Security Operations terms

Study this subject with thinQcards™

• 3-2-1 Backup RuleA backup guideline: keep three copies of data on two different media types with one copy offsite.Foundational
• Account Takeover (ATO)Unauthorized control of a legitimate user account, typically through stolen credentials or session tokens.Intermediate
• AdmissibilityWhether evidence meets legal standards to be accepted in court, such as relevance, reliability and proper handling.Intermediate
• Advanced Persistent Threat (APT)A well-resourced, stealthy adversary that gains long-term access to a target to steal data or prepare for disruption.Intermediate
• Adversary EmulationTesting defenses by replicating the specific TTPs of a known threat actor.Advanced
• Adversary-in-the-Middle Phishing (AiTM)Phishing that proxies a real login session to steal both credentials and session cookies, bypassing traditional MFA.Advanced
• AdwareSoftware that displays unwanted advertisements, often bundled with free applications.Foundational
• After-Action Report (AAR)A formal document summarizing an incident or exercise, its timeline, outcomes and recommendations.Intermediate
• Agent-Based ScanningVulnerability assessment using software agents installed on endpoints that report findings to a central console.Intermediate
• Alternate Data Stream (ADS)An NTFS feature allowing additional data streams to be attached to a file, which can hide data or malicious code.Advanced
• AmcacheA Windows registry hive (Amcache.hve) that records information about executables present or run on the system, including SHA-1 hashes.Advanced
• Amplification AttackA DDoS technique that sends small spoofed requests to services that return much larger responses to the victim.Intermediate
• Anomaly-Based DetectionDetecting threats by identifying deviations from an established baseline of normal behavior.Foundational
• Anti-ForensicsTechniques used to hinder forensic investigation by destroying, hiding or falsifying evidence.Intermediate
• Antimalware Scan Interface (AMSI)A Windows interface that lets antimalware products scan script content and in-memory buffers at runtime.Advanced
• ARP PoisoningSending forged ARP replies to associate the attacker's MAC address with another host's IP, redirecting LAN traffic.Intermediate
• Asset CriticalityA rating of how important an asset is to the business, used to prioritize protection and response.Foundational
• Asset InventoryA complete, current record of hardware, software, cloud resources and data assets an organization owns or uses.Foundational
• Atomic Red TeamAn open-source library by Red Canary of small, ATT&CK-mapped tests that simulate individual adversary techniques.Advanced
• ATT&CK NavigatorA MITRE web tool for visualizing and annotating ATT&CK matrices as layers.Advanced
• ATT&CK TacticA column in the MITRE ATT&CK matrix representing the adversary's tactical goal, the "why" of an action.Intermediate
• ATT&CK TechniqueAn entry in MITRE ATT&CK describing how an adversary achieves a tactical goal, identified by a T number.Intermediate
• Attack Surface Management (ASM)Continuous discovery, inventory and monitoring of an organization's internet-facing assets and exposures.Intermediate
• AttributionIdentifying the threat actor responsible for an attack based on technical evidence, TTPs and intelligence.Advanced
• AuditdThe Linux Audit daemon that records system calls, file access and security-relevant events based on configured rules.Intermediate
• AutopsyAn open-source digital forensics platform and graphical interface for The Sleuth Kit.Intermediate
• BackdoorA hidden method of bypassing normal authentication or security controls to access a system.Foundational
• Backup TypesThe main backup methods: full, incremental and differential, plus snapshots and synthetic full backups.Foundational
• BaitingA social engineering attack that leaves an enticing item, such as an infected USB drive, for a victim to use.Foundational
• Banking TrojanA trojan designed to steal online banking credentials and manipulate financial transactions.Intermediate
• BaselineA documented reference of normal system, network or user behavior used to identify anomalies.Foundational
• BeaconingRegular, periodic outbound communication from a compromised host to attacker command-and-control infrastructure.Intermediate
• Behavioral DetectionDetecting threats by analyzing actions and sequences of activity rather than static signatures.Intermediate
• Behavioral Indicator of Compromise (BIOC)A Cortex XDR rule that detects malicious behavior based on endpoint activity patterns rather than static indicators.Advanced
• BloatwareUnnecessary software preinstalled by a manufacturer that consumes resources and expands the attack surface.Foundational
• Blue TeamThe defensive security team responsible for detecting, responding to and preventing attacks.Foundational
• BluesnarfingUnauthorized access to data on a Bluetooth-enabled device, such as contacts, messages or files.Foundational
• BootkitA rootkit that infects the boot process, such as the MBR, VBR or UEFI firmware, to load before the operating system.Advanced
• BotnetA network of compromised devices remotely controlled by an attacker to perform coordinated tasks.Foundational
• Brand ImpersonationMimicking a trusted company's name, logo and communications to deceive victims.Foundational
• Brute Force AttackSystematically trying all possible passwords or keys until the correct one is found.Foundational
• Buffer OverflowWriting more data into a memory buffer than it can hold, overwriting adjacent memory and potentially enabling code execution.Intermediate
• Business Continuity Planning (BCP)Planning to keep essential business functions operating during and after a disruption.Foundational
• Business Email Compromise (BEC)A fraud in which attackers impersonate or take over business email accounts to trick staff into sending money or data.Intermediate
• Business Impact Analysis (BIA)An analysis that identifies critical business functions and the impact of their disruption over time.Foundational
• Causality ChainIn Cortex XDR, the sequence of related processes and events from the root cause to the alert, shown in the Causality View.Advanced
• Chain of CustodyDocumentation that records every person who handled evidence, when, why and how, from collection to presentation.Foundational
• Cloud ForensicsForensic investigation of incidents in cloud environments, relying on provider logs, snapshots and APIs.Advanced
• Cobalt StrikeA commercial adversary simulation framework whose Beacon payload is widely abused by real attackers for command and control.Advanced
