Lesson 13 - Group 2: Physical and Network Attack Indicators

What physical attacks are listed in Lesson 13?

Physical denial of service, forced entry into premises or cabinets, environmental attacks, and RFID or NFC cloning and skimming.

RFID cloning or skimming

Copying or capturing data from contactless cards, badges, or fobs.

What major stages or activities are listed for network attacks?

Reconnaissance, credential harvesting, denial of service, delivery or breach, C2 and persistence, lateral movement, privilege escalation, and data exfiltration.

DDoS

Distributed Denial-of-Service attack that uses multiple compromised hosts to overwhelm a target.

How is a botnet used in a DDoS attack?

Command-and-control handlers coordinate compromised hosts running automated attack scripts.

SYN flood

A denial-of-service attack that consumes resources using large numbers of spoofed session requests.

Reflected attack

An attacker spoofs the victim’s IP address so third-party servers send responses to the victim.

Amplification attack

An attacker uses small requests, such as DNS or NTP queries, to generate much larger responses directed at the victim.

On-path attack

An attack in which the threat actor positions themselves between two communicating hosts.

ARP poisoning

Sending unsolicited ARP replies to place a spoofed MAC address in local ARP caches, often while impersonating the default gateway.

DNS poisoning

Manipulating DNS information so a client or DNS server resolves a name to an attacker-controlled destination.

What DNS attack locations are listed?

A malicious resolver, the client DNS cache or HOSTS file, and the DNS server cache.

Rogue access point

An unauthorized wireless access point that creates an unapproved network connection.

Evil twin

A malicious access point that imitates a legitimate wireless network.

What wireless denial-of-service methods are listed?

Jamming and disassociation.

Wireless replay attack

Capturing and retransmitting wireless traffic, potentially supporting key recovery or unauthorized acces