
• Security IncidentAn occurrence that actually or potentially jeopardizes the confidentiality, integrity or availability of information or systems, or violates security policy.Foundational
• Security Information and Event Management (SIEM)A platform that collects, normalizes, correlates and analyzes log data from across an environment to detect and investigate threats.Foundational
• Security Logging and Monitoring FailuresOWASP Top 10 category for insufficient logging, detection, alerting and response that allows breaches to go unnoticed.Foundational
• Security MisconfigurationOWASP Top 10 category for insecure default, incomplete or ad hoc configurations across the application stack.Foundational
• Security Operations Center (SOC)A centralized team and facility that monitors, detects, analyzes and responds to cybersecurity incidents around the clock.Foundational
• Security Orchestration, Automation and Response (SOAR)A platform that integrates security tools and automates investigation and response workflows using playbooks.Intermediate
• SegmentationUsing network separation as a containment measure to restrict an attacker's ability to move or communicate.Foundational
• Server-Side Request Forgery (SSRF)An attack that makes a server issue requests to unintended internal or external destinations on the attacker's behalf.Advanced
• Session HijackingTaking over a valid user session by stealing or predicting its session identifier or token.Intermediate
• Session ManagementThe secure creation, maintenance and termination of user sessions after authentication.Foundational
• Shadow ITHardware, software or cloud services used inside an organization without the approval or knowledge of IT and security.Foundational
• SigmaA generic, vendor-neutral signature format for writing log-based detection rules that convert to SIEM queries.Advanced
• Signature-Based DetectionDetecting threats by matching known patterns, such as file hashes or byte sequences, against a database of signatures.Foundational
• Silver TicketA forged Kerberos service ticket created with a service account's hash to access a specific service.Advanced
• SIM SwappingFraudulently transferring a victim's phone number to an attacker-controlled SIM to intercept calls and SMS codes.Intermediate
• Simulation ExerciseAn exercise that simulates an incident with hands-on activity in a controlled environment to test response capabilities.Intermediate
• Slack SpaceUnused space between the end of a file's data and the end of the last cluster allocated to it.Intermediate
• SnapshotA point-in-time capture of the state of a volume, virtual machine or storage system.Foundational
• SnortAn open-source network intrusion detection and prevention system using rule-based signature matching, now maintained by Cisco.Intermediate
• SOC Analyst TiersThe tiered structure of SOC roles, typically Tier 1 triage, Tier 2 investigation and Tier 3 hunting and advanced response.Foundational
• Software Bill of Materials (SBOM)A formal, machine-readable inventory of all components and dependencies in a piece of software.Intermediate
• Splunk Enterprise Security (ES)Splunk's premium SIEM application providing correlation searches, notable events, risk-based alerting and security dashboards.Intermediate
• Splunk Search Processing LanguageThe query language used in Splunk to search, filter, transform and visualize machine data.Foundational
• SQL Injection (SQLi)Injecting malicious SQL into application inputs to read, modify or delete database data or bypass authentication.Foundational
• SQL Injection PreventionThe set of defenses that stop SQL injection, led by parameterized queries and supported by validation and least privilege.Foundational
• Stack CountingA hunting technique that counts occurrences of values across many hosts to find rare outliers.Advanced
• Stakeholder-Specific Vulnerability Categorization (SSVC)A decision-tree method for prioritizing vulnerabilities based on exploitation, exposure, automatability and impact.Advanced
• Static Malware AnalysisExamining a malware sample without executing it, using file properties, strings, headers and disassembly.Intermediate
• stats CommandAn SPL transforming command that calculates aggregate statistics such as count, sum, average and distinct count, grouped by fields.Foundational
• SteganographyHiding the existence of data inside other data, such as an image, audio, or network traffic.Foundational
• Stored Cross-Site ScriptingXSS in which a malicious script is saved by the application and later served to other users.Foundational
• Strategic Threat IntelligenceHigh-level intelligence about threat trends, motivations and risks for executives and decision-makers.Intermediate
• STRIDEMicrosoft's threat classification mnemonic: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege.Foundational
• Structured Threat Information Expression (STIX)A standardized JSON language for representing cyber threat intelligence objects and relationships.Intermediate
• SUNBURSTThe backdoor inserted into SolarWinds Orion software updates in a 2020 supply chain attack.Advanced
• Supply Chain AttackAn attack that compromises a trusted vendor, software component or service provider to reach its downstream customers.Intermediate
• SuricataAn open-source, multithreaded intrusion detection and prevention engine and network security monitoring tool.Intermediate
• SyslogA standard for sending event log messages to a central collector, traditionally over UDP port 514.Foundational
• Syslog Severity LevelsThe eight syslog message levels from 0 (Emergency) to 7 (Debugging).Intermediate
• SysmonSystem Monitor, a free Microsoft Sysinternals tool that logs detailed process, network, file and registry activity to the Windows event log.Intermediate
• Tabletop Exercise (TTX)A discussion-based exercise in which participants walk through a simulated incident scenario to test plans and roles.Foundational
• Tactical Threat IntelligenceIntelligence describing adversary tactics, techniques and procedures, used by defenders to improve detections and controls.Intermediate
• Tactics, Techniques and Procedures (TTP)The patterns of adversary behavior: tactics are goals, techniques are methods and procedures are specific implementations.Intermediate
• tcpdumpA command-line packet capture tool for Unix-like systems.Intermediate
• Technical Threat IntelligenceSpecific, machine-readable indicators such as malicious IPs, domains, URLs and file hashes.Intermediate
• Threat ActorAn individual or group that carries out or intends to carry out malicious activity against an organization's systems or data.Foundational