• Cold SiteAn alternate facility with basic infrastructure such as power and space but no ready equipment or data.Foundational
• Command and Control (C2)Infrastructure and channels attackers use to communicate with and control compromised systems.Intermediate
• Command InjectionInjecting operating system commands through an application input that is passed to a system shell.Intermediate
• Common Event Format (CEF)A standardized text-based log format developed by ArcSight for interoperable security event reporting.Advanced
• Common Information Model (CIM)Splunk's shared semantic model that normalizes field names across data sources into standard data models.Intermediate
• Communication PlanThe part of the IR plan defining who is notified, how, when and by whom during an incident.Foundational
• Concurrent Session UsageAn indicator where the same account has simultaneous active sessions from different devices or locations.Foundational
• Confidence LevelAn assessment of how reliable an intelligence finding or indicator is, based on source reliability and corroboration.Intermediate
• ContainmentThe incident response phase that limits the spread and impact of an incident while preserving evidence.Foundational
• Continuity of Operations Planning (COOP)A US federal government term for planning that ensures essential functions continue during a wide range of emergencies.Intermediate
• Correlation RuleSIEM logic that combines multiple events, possibly across sources and time, to identify suspicious patterns.Intermediate
• Cortex Query Language (XQL)The query language used to search and analyze data in Cortex XDR and Cortex XSIAM datasets.Advanced
• Cortex XDRPalo Alto Networks' extended detection and response platform combining endpoint protection with network, cloud and identity analytics.Intermediate
• Cortex XDR AgentThe Palo Alto Networks endpoint agent that provides prevention, detection and response capabilities for Cortex XDR.Advanced
• Cortex XSIAMPalo Alto Networks' AI-driven security operations platform that combines SIEM, XDR, SOAR, ASM and threat intelligence.Advanced
• Cortex XSOARPalo Alto Networks' security orchestration, automation and response platform with case management and threat intelligence management.Advanced
• Credential DumpingExtracting account credentials such as password hashes or plaintext passwords from an operating system or software.Advanced
• Credential HarvestingCollecting usernames and passwords from victims, usually through fake login pages or malware.Foundational
• Credential StuffingAutomated use of username-password pairs leaked from one breach to log in to other services.Intermediate
• Credentialed ScanA vulnerability scan that logs in to targets with valid credentials to assess installed software and configurations accurately.Foundational
• Cross-Site Request Forgery (CSRF)An attack that tricks an authenticated user's browser into sending unwanted requests to a site where they are logged in.Intermediate
• Cross-Site Scripting (XSS)An attack that injects malicious script into web pages viewed by other users, executing in their browsers.Foundational
• CrowdStrike FalconCrowdStrike's cloud-native endpoint and XDR platform delivered through a single lightweight sensor.Intermediate
• CryptojackingUnauthorized use of a victim's computing resources to mine cryptocurrency.Foundational
• CVSS Base MetricsCVSS metrics describing a vulnerability's intrinsic exploitability and impact characteristics.Intermediate
• CVSS Environmental MetricsCVSS metrics that adjust a score for a specific organization's environment and security requirements.Advanced
• CVSS v4.0The 2023 version of CVSS that adds Attack Requirements, splits impact into vulnerable and subsequent systems and renames Temporal to Threat metrics.Advanced
• Cyber Threat Intelligence (CTI)Evidence-based knowledge about threats and threat actors that informs security decisions.Foundational
• Dark Web MonitoringWatching underground forums, marketplaces and leak sites for stolen data, credentials or threats targeting an organization.Intermediate
• Data BreachA security incident resulting in confirmed unauthorized access to or disclosure of sensitive data.Foundational
• Data Breach NotificationLegal or contractual obligations to inform regulators, affected individuals or partners after a qualifying data breach.Intermediate
• Data EnrichmentAdding context, such as threat intelligence, asset criticality, user identity or geolocation, to events and alerts.Intermediate
• Data ExfiltrationThe unauthorized transfer of data out of an organization to an attacker-controlled location.Intermediate
• DCSyncAn attack that impersonates a domain controller to request password hashes from Active Directory via replication.Advanced
• ddA Unix command-line utility used to create raw bit-for-bit copies of disks and partitions.Intermediate
• Deauthentication AttackA wireless attack that sends forged 802.11 deauthentication frames to disconnect clients from an access point.Intermediate
• Deception TechnologySecurity tools that deploy decoys, lures and fake credentials throughout an environment to detect attackers.Intermediate
• DeepfakeSynthetic audio, video or images generated with AI to convincingly impersonate a real person.Intermediate
• Denial of Service (DoS)An attack that makes a system or network unavailable to legitimate users by exhausting resources or crashing services.Foundational
• Detection and AnalysisThe incident response phase focused on identifying potential incidents, validating them and determining scope and impact.Foundational
• Detection EngineeringThe discipline of designing, building, testing and maintaining threat detections as code.Advanced
• DetonationExecuting a suspicious file or opening a URL in a sandbox to trigger and observe any malicious behavior.Intermediate
• Diamond Model of Intrusion AnalysisAn analytic model describing every intrusion event by four core features: adversary, capability, infrastructure and victim.Intermediate
• Dictionary AttackA password attack that tries words from a list of common passwords and dictionary terms.Foundational
• Digital ForensicsThe scientific collection, preservation, analysis and presentation of digital evidence in a legally defensible manner.Foundational
• Directory TraversalAn attack that manipulates file paths with sequences like ../ to access files outside the intended directory.Foundational
• Disaster Recovery Plan (DRP)A documented plan for restoring IT systems, data and infrastructure after a disruptive event.Foundational
• DisinformationDeliberately false or misleading information spread to deceive, often as part of an influence campaign.Foundational
