3.4 Cyber Incident Response Flashcards
what is data exfiltration?
the unauthorized copying, transfer or retrieval of data from a computer or server
what should you do if you discover rogue devices on the network?
locate and remove them
what happens in vertical privilege escalation?
the attacker obtains higher privileges by performing operations that allow the attacker to run unauthorized code
what are the SIX network-related symptoms of incidents?
bandwidth consumption
beaconing
irregular peer-to-peer communication
rogue devices on the network
scan sweeps
unusual traffic spikes
what is meant by anomalous activity?
activity that is outside the norms
when does an escalation of privileges attack occur?
when an attacker has used a design flaw in an application to obtain unauthorized access to the application
what are scan sweeps?
an attempt by an unauthorized entity to map your network
what happens in horizontal privilege escalation?
the attacker obtains the same level of permissions as he already has but uses a different user account to do so
what are the eight host-related symptoms of an incident?
processor consumption
memory consumption
drive capacity consumption
unauthorized software
malicious processes
unauthorized changes
what is beaconing?
when malware attempts to remotely connect to a command and control host or network
what are the SIX application-related symptoms of incidents?
anomalous activity
introduction of new accounts
unexpected output
unexpected outbound communication
service interruption
memory overflows
