Cybersecurity Glossary

67 terms

APT

Advanced Persistent Threat - a well-resourced, stealthy adversary (often nation-state) that maintains long-term access to a target.

ATT&CK

MITRE's knowledge base of real-world adversary tactics (goals) and techniques (methods), used to describe and measure detection coverage.

Beaconing

The regular 'phone home' traffic from a compromised host to its command-and-control server - a key C2 detection signal.

BEC

Business Email Compromise - a scam that uses a spoofed or hijacked email account to trick a victim into wiring money or data; no malware required.

Blue Team

The defenders - the people and functions responsible for detection, response and hardening against attacks.

Brute Force

Trying many passwords against an account until one works. Compare with password spraying (one password, many accounts).

C2 (Command & Control)

The channel an attacker uses to control compromised hosts - issue commands, exfiltrate data, and deploy tools.

CVE

Common Vulnerabilities and Exposures - a unique public identifier for a specific known security flaw (e.g. CVE-2021-44228).

CVSS

Common Vulnerability Scoring System - a 0-10 score expressing a vulnerability's severity.

DFIR

Digital Forensics and Incident Response - investigating and responding to security incidents, and analyzing the evidence they leave.

DKIM

DomainKeys Identified Mail - a cryptographic signature on outbound email that lets receivers verify it wasn't altered and came from your domain.

DMARC

An email policy that ties SPF/DKIM to the visible From domain and tells receivers what to do on failure (none/quarantine/reject) - the control that stops domain spoofing.

DNS Tunneling

Smuggling data or C2 traffic inside DNS queries/responses, abused because DNS is almost always allowed out of a network.

Dropper

A small piece of malware whose job is to download or unpack and run the real payload.

EDR

Endpoint Detection and Response - software on hosts that records rich telemetry and can respond (isolate, kill processes).

Exfiltration

The unauthorized transfer of data out of an environment - usually the attacker's end goal.

False Positive

An alert that fires on benign activity. Too many cause alert fatigue and hide real attacks.

FIM

File Integrity Monitoring - alerting on changes to important files (e.g. new files in a web root), a high-fidelity signal for web shells.

Golden Ticket

A forged Kerberos TGT created with the domain's KRBTGT hash, granting an attacker near-unlimited, hard-to-detect access to a Windows domain.

Hardening

Reducing a system's attack surface by disabling unneeded features, applying secure configs, and enforcing least privilege.

Hash

A fixed-length fingerprint of data (e.g. SHA-256). Used to identify files/IOCs and to store passwords - never reversible if done right.

Honeypot

A decoy system or account designed to attract and detect attackers; any interaction with it is high-signal.

IDS / IPS

Intrusion Detection/Prevention System - monitors (IDS) or blocks (IPS) malicious network activity by signature or behavior.

Impossible Travel

Two logins from geographically distant locations in a time too short to travel between - a strong account-takeover signal.

Incident Response

The organized process of detecting, containing, eradicating and recovering from a security incident (see PICERL / NIST 800-61).

IOC

Indicator of Compromise - an artifact (hash, IP, domain, filename) that suggests a system may be breached.

Jitter

Randomness added to a C2 beacon's callback interval to evade timing-based detection.

Kerberoasting

Requesting Kerberos service tickets for accounts with an SPN and cracking them offline to recover service-account passwords.

Lateral Movement

Techniques attackers use to move from one compromised host to others across a network (e.g. PsExec, WMI, RDP).

LOLBin (Living off the Land)

Abusing trusted, signed system binaries (certutil, mshta, rundll32) for malicious purposes to evade allow-lists.

Malware

Malicious software - viruses, ransomware, trojans, spyware, and more.

MFA

Multi-Factor Authentication - requiring more than a password (something you have/are). Phishing-resistant MFA (FIDO2) is the strongest.

MITRE ATLAS

An ATT&CK-style knowledge base of adversarial threats against AI and machine-learning systems.

MITRE D3FEND

A knowledge graph of defensive countermeasures, mapping techniques to the defenses that counter them.

NTLM Relay

Relaying a victim's NTLM authentication to another service to act as them - no password cracking needed.

OSINT

Open-Source Intelligence - gathering information from publicly available sources for recon or investigation.

Pass-the-Hash

Authenticating with a stolen NTLM password hash instead of the plaintext password, enabling lateral movement.

Payload

The part of an attack that performs the malicious action (e.g. the code a dropper runs).

Persistence

Mechanisms attackers use to survive reboots and keep access (Run keys, services, scheduled tasks, WMI subscriptions).

Phishing

Tricking a user via email/message into revealing credentials, running malware, or authorizing an action.

PoC

Proof of Concept - code that demonstrates a vulnerability is exploitable.

Precision & Recall

Detection quality metrics: precision = how many alerts are true; recall = how much real activity you catch. F1 balances both.

Privilege Escalation

Gaining higher permissions than initially granted - from a normal user to SYSTEM/root, or to Domain Admin.

Purple Team

Red and blue working together so every attack technique is immediately tested against - and turned into - detections.

Ransomware

Malware that encrypts data (and often steals it) to extort payment. Crews usually disable recovery and spread before encrypting.

RCE

Remote Code Execution - running attacker-chosen code on a target over the network; among the most severe vulnerability classes.

Red Team

Offensive security professionals who emulate real adversaries to test an organization's defenses.

Reverse Engineering

Taking software (often malware) apart to understand how it works, statically or dynamically.

Sandbox

An isolated environment for safely detonating and observing suspicious files or URLs.

SIEM

Security Information and Event Management - centralizes logs from across the estate, correlates them, and runs detections/alerting.

Sigma

A generic, vendor-agnostic detection rule format that converts to many SIEM query languages.

SOAR

Security Orchestration, Automation and Response - automating repetitive SOC workflows and response playbooks.

SOC

Security Operations Center - the team/function that monitors, triages and responds to security alerts.

SPF

Sender Policy Framework - a DNS record listing which servers may send email for your domain.

SSRF

Server-Side Request Forgery - tricking a server into making attacker-chosen requests, often to reach internal services or cloud metadata.

Supply Chain Attack

Compromising software before it reaches the target - via a poisoned dependency or a backdoored build - so it arrives trusted and signed.

Sysmon

A free Windows monitor that logs rich endpoint telemetry (process creation, network, registry) - the backbone of many detections.

Threat Hunting

Proactively searching for attackers that evaded automated detection, driven by hypotheses grounded in ATT&CK and intel.

Threat Intelligence

Curated knowledge about adversaries, their infrastructure and TTPs, used to prioritize and inform defense.

TTP

Tactics, Techniques and Procedures - how an adversary operates, from high-level goals to specific tooling.

Vishing

Voice phishing - phishing conducted over a phone call, often impersonating IT or a bank.

WAF

Web Application Firewall - filters and blocks malicious HTTP traffic to web apps (SQLi, XSS, etc.).

Web Shell

Attacker-planted server-side code in a web root that provides remote command execution through the web server.

XDR

Extended Detection and Response - unifies endpoint, network, identity, email and cloud into one correlated detection-and-response layer.

YARA

A pattern-matching language and engine to identify and classify files, memory and malware by strings and byte patterns.

Zero Trust

A model that trusts no user or device by default - every request is authenticated, authorized and continuously verified.

Zero-Day

A vulnerability exploited before a patch exists (defenders have 'zero days' to prepare).