• Distributed Denial of Service (DDoS)A denial-of-service attack launched from many sources, often a botnet, to overwhelm a target.Foundational
• DLL InjectionForcing a running process to load a malicious dynamic-link library.Advanced
• DLL Side-LoadingPlacing a malicious DLL alongside a legitimate signed application so the application loads it.Advanced
• DNS AmplificationA reflected DDoS attack that abuses open DNS resolvers to send large responses to a spoofed victim address.Intermediate
• DNS Cache PoisoningInserting false records into a DNS resolver's cache so users are directed to malicious IP addresses.Intermediate
• DNS SinkholeA DNS server configuration that returns a controlled IP for known malicious domains to block and identify infected hosts.Intermediate
• DNS TunnelingEncoding data or command-and-control traffic inside DNS queries and responses to bypass network controls.Advanced
• Domain Generation Algorithm (DGA)An algorithm in malware that generates many pseudo-random domain names to locate its command-and-control servers.Advanced
• Domain HijackingTaking unauthorized control of a domain registration, often by compromising the registrar account.Intermediate
• Double ExtortionA ransomware tactic that both encrypts data and threatens to leak stolen copies unless a ransom is paid.Intermediate
• Downgrade AttackForcing a system to use an older, weaker protocol or cipher version that the attacker can exploit.Intermediate
• Drive-by DownloadAn unintended download of malicious code that occurs simply by visiting a compromised or malicious website.Foundational
• DropperMalware whose purpose is to install another malicious payload that it carries within itself.Intermediate
• Dumpster DivingSearching trash for discarded information or media that can aid an attack.Foundational
• Dwell TimeThe length of time an attacker remains undetected in an environment from initial compromise to detection.Intermediate
• Dynamic Malware AnalysisExecuting malware in a controlled environment to observe its behavior, network activity and system changes.Intermediate
• E-DiscoveryThe process of identifying, preserving, collecting, reviewing and producing electronically stored information for legal proceedings.Intermediate
• EmotetA modular malware family that evolved from a banking trojan into a major spam-distributed loader for other malware.Intermediate
• Endpoint Detection and Response (EDR)Security software that continuously records endpoint activity, detects malicious behavior and enables investigation and response.Foundational
• Endpoint Protection Platform (EPP)An endpoint security solution focused on preventing threats with antimalware, firewall, device control and exploit prevention.Foundational
• EradicationThe incident response phase that removes the threat, including malware, backdoors and compromised accounts, from the environment.Foundational
• EscalationTransferring an alert or incident to a higher tier, specialist team or management according to defined criteria.Foundational
• Event ID 1102The Windows Security event recorded when the audit log is cleared.Intermediate
• Event ID 4624The Windows Security event recorded when an account successfully logs on.Intermediate
• Event ID 4625The Windows Security event recorded when an account fails to log on.Intermediate
• Event ID 4688The Windows Security event recorded when a new process is created, optionally including the full command line.Intermediate
• Event ID 7045The Windows System event recorded when a new service is installed.Advanced
• Evidence IntegrityAssurance that evidence has not been altered since collection, typically demonstrated by cryptographic hashes.Foundational
• Evil TwinA malicious wireless access point that impersonates a legitimate SSID to lure clients into connecting.Foundational
• ExploitCode or a technique that takes advantage of a vulnerability to cause unintended behavior, such as code execution.Foundational
• Exploit KitA toolkit hosted on malicious or compromised websites that automatically probes visitors' browsers for vulnerabilities and delivers malware.Intermediate
• Extended Detection and Response (XDR)A security platform that correlates telemetry across endpoints, network, cloud, identity and email for unified detection and response.Intermediate
• FailoverAutomatic or manual switching to a redundant or standby system when the primary fails.Foundational
• False Negative (FN)A failure to alert on activity that is actually malicious.Foundational
• False Positive (FP)An alert that flags benign activity as malicious.Foundational
• Fast FluxA DNS technique that rapidly changes the IP addresses associated with a domain to hide malicious infrastructure.Advanced
• Field ExtractionThe process of identifying and pulling named fields out of raw event data, at index time or search time.Intermediate
• File CarvingRecovering files from raw data based on content signatures such as headers and footers, without file system metadata.Intermediate
• File HashA fixed-length value computed from file content by a hash function, used to identify files and verify integrity.Foundational
• Fileless MalwareMalware that runs in memory and abuses legitimate system tools instead of writing malicious executables to disk.Intermediate
• Forensic ImageA bit-for-bit copy of a storage device, including unallocated space and slack, used for analysis instead of the original.Foundational
• Forensic ReportA formal document presenting the methods, findings and conclusions of a forensic investigation.Intermediate
• FTK ImagerA free Exterro (formerly AccessData) tool for creating forensic images and capturing memory on Windows.Intermediate
• Full Interruption TestA disaster recovery test that shuts down the primary site and moves operations completely to the recovery site.Intermediate
• Full Packet Capture (FPC)Recording complete network packets, including payloads, for detailed analysis and forensics.Intermediate
• Golden TicketA forged Kerberos TGT created with the KRBTGT account hash, granting unrestricted domain access.Advanced
• Google Security OperationsGoogle Cloud's security operations platform, formerly Chronicle, combining SIEM, SOAR and threat intelligence.Advanced
• HacktivistA threat actor who attacks to promote a political, social or ideological cause rather than for profit.Foundational
• HoneyfileA decoy file, often with an enticing name, that triggers an alert when accessed.Foundational
• HoneynetA network of honeypots that simulates a realistic environment to observe attacker behavior.Foundational
• HoneypotA decoy system designed to attract attackers, detect intrusion attempts and study their techniques.Foundational
