EC-Council Certified Threat Intelligence Analyst (CTIA): key terms

Flashcards for this exam EC-Council Certified Threat Intelligence Analyst (CTIA) guide

• Advanced Persistent Threat (APT)A well-resourced, stealthy adversary that gains long-term access to a target to steal data or prepare for disruption.Intermediate
• Adversary EmulationTesting defenses by replicating the specific TTPs of a known threat actor.Advanced
• ATT&CK NavigatorA MITRE web tool for visualizing and annotating ATT&CK matrices as layers.Advanced
• ATT&CK TacticA column in the MITRE ATT&CK matrix representing the adversary's tactical goal, the "why" of an action.Intermediate
• ATT&CK TechniqueAn entry in MITRE ATT&CK describing how an adversary achieves a tactical goal, identified by a T number.Intermediate
• AttributionIdentifying the threat actor responsible for an attack based on technical evidence, TTPs and intelligence.Advanced
• Cobalt StrikeA commercial adversary simulation framework whose Beacon payload is widely abused by real attackers for command and control.Advanced
• Confidence LevelAn assessment of how reliable an intelligence finding or indicator is, based on source reliability and corroboration.Intermediate
• Cyber Kill ChainLockheed Martin's seven-stage model of an intrusion from reconnaissance to actions on objectives.Foundational
• Cyber Threat Intelligence (CTI)Evidence-based knowledge about threats and threat actors that informs security decisions.Foundational
• Dark Web MonitoringWatching underground forums, marketplaces and leak sites for stolen data, credentials or threats targeting an organization.Intermediate
• Diamond Model of Intrusion AnalysisAn analytic model describing every intrusion event by four core features: adversary, capability, infrastructure and victim.Intermediate
• DLL Side-LoadingPlacing a malicious DLL alongside a legitimate signed application so the application loads it.Advanced
• Double ExtortionA ransomware tactic that both encrypts data and threatens to leak stolen copies unless a ransom is paid.Intermediate
• Dwell TimeThe length of time an attacker remains undetected in an environment from initial compromise to detection.Intermediate
• HacktivistA threat actor who attacks to promote a political, social or ideological cause rather than for profit.Foundational
• Hypothesis-Driven HuntingA threat hunting approach that starts with a testable hypothesis about adversary behavior in the environment.Advanced
• Indicator of Attack (IoA)Evidence of attacker behavior or intent in progress, focusing on techniques rather than specific artifacts.Intermediate
• Indicator of Compromise (IoC)Forensic evidence that a system or network has likely been breached, such as malicious hashes, IPs, domains or registry keys.Foundational
• Information Sharing and Analysis Center (ISAC)A sector-based organization that facilitates sharing of threat information among member companies.Foundational
• InfostealerMalware designed to harvest credentials, browser cookies, crypto wallets and other sensitive data from infected systems.Intermediate
• Initial AccessThe ATT&CK tactic (TA0001) covering techniques adversaries use to gain their first foothold in a network.Intermediate
• Initial Access Broker (IAB)A cybercriminal who compromises networks and sells that access to other criminals such as ransomware affiliates.Advanced
• Living off the Land (LotL)An attacker technique of using tools already present on the target system to blend in and avoid detection.Intermediate
• Living Off the Land Binaries (LOLBins)Legitimate, signed operating system binaries that attackers abuse to download, execute or hide malicious activity.Advanced
• LoaderFirst-stage malware that downloads or decrypts and executes additional payloads on a compromised system.Advanced
• MISPAn open-source threat intelligence sharing platform originally called the Malware Information Sharing Platform.Advanced
• MITRE ATT&CKA globally accessible knowledge base of adversary tactics, techniques and procedures based on real-world observations.Foundational
• MITRE D3FENDA MITRE knowledge graph of defensive cybersecurity countermeasures mapped to offensive techniques.Advanced
• Nation-State ActorA threat actor sponsored or directed by a government, with high sophistication, funding and strategic goals.Foundational
• NotPetyaA 2017 destructive wiper disguised as ransomware that spread from a compromised Ukrainian accounting software update.Intermediate
• Open-Source Intelligence (OSINT)Intelligence collected from publicly available sources such as websites, social media, public records and search engines.Foundational
• Operational Threat IntelligenceIntelligence about specific impending attacks or campaigns, including actor intent, timing and capability.Intermediate
• Organized Crime GroupA structured criminal enterprise that conducts cyberattacks primarily for financial gain.Foundational
• Priority Intelligence Requirement (PIR)A high-priority question that stakeholders need intelligence to answer, guiding collection and analysis.Advanced
• Process InjectionAn ATT&CK technique (T1055) in which malware executes code within the address space of another process.Advanced
• Pyramid of PainA model by David Bianco ranking indicator types by how much pain denying them causes the adversary.Intermediate
• Ransomware-as-a-Service (RaaS)A criminal business model in which ransomware developers lease their malware and infrastructure to affiliates for a share of ransoms.Intermediate
• SigmaA generic, vendor-neutral signature format for writing log-based detection rules that convert to SIEM queries.Advanced
• Strategic Threat IntelligenceHigh-level intelligence about threat trends, motivations and risks for executives and decision-makers.Intermediate
• Structured Threat Information Expression (STIX)A standardized JSON language for representing cyber threat intelligence objects and relationships.Intermediate
• SUNBURSTThe backdoor inserted into SolarWinds Orion software updates in a 2020 supply chain attack.Advanced
• Supply Chain AttackAn attack that compromises a trusted vendor, software component or service provider to reach its downstream customers.Intermediate
• Tactical Threat IntelligenceIntelligence describing adversary tactics, techniques and procedures, used by defenders to improve detections and controls.Intermediate
• Tactics, Techniques and Procedures (TTP)The patterns of adversary behavior: tactics are goals, techniques are methods and procedures are specific implementations.Intermediate
• Technical Threat IntelligenceSpecific, machine-readable indicators such as malicious IPs, domains, URLs and file hashes.Intermediate
• Threat ActorAn individual or group that carries out or intends to carry out malicious activity against an organization's systems or data.Foundational
• Threat Actor MotivationThe underlying reason a threat actor attacks, such as financial gain, espionage, ideology, revenge, disruption or war.Foundational
• Threat FeedA continuous stream of threat data, typically indicators of compromise, delivered for integration into security tools.Foundational
• Threat HuntingProactively searching for threats that have evaded existing detections, based on hypotheses, intelligence or analytics.Intermediate
• Threat Intelligence LifecycleThe cyclical process for producing intelligence: requirements, collection, processing, analysis, dissemination and feedback.Intermediate
• Threat Intelligence Platform (TIP)A system that aggregates, normalizes, scores and distributes threat intelligence to security tools and teams.Intermediate
• Traffic Light Protocol (TLP)A scheme for marking how widely shared threat information may be disseminated.Intermediate
• Trusted Automated Exchange of Intelligence Information (TAXII)A protocol for exchanging cyber threat intelligence over HTTPS, designed to carry STIX data.Intermediate
• Watering Hole AttackAn attack that compromises a website frequently visited by a target group in order to infect those visitors.Intermediate
• Wiper MalwareDestructive malware designed to permanently erase or corrupt data and systems rather than extort payment.Intermediate
• YARAA pattern-matching tool and rule language for identifying and classifying malware based on textual or binary patterns.Intermediate