Network Attack Investigations and Malware Analysis

Vocabulary flashcards covering key security tools, concepts, malware types, and forensic artifacts discussed in the lecture.

Indicator of Compromise (IoC)

Technical artifacts such as IP addresses, file hashes, URLs, and domain names that indicate a system or network has been breached.

MX toolbox

An online suite of applications used for mail server analytics, email header analysis, and checking SPF or blocklist statuses.

ipapi.com

An IP lookup service queried by malware to determine whether the executing host is in a data center or VPS to evade honeypots and security research environments.

GooLoader

A malware delivery mechanism that leverages legitimate cloud services, such as Google Drive, to host and download malicious payloads.

Agent Tesla

A family of Remote Access Trojan (RAT) malware used to steal credentials, system metadata, and session tokens, often exfiltrating data via protocols like FTP.

Network Detection and Response (NDR)

A security domain and set of tools focused on analyzing network traffic and packet captures to identify and respond to malicious activities.

Endpoint Detection and Response (EDR)

Host-based security technology that monitors and logs host-level events, such as file creation, process execution, and system modifications.

Suricata

An Intrusion Detection System (IDS) that inspects incoming network traffic against defined rules and generates alerts for suspicious activity.

Joomla

A web content management system targeted by attackers to upload malicious scripts using built-in installer functionality.

agent.php

An obfuscated PHP script uploaded to a web server by attackers to conduct covert communication and exchange encoded data.

Thunderbird

A desktop email client from which Agent Tesla malware extracted stored passwords, OAuth tokens, and saved user contacts.