Classifying Threats Flashcards
Documented Exploits
A piece of software, data or sequence of commands that takes advantage of a vulnerability to cause unintended behavior or to gain unauthorized access to sensitive data
Known Unknowns
A classification of malware that contains obfuscation techniques to
circumvent signature-matching and detection
APT
An attacker that establishes a long-term presence on a network in
order to gather sensitive information
Commodity Malware
Malicious software applications that are widely available for sale or easily obtainable and usable
Reputation Data
Blacklists of known threat sources, such as malware signatures, IP address ranges, and DNS domains
IoC
A residual sign that an asset or network has been successfully attacked or is continuing to be attacked
IoA
A term used for evidence of an intrusion attempt that is in
progress
Behavioral Threat Research
Correlation of IoCs into attack patterns
TTP
Behavior patterns that were used in historical cyberattacks and
adversary actions
Fast Flux DNS
A technique rapidly changes the IP address associated with a
domain
Lockheed Marin Kill Chain
Describes the stages by which a threat actor progresses a network
intrusion
Lockheed Marin Kill Chain STEPS
Reconnaissance - method of attack
Weaponization - creates payload code to be executed
Delivery - ID vector to transmit code
Exploitation - execution on system
Installation - enables code to remote access
C2 - established control and download additional tools
Actions on Objectives - achievement of data exfiltration or goal
MITRE ATT&CK Framework
A knowledge base maintained by the MITRE Corporation for listing and explaining specific adversary tactics, techniques, and common knowledge or procedures (attack.mitre.org)
Diamond Model of Intrusion Analysis
A framework for analyzing cybersecurity incidents and intrusions by
exploring the relationships between four core features: adversary,
capability, infrastructure, and victim
STIX
A standard terminology for IoCs and ways of indicating relationships
between them that is included as part of the OASIS Cyber Threat
Intelligence (CTI) framework
TAXII
A protocol for supplying codified information to automate incident
detection and analysis
OpenIOC
A framework by Mandiant that uses XML-formatted files for supplying codified information to automate incident detection and analysis
MISP
MISP provides a server platform for cyber threat intelligence sharing, a proprietary format, supports OpenIOC definitions, and can import and export STIX over TAXII