• HoneytokenA fake credential, record or data item planted to detect unauthorized access or use.Intermediate
• Host IsolationDisconnecting an endpoint from the network except for the security management channel to contain a threat.Foundational
• Hot SiteA fully equipped alternate facility with current systems and data that can take over operations almost immediately.Foundational
• Hypothesis-Driven HuntingA threat hunting approach that starts with a testable hypothesis about adversary behavior in the environment.Advanced
• Immutable BackupA backup that cannot be modified or deleted for a defined retention period, even by administrators.Intermediate
• ImpersonationPretending to be another person or role, such as an executive, technician or vendor, to gain trust or access.Foundational
• Incident Response (IR)The organized approach to preparing for, detecting, containing, eradicating and recovering from security incidents.Foundational
• Incident Response Plan (IRP)A documented set of policies, roles and procedures guiding how an organization responds to security incidents.Foundational
• Incident Response Team (CSIRT)The group responsible for handling security incidents, also called a computer security incident response team.Foundational
• Incident SeverityA classification of an incident's urgency and impact used to prioritize response and escalation.Foundational
• Indicator of Attack (IoA)Evidence of attacker behavior or intent in progress, focusing on techniques rather than specific artifacts.Intermediate
• Indicator of Compromise (IoC)Forensic evidence that a system or network has likely been breached, such as malicious hashes, IPs, domains or registry keys.Foundational
• Information Sharing and Analysis Center (ISAC)A sector-based organization that facilitates sharing of threat information among member companies.Foundational
• InfostealerMalware designed to harvest credentials, browser cookies, crypto wallets and other sensitive data from infected systems.Intermediate
• Initial AccessThe ATT&CK tactic (TA0001) covering techniques adversaries use to gain their first foothold in a network.Intermediate
• Initial Access Broker (IAB)A cybercriminal who compromises networks and sells that access to other criminals such as ransomware affiliates.Advanced
• inputs.confA Splunk configuration file that defines what data a Splunk instance collects and how it is labeled.Advanced
• Insider ThreatA risk posed by a current or former employee, contractor or partner who misuses authorized access, maliciously or by accident.Foundational
• IP SpoofingForging the source IP address of packets to hide the sender's identity or impersonate another system.Intermediate
• Jump BagA pre-assembled kit of tools, media and documentation that incident responders can grab immediately.Intermediate
• KerberoastingRequesting Kerberos service tickets for accounts with SPNs and cracking them offline to recover service account passwords.Advanced
• KeyloggerSoftware or hardware that records keystrokes to capture passwords and other sensitive input.Foundational
• Kroll Artifact Parser and Extractor (KAPE)A free triage tool that collects and parses forensic artifacts from Windows systems using targets and modules.Advanced
• Lateral MovementTechniques attackers use to move from one compromised system to others within a network.Intermediate
• Legal HoldA directive to preserve all potentially relevant information when litigation or investigation is reasonably anticipated.Foundational
• Lessons LearnedA review conducted after an incident to identify what happened, what worked, what failed and how to improve.Foundational
• Live AcquisitionCollecting evidence from a running system, capturing volatile data before it is lost.Intermediate
• Living off the Land (LotL)An attacker technique of using tools already present on the target system to blend in and avoid detection.Intermediate
• Living Off the Land Binaries (LOLBins)Legitimate, signed operating system binaries that attackers abuse to download, execute or hide malicious activity.Advanced
• LoaderFirst-stage malware that downloads or decrypts and executes additional payloads on a compromised system.Advanced
• Log NormalizationConverting logs from different formats into a common schema so they can be correlated and searched consistently.Intermediate
• Log RetentionPolicy defining how long logs are stored, balancing investigation needs, compliance requirements and cost.Intermediate
• Log TamperingModifying, deleting or disabling logs to hide malicious activity.Intermediate
• Logic BombMalicious code that lies dormant until a specific condition, such as a date or event, triggers its payload.Foundational
• LookupA Splunk knowledge object that enriches events by matching field values against an external table or source.Intermediate
• MAC FloodingOverwhelming a switch's MAC address table with fake entries so it floods frames to all ports like a hub.Intermediate
• MAC Times (MACB)File system timestamps recording when a file was Modified, Accessed, Changed (metadata) and Born (created).Advanced
• Macro VirusA virus written in a macro language, such as VBA, embedded in documents and executed when the document is opened.Foundational
• Magic NumberA fixed sequence of bytes at the start of a file that identifies its true format regardless of extension.Intermediate
• MalvertisingThe use of online advertising to deliver malware or redirect users to malicious sites.Intermediate
• MalwareMalicious software designed to damage, disrupt, spy on or gain unauthorized access to systems or data.Foundational
• Malware SandboxAn isolated, instrumented environment where suspicious files or URLs are executed safely to observe behavior.Intermediate
• Man-in-the-Browser (MitB)An attack in which malware inside the browser intercepts and modifies web content and transactions.Intermediate
• Managed Detection and Response (MDR)An outsourced service providing 24x7 threat detection, investigation and active response using the provider's tools and analysts.Intermediate
• Managed Security Service Provider (MSSP)A third party that delivers outsourced security monitoring and management services.Foundational
• Mark of the Web (MotW)A Zone.Identifier alternate data stream Windows adds to downloaded files to mark them as originating from the internet.Advanced
• Master File Table (MFT)The NTFS metadata file that holds a record for every file and directory on the volume.Advanced
• Maximum Tolerable Downtime (MTD)The longest period a business function can be unavailable before causing unacceptable or irrecoverable harm.Intermediate
• Mean Time Between Failures (MTBF)The average operating time between failures of a repairable system, a measure of reliability.Foundational
