GIAC Certified Incident Handler (GCIH): key terms

Flashcards for this exam GIAC Certified Incident Handler (GCIH) guide

• Account Takeover (ATO)Unauthorized control of a legitimate user account, typically through stolen credentials or session tokens.Intermediate
• Advanced Persistent Threat (APT)A well-resourced, stealthy adversary that gains long-term access to a target to steal data or prepare for disruption.Intermediate
• Adversary-in-the-Middle Phishing (AiTM)Phishing that proxies a real login session to steal both credentials and session cookies, bypassing traditional MFA.Advanced
• Alert FatigueDesensitization of responders caused by too many, too noisy, or non-actionable alerts, leading to missed real incidents.Foundational
• Anti-ForensicsTechniques used to hinder forensic investigation by destroying, hiding or falsifying evidence.Intermediate
• Antimalware Scan Interface (AMSI)A Windows interface that lets antimalware products scan script content and in-memory buffers at runtime.Advanced
• ATT&CK TacticA column in the MITRE ATT&CK matrix representing the adversary's tactical goal, the "why" of an action.Intermediate
• ATT&CK TechniqueAn entry in MITRE ATT&CK describing how an adversary achieves a tactical goal, identified by a T number.Intermediate
• AuditdThe Linux Audit daemon that records system calls, file access and security-relevant events based on configured rules.Intermediate
• BackdoorA hidden method of bypassing normal authentication or security controls to access a system.Foundational
• BeaconingRegular, periodic outbound communication from a compromised host to attacker command-and-control infrastructure.Intermediate
• Behavioral DetectionDetecting threats by analyzing actions and sequences of activity rather than static signatures.Intermediate
• Business Email Compromise (BEC)A fraud in which attackers impersonate or take over business email accounts to trick staff into sending money or data.Intermediate
• Cobalt StrikeA commercial adversary simulation framework whose Beacon payload is widely abused by real attackers for command and control.Advanced
• Command and Control (C2)Infrastructure and channels attackers use to communicate with and control compromised systems.Intermediate
• ContainmentThe incident response phase that limits the spread and impact of an incident while preserving evidence.Foundational
• Credential DumpingExtracting account credentials such as password hashes or plaintext passwords from an operating system or software.Advanced
• Credential StuffingAutomated use of username-password pairs leaked from one breach to log in to other services.Intermediate
• Cyber Kill ChainLockheed Martin's seven-stage model of an intrusion from reconnaissance to actions on objectives.Foundational
• Cyber Threat Intelligence (CTI)Evidence-based knowledge about threats and threat actors that informs security decisions.Foundational
• Data ExfiltrationThe unauthorized transfer of data out of an organization to an attacker-controlled location.Intermediate
• DCSyncAn attack that impersonates a domain controller to request password hashes from Active Directory via replication.Advanced
• Detection and AnalysisThe incident response phase focused on identifying potential incidents, validating them and determining scope and impact.Foundational
• DetonationExecuting a suspicious file or opening a URL in a sandbox to trigger and observe any malicious behavior.Intermediate
• Diamond Model of Intrusion AnalysisAn analytic model describing every intrusion event by four core features: adversary, capability, infrastructure and victim.Intermediate
• DLL InjectionForcing a running process to load a malicious dynamic-link library.Advanced
• DLL Side-LoadingPlacing a malicious DLL alongside a legitimate signed application so the application loads it.Advanced
• DNS TunnelingEncoding data or command-and-control traffic inside DNS queries and responses to bypass network controls.Advanced
• Double ExtortionA ransomware tactic that both encrypts data and threatens to leak stolen copies unless a ransom is paid.Intermediate
• DropperMalware whose purpose is to install another malicious payload that it carries within itself.Intermediate
• Dwell TimeThe length of time an attacker remains undetected in an environment from initial compromise to detection.Intermediate
• Dynamic Malware AnalysisExecuting malware in a controlled environment to observe its behavior, network activity and system changes.Intermediate
• EmotetA modular malware family that evolved from a banking trojan into a major spam-distributed loader for other malware.Intermediate
• EradicationThe incident response phase that removes the threat, including malware, backdoors and compromised accounts, from the environment.Foundational