• Threat FeedA continuous stream of threat data, typically indicators of compromise, delivered for integration into security tools.Foundational
• Threat HuntingProactively searching for threats that have evaded existing detections, based on hypotheses, intelligence or analytics.Intermediate
• Threat Intelligence LifecycleThe cyclical process for producing intelligence: requirements, collection, processing, analysis, dissemination and feedback.Intermediate
• Threat Intelligence Platform (TIP)A system that aggregates, normalizes, scores and distributes threat intelligence to security tools and teams.Intermediate
• Threat VectorThe path or means by which a threat actor gains access to a target, such as email, removable media or vulnerable software.Foundational
• Timeline AnalysisReconstructing the sequence of events in an incident by ordering timestamps from multiple artifacts.Intermediate
• TimestompingAn anti-forensics technique that alters file timestamps to blend malicious files in or mislead investigators.Advanced
• Traffic Light Protocol (TLP)A scheme for marking how widely shared threat information may be disseminated.Intermediate
• TriageRapidly assessing alerts or incidents to determine validity, severity and priority for response.Foundational
• Triage CollectionRapid acquisition of high-value forensic artifacts from a system instead of a full disk image.Advanced
• True Positive (TP)An alert that correctly identifies real malicious activity.Foundational
• Trusted Automated Exchange of Intelligence Information (TAXII)A protocol for exchanging cyber threat intelligence over HTTPS, designed to carry STIX data.Intermediate
• TuningAdjusting detection rules, thresholds and exclusions to improve alert accuracy.Intermediate
• TyposquattingRegistering domain names that are common misspellings or variants of legitimate domains to deceive users.Foundational
• Unallocated SpaceAreas of a storage device not currently assigned to any file, which may contain deleted data.Intermediate
• Use CaseA defined detection scenario describing what threat to detect, which data is required and how to respond.Intermediate
• User and Entity Behavior Analytics (UEBA)Analytics that baseline normal behavior of users and entities and flag anomalies that may indicate threats.Intermediate
• VelociraptorAn open-source endpoint visibility and digital forensics tool that queries many endpoints at scale using VQL.Advanced
• Verbose Error MessageAn error message that reveals internal details such as stack traces, queries, file paths or software versions.Foundational
• Virtual PatchingBlocking exploitation of a known vulnerability with an external control such as a WAF or IPS rule while the code fix is pending.Intermediate
• VirusTotalA Google-owned online service that scans files, URLs, domains and IPs with many antivirus engines and reputation tools.Foundational
• VolatilityAn open-source framework for extracting digital artifacts from memory images.Advanced
• VulnerabilityA weakness in an asset, control, or process that a threat could exploit.Foundational
• Vulnerability AssessmentA systematic process of identifying, quantifying and prioritizing vulnerabilities without attempting to exploit them.Foundational
• Vulnerability ExceptionA formally approved, documented decision to delay or not remediate a vulnerability, usually with compensating controls.Intermediate
• Vulnerability Exploitability eXchange (VEX)A machine-readable advisory stating whether a product is actually affected by a known vulnerability in one of its components.Advanced
• Vulnerability ManagementThe continuous process of identifying, assessing, prioritizing, remediating and verifying security weaknesses.Foundational
• Vulnerability PrioritizationRanking vulnerabilities for remediation based on severity, exploitability, exposure and asset criticality.Intermediate
• Vulnerability Remediation SLAA defined maximum time to fix a vulnerability based on its severity or risk rating.Foundational
• Vulnerability ScanningAutomated testing of systems and applications to identify known vulnerabilities, missing patches and misconfigurations.Foundational
• Vulnerability ValidationConfirming that a reported vulnerability truly exists and that remediation actually fixed it.Intermediate
• Vulnerable and Outdated ComponentsOWASP Top 10 2021 category for using libraries, frameworks or platforms with known vulnerabilities or that are unsupported.Foundational
• WannaCryA 2017 ransomware worm that spread globally through the EternalBlue SMBv1 exploit.Foundational
• Watering Hole AttackAn attack that compromises a website frequently visited by a target group in order to infect those visitors.Intermediate
• WeaponizationThe kill-chain stage where an attacker couples an exploit with a deliverable payload, such as a malicious document.Foundational
• Web ShellA malicious script uploaded to a web server that gives an attacker remote command execution through HTTP.Intermediate
• White TeamThe group that oversees a red team or cyber exercise, setting rules, refereeing, scoring and ensuring safety.Foundational
• Windows Event Forwarding (WEF)A built-in Windows feature that forwards event logs from many hosts to a central Windows Event Collector.Advanced
• Windows Event LogThe structured logging system in Windows that records security, system and application events.Foundational
• Windows Registry ForensicsExamining Windows registry hives for evidence of program execution, persistence, user activity and connected devices.Advanced
• Wiper MalwareDestructive malware designed to permanently erase or corrupt data and systems rather than extort payment.Intermediate
• WiresharkA free, open-source graphical protocol analyzer that captures and decodes network packets.Foundational
• Write BlockerA hardware or software tool that allows reading from a storage device while preventing any writes to it.Foundational
• YARAA pattern-matching tool and rule language for identifying and classifying malware based on textual or binary patterns.Intermediate
• ZAPAn open-source dynamic application security testing proxy and scanner, formerly OWASP ZAP and now maintained under Checkmarx sponsorship as ZAP by Checkmarx.Intermediate
• ZeekAn open-source network security monitoring tool that generates detailed logs of network protocol activity.Intermediate
• Zero-Day VulnerabilityA vulnerability unknown to the vendor or without an available patch, which attackers may exploit before defenders can fix it.Foundational