• Mean Time to Detect (MTTD)The average time between when an incident begins and when it is detected.Foundational
• Mean Time to Repair (MTTR)The average time required to repair a failed component or system and return it to service.Foundational
• Mean Time to Respond (MTTR)The average time between detecting an incident and containing or resolving it.Foundational
• Memory ForensicsAnalysis of volatile memory captures to find running processes, network connections, injected code and other evidence.Intermediate
• Memory InjectionInserting malicious code into the memory space of a running process to execute it under that process's context.Advanced
• Metamorphic MalwareMalware that rewrites its own code on each propagation so no two copies share the same instructions.Advanced
• MFA Fatigue AttackRepeatedly sending MFA push requests to a user with stolen credentials until they approve one.Intermediate
• Microsoft Defender XDRMicrosoft's extended detection and response suite, formerly Microsoft 365 Defender, unifying endpoint, identity, email and cloud app protection.Intermediate
• Microsoft SentinelMicrosoft's cloud-native SIEM and SOAR solution built on Azure Log Analytics.Intermediate
• MimikatzA post-exploitation tool that extracts plaintext passwords, hashes, Kerberos tickets and other credentials from Windows memory.Advanced
• MiraiAn IoT botnet malware family that spreads by logging in to devices with default credentials and launches massive DDoS attacks.Intermediate
• MISPAn open-source threat intelligence sharing platform originally called the Malware Information Sharing Platform.Advanced
• Missing LogsAn indicator of compromise where expected log data is absent, suggesting tampering or deliberate clearing.Intermediate
• Mission-Essential Function (MEF)A business function that must continue or be quickly restored for the organization to fulfill its mission.Foundational
• MITRE D3FENDA MITRE knowledge graph of defensive cybersecurity countermeasures mapped to offensive techniques.Advanced
• Mobile Device ForensicsAcquiring and analyzing data from smartphones and tablets, such as messages, location history and app data.Intermediate
• Nation-State ActorA threat actor sponsored or directed by a government, with high sophistication, funding and strategic goals.Foundational
• National Vulnerability Database (NVD)The US government repository, maintained by NIST, that enriches CVE records with CVSS scores, CWE and CPE data.Foundational
• NessusA widely used commercial vulnerability scanner from Tenable that uses plugins to detect vulnerabilities and misconfigurations.Foundational
• Network Detection and Response (NDR)A solution that analyzes network traffic to detect threats and enable response, often using behavioral analytics.Intermediate
• Network ForensicsCapturing and analyzing network traffic and logs to investigate security incidents.Intermediate
• Network Traffic Analysis (NTA)Monitoring and analyzing network traffic to detect anomalies, threats and performance issues.Intermediate
• Next-Generation Antivirus (NGAV)Endpoint antimalware that uses machine learning, behavioral analysis and exploit prevention instead of relying solely on signatures.Foundational
• NIST Cybersecurity Framework (CSF)A NIST framework of cybersecurity outcomes organized into six functions: Govern, Identify, Protect, Detect, Respond and Recover.Foundational
• NIST SP 800-61The NIST publication providing guidance on computer security incident handling and response.Intermediate
• Non-Credentialed ScanA vulnerability scan performed without logging in, seeing only what is exposed over the network.Foundational
• Notable EventAn event generated by a Splunk Enterprise Security correlation search that requires analyst review.Intermediate
• NotPetyaA 2017 destructive wiper disguised as ransomware that spread from a compromised Ukrainian accounting software update.Intermediate
• On-Path AttackAn attack in which the adversary positions themselves between two communicating parties to intercept or alter traffic.Foundational
• Open Cybersecurity Schema Framework (OCSF)An open, vendor-neutral schema for normalizing security event data across tools.Advanced
• Operational Threat IntelligenceIntelligence about specific impending attacks or campaigns, including actor intent, timing and capability.Intermediate
• Order of VolatilityThe sequence for collecting evidence from most to least volatile so short-lived data is not lost.Foundational
• Organized Crime GroupA structured criminal enterprise that conducts cyberattacks primarily for financial gain.Foundational
• Out-of-Band CommunicationCommunication through channels separate from potentially compromised production systems during an incident.Intermediate
• Out-of-Cycle LoggingLog entries generated at unusual times or outside expected patterns, indicating possible malicious activity.Foundational
• Parallel TestA disaster recovery test in which recovery systems are brought up at the alternate site and run alongside production without interrupting it.Intermediate
• ParsingExtracting structured fields from raw log data so events can be searched and correlated.Intermediate
• Pass-the-Hash (PtH)Authenticating to a remote system using a captured NTLM password hash instead of the plaintext password.Advanced
• Pass-the-Ticket (PtT)Using a stolen Kerberos ticket to authenticate to services without knowing the user's password.Advanced
• Password SprayingTrying a few common passwords against many accounts to avoid lockout thresholds.Intermediate
• Patch ManagementThe process of acquiring, testing, deploying and verifying software updates to fix vulnerabilities and defects.Foundational
• PersistenceTechniques attackers use to maintain access to a system across reboots, credential changes and other interruptions.Intermediate
• PharmingRedirecting users from a legitimate website to a fraudulent one by manipulating DNS or host files.Intermediate
• PhishingA social engineering attack using fraudulent messages, typically email, to steal credentials, deliver malware or induce payments.Foundational
• PiggybackingEntering a secure area with the consent of an authorized person who lets the intruder in.Foundational
• PlaybookA documented or automated set of steps for responding to a specific type of security incident or alert.Foundational
• Polymorphic MalwareMalware that changes its code appearance with each infection, often through encryption, to evade signature detection.Intermediate
• Post-Incident ActivityThe final incident response phase covering lessons learned, reporting, evidence retention and process improvement.Foundational