• Event ID 1102The Windows Security event recorded when the audit log is cleared.Intermediate
• Event ID 4624The Windows Security event recorded when an account successfully logs on.Intermediate
• Event ID 4625The Windows Security event recorded when an account fails to log on.Intermediate
• Event ID 4688The Windows Security event recorded when a new process is created, optionally including the full command line.Intermediate
• Event ID 7045The Windows System event recorded when a new service is installed.Advanced
• File HashA fixed-length value computed from file content by a hash function, used to identify files and verify integrity.Foundational
• Fileless MalwareMalware that runs in memory and abuses legitimate system tools instead of writing malicious executables to disk.Intermediate
• Golden TicketA forged Kerberos TGT created with the KRBTGT account hash, granting unrestricted domain access.Advanced
• Host IsolationDisconnecting an endpoint from the network except for the security management channel to contain a threat.Foundational
• Impossible TravelDetection that flags sign-ins from geographically distant locations within a time too short for real travel.Intermediate
• Incident Response (IR)The organized approach to preparing for, detecting, containing, eradicating and recovering from security incidents.Foundational
• Indicator of Attack (IoA)Evidence of attacker behavior or intent in progress, focusing on techniques rather than specific artifacts.Intermediate
• Indicator of Compromise (IoC)Forensic evidence that a system or network has likely been breached, such as malicious hashes, IPs, domains or registry keys.Foundational
• InfostealerMalware designed to harvest credentials, browser cookies, crypto wallets and other sensitive data from infected systems.Intermediate
• Initial AccessThe ATT&CK tactic (TA0001) covering techniques adversaries use to gain their first foothold in a network.Intermediate
• Initial Access Broker (IAB)A cybercriminal who compromises networks and sells that access to other criminals such as ransomware affiliates.Advanced
• KerberoastingRequesting Kerberos service tickets for accounts with SPNs and cracking them offline to recover service account passwords.Advanced
• Lateral MovementTechniques attackers use to move from one compromised system to others within a network.Intermediate
• Lessons LearnedA review conducted after an incident to identify what happened, what worked, what failed and how to improve.Foundational
• Living off the Land (LotL)An attacker technique of using tools already present on the target system to blend in and avoid detection.Intermediate
• Living Off the Land Binaries (LOLBins)Legitimate, signed operating system binaries that attackers abuse to download, execute or hide malicious activity.Advanced
• LoaderFirst-stage malware that downloads or decrypts and executes additional payloads on a compromised system.Advanced
• Log TamperingModifying, deleting or disabling logs to hide malicious activity.Intermediate
• Magic NumberA fixed sequence of bytes at the start of a file that identifies its true format regardless of extension.Intermediate
• Malware SandboxAn isolated, instrumented environment where suspicious files or URLs are executed safely to observe behavior.Intermediate
• Mark of the Web (MotW)A Zone.Identifier alternate data stream Windows adds to downloaded files to mark them as originating from the internet.Advanced
• Memory ForensicsAnalysis of volatile memory captures to find running processes, network connections, injected code and other evidence.Intermediate
• Memory InjectionInserting malicious code into the memory space of a running process to execute it under that process's context.Advanced
• MFA Fatigue AttackRepeatedly sending MFA push requests to a user with stolen credentials until they approve one.Intermediate
• MimikatzA post-exploitation tool that extracts plaintext passwords, hashes, Kerberos tickets and other credentials from Windows memory.Advanced
• Missing LogsAn indicator of compromise where expected log data is absent, suggesting tampering or deliberate clearing.Intermediate
• MITRE ATT&CKA globally accessible knowledge base of adversary tactics, techniques and procedures based on real-world observations.Foundational
• NIST SP 800-61The NIST publication providing guidance on computer security incident handling and response.Intermediate
• ObfuscationMaking data or code difficult to understand without changing its function, to hinder analysis.Foundational
• Pass-the-Hash (PtH)Authenticating to a remote system using a captured NTLM password hash instead of the plaintext password.Advanced
• Pass-the-Ticket (PtT)Using a stolen Kerberos ticket to authenticate to services without knowing the user's password.Advanced
