CySA+ Flashcards
1
Q
Reaver
A
A specialized tool used to find WPA and WPA2 passphrases specifically on networks that support the Wi-Fi Protected Setup (WPS) feature.
2
Q
Aircrack-ng
A
A suite of tools designed for wireless network testing. The tools in this suite can capture packets from wireless networks, conduct packet injection attacks, and crack preshared keys used on WEP, WPA, and WPA2 networks.
3
Q
Hashcat
A
A general-purpose password cracking tool that may also be used on wireless networks.
4
Q
CAN bus
A
Controller Area Network. A vehicle bus standard designed to allow microcontrollers and devices to communicate with each other’s applications without a host computer.
5
Q
Common Platform Enumeration (CPE)
A
Provides a standard nomenclature for describing product names and versions.
6
Q
Common Vulnerabilities and Exposures (CVE)
A
Provides a common nomenclature for describing security-related software flaws.
7
Q
Common Vulnerability Scoring System (CVSS)
A
Provides a standardized approach for measuring and describing the severity of security-related software flaws.
8
Q
FIPS 140-2
A
U.S. government standard that hardware security modules are certified against.
9
Q
OpenFlow
A
Used to allow software-defined network (SDN) controllers to push changes to switches and routers, allowing flow control, network traffic partitioning, and testing of applications and configurations.
10
Q
Host File
A
Used by operating systems to map a connection between an IP address and domain names before going to DNS.
11
Q
Domain Generation Algorithm (DGA)
A
A program that generates a large list of domain names.
12
Q
Register
A
A critical component of computer memory that stores data and instructions for quick processing. High volatility.
13
Q
Cache
A
A chip-based computer component that makes retrieving data from the computer memory more efficient. High volatility.
14
Q
Random Access Memory (RAM)
A
The hardware in a computing device where the operating system, application programs, and date in current use are kept so they can quickly be reached by the device’s processor.
15
Q
Routing Table
A
A set of rules, often viewed in table format, that is used to determine where data packets traveling over an Internet Protocol (IP) network will be directed.
16
Q
ARP Cache
A
A collection of Address Resolution Protocol entries that are created when an IP address is resolved to a MAC address.
17
Q
Process Table
A
Contains an entry for each process present in they system. Each entry contains several fields that stores all the information pertaining to a single process.
18
Q
Temporary Swap File
A
A special type of file used by the computer’s operating system to manage memory. When the computer’s RAM is full of running programs and data, the operating system may use a portion of the computer’s storage (hard drive or SSD) as virtual memory.
19
Q
Mandatory Access Control (MAC)
A
Rely on the operating system to control what subjects can access and what actions they can perform.
20
Q
Virtual Private Cloud (VPC)
A
A secure, isolated cloud environment hosted within a public cloud.
21
Q
Cloud Access Security Broker (CASB)
A
Software tool that serves as intermediaries between cloud services users and cloud service providers. The positioning allows them to monitor user activity and enforce policy requirements.
22
Q
auth.log (Linux)
A
In Linux, serves the purpose of recording authentication-related events, including user logins, logouts, and authentication attempts, providing a centralized location for monitoring and troubleshooting security-related activities on a system.
23
Q
Gramm-Leach-Billey Act (GLBA)
A
Covers financial institutions, broadly defined. It requires that those institutions have a formal security program and designate an individual as having overall responsibility for the program.
24
Q
The Health Insurance Portability and Accountability Act (HIPPA)
A
Includes security and privacy rules that affect healthcare providers, health insurers, and health information clearinghouses.
25
The Family Educational Rights and Privacy Act (FERPA)
Requires the educational institutions implement security and privacy controls for student educational records.
26
The Sarbanes-Oxley (SOX) Act
Applies to the financial records of publicly traded companies and requires that those companies have a strong degree of assurance around the IT systems that store and process those records.
27
Payment Card Industry Data Security Standard (PCI DSS)
Provides detailed rules about the storage, processing, and transmission of credit and debit card information. A contractual obligation that applies to credit card merchants and service providers.