• Potentially Unwanted Program (PUP)Software that is not clearly malicious but is unwanted, often installed through bundling, such as toolbars or adware.Foundational
• PowerShell Script Block LoggingA Windows feature that records the content of PowerShell script blocks as they execute, including deobfuscated code.Intermediate
• PrecursorA sign that an incident may occur in the future.Intermediate
• PrefetchWindows files that record application execution details to speed up program loading, valuable as evidence of execution.Advanced
• PreparationThe incident response phase in which an organization establishes capabilities, tools, plans and training before incidents occur.Foundational
• Priority Intelligence Requirement (PIR)A high-priority question that stakeholders need intelligence to answer, guiding collection and analysis.Advanced
• Privilege EscalationGaining higher-level permissions than originally granted, such as moving from a standard user to administrator or root.Intermediate
• Process Creation LoggingRecording every new process with its command line, parent and user to support detection and investigation.Intermediate
• Process InjectionAn ATT&CK technique (T1055) in which malware executes code within the address space of another process.Advanced
• props.confA Splunk configuration file that defines parsing and search-time behavior for sourcetypes, sources or hosts.Advanced
• Purple TeamA collaborative approach in which red and blue teams work together to improve detections in real time.Intermediate
• Pyramid of PainA model by David Bianco ranking indicator types by how much pain denying them causes the adversary.Intermediate
• Quid Pro QuoA social engineering attack that offers a service or benefit in exchange for information or access.Foundational
• QuishingPhishing that uses QR codes to direct victims to malicious websites.Intermediate
• Race ConditionA flaw where the outcome depends on the timing of events, allowing attackers to exploit the gap between operations.Advanced
• Rainbow TableA precomputed table of hash values used to rapidly reverse unsalted password hashes.Intermediate
• RansomwareMalware that encrypts or locks a victim's data or systems and demands payment for restoration.Foundational
• Ransomware-as-a-Service (RaaS)A criminal business model in which ransomware developers lease their malware and infrastructure to affiliates for a share of ransoms.Intermediate
• RecoveryThe incident response phase that restores systems and operations to normal and verifies they are functioning securely.Foundational
• Red TeamA group that emulates real adversaries to test an organization's detection and response capabilities.Foundational
• Registry Run KeysWindows registry locations that automatically launch programs at user logon or system boot.Intermediate
• ReimagingRestoring a system from a known-good image to remove compromise rather than attempting to clean it.Foundational
• Remote Access Trojan (RAT)A trojan that gives an attacker covert remote administrative control over an infected system.Foundational
• Replay AttackCapturing valid data transmissions, such as authentication tokens, and retransmitting them to gain unauthorized access.Intermediate
• ReplicationCopying data continuously or frequently to another system or location to support availability and low RPO.Intermediate
• Resource ConsumptionAn indicator of malicious activity shown by unusual CPU, memory, disk, or bandwidth usage.Foundational
• Reverse EngineeringAnalyzing software to understand its design and behavior, typically by disassembling or decompiling compiled code.Advanced
• Risk-Based Alerting (RBA)A detection approach that assigns risk scores to entities for suspicious observations and alerts only when cumulative risk exceeds a threshold.Advanced
• Rogue Access PointAn unauthorized wireless access point connected to a network, bypassing perimeter security.Foundational
• RootkitMalware that hides its presence and other malicious activity by subverting the operating system at a deep level.Intermediate
• Sandbox EvasionTechniques malware uses to detect analysis environments and alter or delay its behavior to avoid detection.Advanced
• SANS PICERLThe SANS six-step incident response model: Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned.Intermediate
• ScarewareSoftware or pop-ups that use fear of infection to trick users into buying fake security products or installing malware.Foundational
• Scheduled TaskA Windows mechanism for running programs at specified times or events, frequently abused for persistence and execution.Intermediate
• Security Awareness Training (SAT)Education that teaches staff to recognize and report security threats such as phishing and social engineering.Foundational
• Security BenchmarkA consensus-based configuration standard specifying secure settings for systems and applications.Intermediate
• Security Content Automation Protocol (SCAP)A NIST suite of specifications for automating vulnerability management, measurement and compliance checking.Advanced
• Security Data LakeA centralized repository that stores large volumes of raw and normalized security telemetry for analytics and long-term retention.Advanced
• Security EventAny observable occurrence in a system or network that may have security relevance.Foundational
• Security IncidentAn occurrence that actually or potentially jeopardizes the confidentiality, integrity or availability of information or systems, or violates security policy.Foundational
• Security Information and Event Management (SIEM)A platform that collects, normalizes, correlates and analyzes log data from across an environment to detect and investigate threats.Foundational
• Security Operations Center (SOC)A centralized team and facility that monitors, detects, analyzes and responds to cybersecurity incidents around the clock.Foundational
• Security Orchestration, Automation and Response (SOAR)A platform that integrates security tools and automates investigation and response workflows using playbooks.Intermediate
• SegmentationUsing network separation as a containment measure to restrict an attacker's ability to move or communicate.Foundational
• Server-Side Request Forgery (SSRF)An attack that makes a server issue requests to unintended internal or external destinations on the attacker's behalf.Advanced
• ServiceNow Security Incident Response (SIR)A ServiceNow application for managing security incidents with workflows, playbooks, threat intelligence and integrations.Advanced
• Session HijackingTaking over a valid user session by stealing or predicting its session identifier or token.Intermediate
