Indicators of Malicious Activity

These flashcards cover key terms and concepts related to indicators of malicious activity, malware types, and techniques used in cybersecurity.

__ refers to the unauthorized transfer of data from a computer or network.

Data Exfiltration

Moving from 11 host to another within a network to gain wider access is called _.

Lateral Movement

An __ is evidence of an intrusion attempt in progress.

Indicator of Attack (IOA)

A __ attack tricks a domain controller into replicating credentials to a rogue host.

DCSync

__ is a technique where an attacker captures a password hash and uses it to authenticate instead of a plaintext password.

Pass-the-Hash

A __ Ticket is a forged Kerberos Ticket-Granting Ticket (TGT) used to gain domain admin rights.

Golden

A __ Ticket is a forged Kerberos Ticket-Granting Service (TGS) ticket used to access specific resources.

Silver

A __ relay attack involves intercepting and forwarding network authentication requests to another server.

New Technology LAN Manager (NTLM)

__ is a post-exploitation tool often used to dump passwords and hashes from local memory.

Mimikatz

The __ database contains local password hashes on Windows operating systems.

Security Account Manager (SAM)

__ is a tool that identifies complex attack paths in Active Directory environments via graph theory.

Blood Hound

Poisoning __ and NBT−NS protocols causes clients to send authentication hashes to an attacker on the local network.

LLMNR

The __ protocol is the primary method for querying directory services like Active Directory.

Lightweight Directory Access Protocol (LDAP)

An __ consists of forensic evidence indicating that a system breach has already occurred.

Indicator of Compromise (IoC)

Attackers dump memory from the __ process to steal credentials from currently logged-in users.

LSASS

__ techniques allow an attacker to maintain access to a network even after a system reboot.

Persistence

A __ is the central infrastructure used by attackers to control compromised systems.

Command and Control Server (C2)

Enabling __ signing is a primary defense used to prevent relay attacks over the file-sharing protocol.

SMB

__ is the phase where an attacker gathers detailed information about visible users, groups, and shares.

Enumeration