28
Trusted Foundry Program
Started by the U.S. government to validate microelectronic suppliers throughout the supply chain.
29
Fuzz Testing (Fuzzing)
Sending invalid or random data to an application to test its ability to handle unexpected data.
30
Fault Injection
Directly inserts faults into error handling paths, particularly error handling mechanisms that are rarely used or might be otherwise missed during normal testing.
31
Jump Box
A system that resides in a segmented environment and is used to access and manage the devices in the segment where it resides. Span two different security zones.
32
Out-of-Band (NAC)
Leverage existing network infrastructure to have network devices communicate with authentication servers and then reconfigure the network to grant or deny access as needed. Example 802.1x.
33
In-Band (NAC)
Use dedicated appliances that sit between devices and the resources that they wish to access. The deny or limit network access to devices that do not pass the authentication process.
34
Purpose Limitation
Information should only be used for the reason it was collected.
35
Information Technology Infrastructure Library (ITIL)
A framework that offers a comprehensive approach to IT services management (ITSM) within the modern enterprise. It covers five core activities: services strategy, service design, services transition, service operation, continual service improvement.
36
Control Objectives for Information and Related Technologies (COBIT)
A set of best practices for IT governance developed by the Information Systems Audit and Control Association (ISACA). It divides information technology into four domains: plan and organize, acquire and implement, deliver and support, monitor and evaluate.
37
Infrastructure as Code (IaC)
The process of automating the provisioning, management, and deprovisioning of infrastructure services through scripted code rather than human intervention. A major feature of all major IaaS environments (AWS, Microsoft Azure, and Google Cloud Platform).
38
File Transfer Protocol (FTP)
Provides the ability to transfer files between systems but does not incorporate security features.
39
Secure File Transfer Protocol (SFTP)/FTP-Secure
Secure methods to transfer files between systems.
40
-top (Linux)
Linux command that shows processes, their PID (process ID), the user who is executing the process, and the command used to start it. It also provides a real-time view of the memory usage for a system on a per-process basis.
41
-ps (Linux)
Linux command that provides information about processes and their CPU and memory utilization.
42
chmod (Linux)
Linux command that changes permissions of a file or directory. It allows you to control who can read, write, and execute a file.
43
Simple Network Management Protocol (SNMP)
A protocol for collecting information like status and performance about devices on a network.
44
-cat (Linux)
Linux command used to concatenate and display the contents of one or more files. It is often used to quickly view the contents of a file by printing them to the terminal.
45
Switched Port Analyzer (SPAN Port)
A dedicated port on a switch that takes a mirrored copy of network traffic from within the switch and sends it to another port for analysis.
46
Address Resolution Protocol (ARP)
The procedure for mapping a dynamic IP address to a permanent physical MAC address in a local area network (LAN).
47
lsof (Linux)
Linux command that lists open files and the processes that opened them.
48
The Wayback Machine
A digital archive of information on the internet that allows users to view historic versions of websites.
49
Common Platform Enumeration (CPE)
Provides common nomenclature for describing product names and versions.
50
Common Vulnerability Scoring System (CVSS)
Provides a standardized approach for measuring and describing the severity of security-related software flaws.
51
Open Vulnerability and Assessment Language (OVAL)
A language for specifying low-level testing procedures used by checklists.
52
-sV
A flag on Nmap used for version detection.
53
Banner Grabbing
The process of collecting information about a service by examining the details provided in its initial response, typically containing software and version information.
54
Border Gateway Protocol (BGP)
A set of rules that determines the best network routes for data transmissions on the internet.
55
Simple Mail Transfer Protocol (SMTP)
A TCP/IP protocol used in sending and receiving emails. Uses port 25.
56
/var
In Linux, a directory that is used to store variable data, such as log files, temporary files, and other data that may change during the normal operation of the system.