• Password SprayingTrying a few common passwords against many accounts to avoid lockout thresholds.Intermediate
• PersistenceTechniques attackers use to maintain access to a system across reboots, credential changes and other interruptions.Intermediate
• Polymorphic MalwareMalware that changes its code appearance with each infection, often through encryption, to evade signature detection.Intermediate
• PowerShell Script Block LoggingA Windows feature that records the content of PowerShell script blocks as they execute, including deobfuscated code.Intermediate
• PreparationThe incident response phase in which an organization establishes capabilities, tools, plans and training before incidents occur.Foundational
• Privilege EscalationGaining higher-level permissions than originally granted, such as moving from a standard user to administrator or root.Intermediate
• Process Creation LoggingRecording every new process with its command line, parent and user to support detection and investigation.Intermediate
• Process InjectionAn ATT&CK technique (T1055) in which malware executes code within the address space of another process.Advanced
• Pyramid of PainA model by David Bianco ranking indicator types by how much pain denying them causes the adversary.Intermediate
• Ransomware-as-a-Service (RaaS)A criminal business model in which ransomware developers lease their malware and infrastructure to affiliates for a share of ransoms.Intermediate
• RecoveryThe incident response phase that restores systems and operations to normal and verifies they are functioning securely.Foundational
• Registry Run KeysWindows registry locations that automatically launch programs at user logon or system boot.Intermediate
• Remote Access Trojan (RAT)A trojan that gives an attacker covert remote administrative control over an infected system.Foundational
• RootkitMalware that hides its presence and other malicious activity by subverting the operating system at a deep level.Intermediate
• Sandbox EvasionTechniques malware uses to detect analysis environments and alter or delay its behavior to avoid detection.Advanced
• SANS PICERLThe SANS six-step incident response model: Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned.Intermediate
• Scheduled TaskA Windows mechanism for running programs at specified times or events, frequently abused for persistence and execution.Intermediate
• ScopingDetermining which controls or requirements apply to a system, process, or assessment.Intermediate
• Session HijackingTaking over a valid user session by stealing or predicting its session identifier or token.Intermediate
• Silver TicketA forged Kerberos service ticket created with a service account's hash to access a specific service.Advanced
• Stack CountingA hunting technique that counts occurrences of values across many hosts to find rare outliers.Advanced
• Static Malware AnalysisExamining a malware sample without executing it, using file properties, strings, headers and disassembly.Intermediate
• SUNBURSTThe backdoor inserted into SolarWinds Orion software updates in a 2020 supply chain attack.Advanced
• Supply Chain AttackAn attack that compromises a trusted vendor, software component or service provider to reach its downstream customers.Intermediate
• SysmonSystem Monitor, a free Microsoft Sysinternals tool that logs detailed process, network, file and registry activity to the Windows event log.Intermediate
• Tactics, Techniques and Procedures (TTP)The patterns of adversary behavior: tactics are goals, techniques are methods and procedures are specific implementations.Intermediate
• Threat HuntingProactively searching for threats that have evaded existing detections, based on hypotheses, intelligence or analytics.Intermediate
• TriageRapidly assessing alerts or incidents to determine validity, severity and priority for response.Foundational
• VirusTotalA Google-owned online service that scans files, URLs, domains and IPs with many antivirus engines and reputation tools.Foundational
• VolatilityAn open-source framework for extracting digital artifacts from memory images.Advanced
• Web ShellA malicious script uploaded to a web server that gives an attacker remote command execution through HTTP.Intermediate
• Windows Event Forwarding (WEF)A built-in Windows feature that forwards event logs from many hosts to a central Windows Event Collector.Advanced
• Windows Event LogThe structured logging system in Windows that records security, system and application events.Foundational
• Wiper MalwareDestructive malware designed to permanently erase or corrupt data and systems rather than extort payment.Intermediate
• YARAA pattern-matching tool and rule language for identifying and classifying malware based on textual or binary patterns.Intermediate