• Shadow ITHardware, software or cloud services used inside an organization without the approval or knowledge of IT and security.Foundational
• Shoulder SurfingObserving someone's screen or keyboard to obtain sensitive information such as passwords or PINs.Foundational
• SigmaA generic, vendor-neutral signature format for writing log-based detection rules that convert to SIEM queries.Advanced
• Signature-Based DetectionDetecting threats by matching known patterns, such as file hashes or byte sequences, against a database of signatures.Foundational
• Silver TicketA forged Kerberos service ticket created with a service account's hash to access a specific service.Advanced
• SIM SwappingFraudulently transferring a victim's phone number to an attacker-controlled SIM to intercept calls and SMS codes.Intermediate
• Simulation ExerciseAn exercise that simulates an incident with hands-on activity in a controlled environment to test response capabilities.Intermediate
• Slack SpaceUnused space between the end of a file's data and the end of the last cluster allocated to it.Intermediate
• SmishingPhishing conducted through SMS or other text messaging.Foundational
• SnapshotA point-in-time capture of the state of a volume, virtual machine or storage system.Foundational
• SnortAn open-source network intrusion detection and prevention system using rule-based signature matching, now maintained by Cisco.Intermediate
• SOC Analyst TiersThe tiered structure of SOC roles, typically Tier 1 triage, Tier 2 investigation and Tier 3 hunting and advanced response.Foundational
• Social EngineeringManipulating people into revealing information, granting access or performing actions that compromise security.Foundational
• Social Engineering PrinciplesThe psychological levers attackers use to persuade victims, such as authority, urgency, scarcity, trust and consensus.Foundational
• SourcetypeA Splunk field that identifies the format of data, determining how it is parsed and how fields are extracted.Foundational
• Spear PhishingA targeted phishing attack crafted for a specific individual or group using personal or organizational details.Foundational
• Splunk BucketA directory in a Splunk index that holds data for a time range, moving through hot, warm, cold, frozen and thawed stages.Advanced
• Splunk Enterprise Security (ES)Splunk's premium SIEM application providing correlation searches, notable events, risk-based alerting and security dashboards.Intermediate
• Splunk Heavy Forwarder (HF)A full Splunk Enterprise instance configured to parse, filter, route and forward data before indexing.Advanced
• Splunk IndexA repository in Splunk where ingested data is stored and from which searches retrieve events.Foundational
• Splunk IndexerThe Splunk component that parses incoming data, writes it to indexes and responds to search requests.Intermediate
• Splunk Search HeadThe Splunk component that provides the user interface and distributes searches to indexers.Intermediate
• Splunk Search Processing LanguageThe query language used in Splunk to search, filter, transform and visualize machine data.Foundational
• Splunk Universal Forwarder (UF)A lightweight Splunk agent that collects data from hosts and sends it to indexers or heavy forwarders.Intermediate
• SpywareMalware that secretly monitors user activity and collects information without consent.Foundational
• SQL Injection (SQLi)Injecting malicious SQL into application inputs to read, modify or delete database data or bypass authentication.Foundational
• SSL StrippingAn on-path attack that downgrades a user's HTTPS connection to HTTP so traffic can be read in clear text.Intermediate
• Stack CountingA hunting technique that counts occurrences of values across many hosts to find rare outliers.Advanced
• Stakeholder-Specific Vulnerability Categorization (SSVC)A decision-tree method for prioritizing vulnerabilities based on exploitation, exposure, automatability and impact.Advanced
• Static Malware AnalysisExamining a malware sample without executing it, using file properties, strings, headers and disassembly.Intermediate
• stats CommandAn SPL transforming command that calculates aggregate statistics such as count, sum, average and distinct count, grouped by fields.Foundational
• Strategic Threat IntelligenceHigh-level intelligence about threat trends, motivations and risks for executives and decision-makers.Intermediate
• Structured Threat Information Expression (STIX)A standardized JSON language for representing cyber threat intelligence objects and relationships.Intermediate
• StuxnetA sophisticated worm discovered in 2010 that sabotaged Iranian uranium enrichment centrifuges by manipulating PLCs.Intermediate
• SUNBURSTThe backdoor inserted into SolarWinds Orion software updates in a 2020 supply chain attack.Advanced
• Super TimelineA comprehensive timeline that merges timestamps from many artifact types into one chronological view.Advanced
• Supply Chain AttackAn attack that compromises a trusted vendor, software component or service provider to reach its downstream customers.Intermediate
• SuricataAn open-source, multithreaded intrusion detection and prevention engine and network security monitoring tool.Intermediate
• SYN FloodA DoS attack that sends many TCP SYN packets without completing the handshake, exhausting the server's connection table.Foundational
• SysmonSystem Monitor, a free Microsoft Sysinternals tool that logs detailed process, network, file and registry activity to the Windows event log.Intermediate
• Tabletop Exercise (TTX)A discussion-based exercise in which participants walk through a simulated incident scenario to test plans and roles.Foundational
• Tactical Threat IntelligenceIntelligence describing adversary tactics, techniques and procedures, used by defenders to improve detections and controls.Intermediate
• Tactics, Techniques and Procedures (TTP)The patterns of adversary behavior: tactics are goals, techniques are methods and procedures are specific implementations.Intermediate
• Technical Threat IntelligenceSpecific, machine-readable indicators such as malicious IPs, domains, URLs and file hashes.Intermediate
• The Sleuth Kit (TSK)A collection of open-source command-line tools for file system forensic analysis.Advanced
• Threat ActorAn individual or group that carries out or intends to carry out malicious activity against an organization's systems or data.Foundational
• Threat Actor MotivationThe underlying reason a threat actor attacks, such as financial gain, espionage, ideology, revenge, disruption or war.Foundational
• Threat FeedA continuous stream of threat data, typically indicators of compromise, delivered for integration into security tools.Foundational