57
John the Ripper Modes
1. Incremental: The most powerful, tries all possible character combinations as defined by settings entered at the start.
2. Single Crack Mode: Tries to use login names with various modifications, good for initial testing.
3. External Mode: Relies on functions that are custom written to generate passwords. Useful in an organization has custom password policies.
4. Wordlist: Uses a dictionary file along with mangling rules to test for common passwords.
58
Acceptable Use Policy (AUP)
Provides network and system users with clear direction on permissible uses of information resources.
59
Account Management Policy
Describes the account life cycle from provisioning through active use and decommissioning.
60
SOCKS4
A protocol that facilitates TCP traffic between a client and server through a proxy. Supported by Nmap.
61
Disposition
A phase in the SDLC that occurs when a product or system reaches the end of its life.
62
Network Address Translation (NAT)
A method used in networking to map private IP addresses of devices within a local network to a single public IP address, allowing them to access the internet.
63
MITRE's ATT&CK Framework (Adversarial Tactics, Techniques, and Common Knowledge)
Includes detailed descriptions, definitions, and examples for the complete threat lifecycle, from initial access through execution, persistence, privilege escalation, and exfiltration.
64
The Diamond Model of Intrusion Analysis
Describes a sequence where an adversary deploys a capability targeted at an infrastructure against a victim.
65
Lockheed Martin's Cyber Kill Chain
A framework that uses seven stages to describe an attack.
1. Reconnaissance
2. Weaponization
3. Delivery
4. Exploitation
5. Installation
6. Command and Control (C2)
7. Actions on Objectives
66
Purging
A method of sanitization that applies physical or logical techniques that render target data recovery infeasible using state of the art laboratory techniques.
67
Persistent Cross-Site Scripting
The malicious script comes from the website database.
68
Reflected Cross-Site Scripting
The malicious script comes from the current HTTP request.
69
DOM-Based Cross-Site Scripting
The vulnerability exists in the client-side code rather than the server-side code.
70
Hping
A command-line network tool that provides the functionality for crafting and sending custom TCP/IP packets.
71
Responder
A python script that is a hybrid between passive and active reconnaissance. Initially it passively monitors the network waiting for systems to send broadcast requests out intended for devices running networked services. Once a request is passively identified, it switches to active mode and attempts to hijack the connection and gather information from the broadcasting system and its users.
72
Field-Programmable Gate Arrays (FPGAs)
Computer chips that allow the end user to reprogram their function, making them quite useful for embedded systems.
73
Embedded Systems
Computers integrated into the operation of another device, such as a vehicle, camera, or multifunction printer.
74
Real-Time Operating Systems (RTOs)
Slimmed-down operating systems designed to work quickly on IoT devices in a low-power environment.
75
System on a Chip (SOC)
An entire embedded system packaged onto a single chip, often including a processor, memory, networking interfaces, and power management on the chip.
76
Controller Area Network bus (CAN bus)
Specialized networks designed to facilitate communication between embedded systems without the overhead of a TCP/IP network.
77
Supervisory Control and Data Acquisition (SCADA) systems
A type of industrial control system that monitors and manages processes in manufacturing, infrastructure, and other industries. They collect real-time data from sensors and devices, allowing operators to control and supervise industrial processes from a centralized location.
78
Industrial Control Systems (ICS)
Computer-based systems that monitor and control industrial processes, machinery, and infrastructure.
79
Programmable Logic Controllers (PLCs)
Specialized hardware controllers designed to operate in an IoT environment. Often use a specialized communication protocol called Modbus to communicate with sensors and other IoT components over wired serial infrastructure.
80
Integer Overflow
A variant of buffer overflow where the result of an arithmetic operation attempts to store an integer that is too large to fit in the specified buffer.
81
Back-Off Algorithm
A method that adds delays to a system's retry attempts when competing for a shared resource, reducing conflicts and enhancing overall efficiency in networking and distributed systems.
82
STIX
A standardized language for describing and sharing information about cybersecurity threats in a structured and machine-readable format.