• Threat HuntingProactively searching for threats that have evaded existing detections, based on hypotheses, intelligence or analytics.Intermediate
• Threat Intelligence LifecycleThe cyclical process for producing intelligence: requirements, collection, processing, analysis, dissemination and feedback.Intermediate
• Threat Intelligence Platform (TIP)A system that aggregates, normalizes, scores and distributes threat intelligence to security tools and teams.Intermediate
• Threat VectorThe path or means by which a threat actor gains access to a target, such as email, removable media or vulnerable software.Foundational
• Timeline AnalysisReconstructing the sequence of events in an incident by ordering timestamps from multiple artifacts.Intermediate
• TimestompingAn anti-forensics technique that alters file timestamps to blend malicious files in or mislead investigators.Advanced
• Traffic Light Protocol (TLP)A scheme for marking how widely shared threat information may be disseminated.Intermediate
• TriageRapidly assessing alerts or incidents to determine validity, severity and priority for response.Foundational
• Triage CollectionRapid acquisition of high-value forensic artifacts from a system instead of a full disk image.Advanced
• Trojan HorseMalware disguised as legitimate software that performs hidden malicious actions once the user runs it.Foundational
• True Positive (TP)An alert that correctly identifies real malicious activity.Foundational
• Trusted Automated Exchange of Intelligence Information (TAXII)A protocol for exchanging cyber threat intelligence over HTTPS, designed to carry STIX data.Intermediate
• tstats CommandAn SPL command that performs fast statistical queries on indexed fields and accelerated data models.Advanced
• TuningAdjusting detection rules, thresholds and exclusions to improve alert accuracy.Intermediate
• TyposquattingRegistering domain names that are common misspellings or variants of legitimate domains to deceive users.Foundational
• Unallocated SpaceAreas of a storage device not currently assigned to any file, which may contain deleted data.Intermediate
• Unified Data Model (UDM)The normalized schema Google Security Operations uses to represent security events from all sources.Advanced
• Unskilled AttackerA low-sophistication threat actor who relies on pre-built tools and exploits written by others.Foundational
• Use CaseA defined detection scenario describing what threat to detect, which data is required and how to respond.Intermediate
• User and Entity Behavior Analytics (UEBA)Analytics that baseline normal behavior of users and entities and flag anomalies that may indicate threats.Intermediate
• VelociraptorAn open-source endpoint visibility and digital forensics tool that queries many endpoints at scale using VQL.Advanced
• VirusMalware that attaches to a host file or program and replicates when that host is executed, requiring user action to spread.Foundational
• VirusTotalA Google-owned online service that scans files, URLs, domains and IPs with many antivirus engines and reputation tools.Foundational
• VishingVoice phishing that uses phone calls or voicemail to manipulate victims into revealing information or taking action.Foundational
• VLAN HoppingAn attack that sends traffic from one VLAN to another without passing through a router, via switch spoofing or double tagging.Intermediate
• VolatilityAn open-source framework for extracting digital artifacts from memory images.Advanced
• Vulnerability ExceptionA formally approved, documented decision to delay or not remediate a vulnerability, usually with compensating controls.Intermediate
• Vulnerability Exploitability eXchange (VEX)A machine-readable advisory stating whether a product is actually affected by a known vulnerability in one of its components.Advanced
• Vulnerability ManagementThe continuous process of identifying, assessing, prioritizing, remediating and verifying security weaknesses.Foundational
• Vulnerability PrioritizationRanking vulnerabilities for remediation based on severity, exploitability, exposure and asset criticality.Intermediate
• Vulnerability ScanningAutomated testing of systems and applications to identify known vulnerabilities, missing patches and misconfigurations.Foundational
• Vulnerability ValidationConfirming that a reported vulnerability truly exists and that remediation actually fixed it.Intermediate
• WannaCryA 2017 ransomware worm that spread globally through the EternalBlue SMBv1 exploit.Foundational
• Warm SiteAn alternate facility with some equipment and connectivity in place but requiring data restoration and configuration before use.Foundational
• Watering Hole AttackAn attack that compromises a website frequently visited by a target group in order to infect those visitors.Intermediate
• Web ShellA malicious script uploaded to a web server that gives an attacker remote command execution through HTTP.Intermediate
• WhalingSpear phishing aimed at senior executives or other high-value individuals.Foundational
• WildFirePalo Alto Networks' cloud-based malware analysis service that detonates unknown files and links to produce verdicts and signatures.Intermediate
• Windows Event Forwarding (WEF)A built-in Windows feature that forwards event logs from many hosts to a central Windows Event Collector.Advanced
• Windows Event LogThe structured logging system in Windows that records security, system and application events.Foundational
• Windows Registry ForensicsExamining Windows registry hives for evidence of program execution, persistence, user activity and connected devices.Advanced
• Wiper MalwareDestructive malware designed to permanently erase or corrupt data and systems rather than extort payment.Intermediate
• Work Recovery Time (WRT)The time needed after systems are restored to verify data, test functionality and resume normal operations.Advanced
• WormSelf-replicating malware that spreads across networks without user interaction by exploiting vulnerabilities.Foundational
• Write BlockerA hardware or software tool that allows reading from a storage device while preventing any writes to it.Foundational
• YARAA pattern-matching tool and rule language for identifying and classifying malware based on textual or binary patterns.Intermediate
• YARA-LThe detection rule language used in Google Security Operations to identify threats across UDM events.Advanced
• ZeekAn open-source network security monitoring tool that generates detailed logs of network protocol activity.Intermediate
• Zero-Day VulnerabilityA vulnerability unknown to the vendor or without an available patch, which attackers may exploit before defenders can fix it.Foundational