83
TAXII
A protocol used for sharing cyber threat intelligence and indicators of compromises (IoCs) between different organizations and security systems in a standardized way.
84
Apple File System (APFS)
Apple's file system for its devices like macOS, iOS, watchOS and tvOS. It manages how data is stored, organized, and accessed on Apple devices, offering features such as enhanced encryption, snapshots, and improved performance.
85
FAT32/NTFS
Types of file systems used to organize and store data on computer storage devices.
86
File System
A method or structure used by operating systems to organize and store data on a storage device, such as a hard drive or flash drive. It defines how files are names, accessed, and stored, providing framework for managing data on the storage medium.
87
Data Carving
A forensic technique used to recover fragmented or deleted files from storage media by identifying and extracting data based on file signatures and patterns, bypassing traditional file system structures. Its purpose is to retrieve lost or deleted information during digital forensic investigation.
88
U.S. Government Information Classification Scheme
Confidential, Secret, Top Secret
89
Network Interface Card (NIC)
A hardware component, typically a circuit board or chip, which is installed on a computer so it can connect to a network.
90
Remote Attestation
A security process where one system remotely verifies the integrity and trustworthiness of another system, confirming that it runs the expected software without direct access. This ensures trust between networked systems.
91
Measured Boot Process
A process that involves securely verifying and recording each set of a computer's startup sequence. Hashing functions are utilized to generate fixed-size representations (hashes) of different components in this process, facilitating the verification of their integrity and ensuring the system has not been tampered with.
92
Unified Extensible Firmware Interface (UEFI)
A modern firmware standard. It serves as an interface between the computer's operating system and firmware, offering features like secure boot, faster startup, and enhanced hardware support.
93
Address Space Layout Randomization (ASLR)
A security technique that involves randomizing the memory address where system components and executables are loaded. This helps prevent attackers from predicting the location of specific functions or vulnerabilities in a computer's memory, making it more challenging to exploit software vulnerabilities.
94
NX (No Execute) Bit
A security feature in computer processors that designate certain areas of memory as non-executable. It helps prevent the execution of code in specific regions, making it more difficult for malicious software to exploit vulnerabilities by executing code in data storage areas.
95
File Command (Linux)
A Linux command used to determine and display the type of a file. It examines the file's content and provides information about its format, helping users identify the file type, such as text, executable, or specific data format.
96
Time of Check/Time of Use (TOC/TOU)
A security vulnerability that occurs when there's a time gap between checking the status of a resource and using it. During this gap, the resource's status may change, leading to potential security vulnerabilities.
97
strepy ()
In C programming, a standard library function that copies the contents for one string (source) to another (destination). It does not check if the destination string hads enough space to accommodate the source string, could cause buffer overflow.
98
main ()
In C programming, a special function that serves as the entry point of the program, where execution begins and ends.
99
printf ()
In C programming, a standard library function that is primarily used to display information on the screen.
100
scanf ()
In C programming, a standard library function used for reading input from the input from the standard input, typically the keyboard. It is used to accept data form the user.
101
VMware
Develops virtualization software. Virtualization software creates an abstraction layer over computer hardware that allows the hardware elements of a single computer (processors, memory, storage, etc.) to be divided into multiple virtual computers, commonly called virtual machines (VMs). Each VM runs its own operating system and behaves like an independent computer.
102
Hypervisor
The software component that enables virtualization, allowing multiple operating systems to run on a single physical machine concurrently. It manages and allocates the resource of the host system to create and run multiple virtual machines, each operating independently as if it were running on its own dedicated hardware.
103
Active Directory (AD)
A directory service developed by Microsoft that stores and organizes information about network resources, including users, computers, and other devices in a hierarchical database. It provides centralized authentication, authorization, and management of network resources in a Window's domain environment, simplifying tasks such as user login, access control, and resource administration.
104
FIPS 140-2
A U.S. government standard outlining security requirements for cryptographic modules, ensuring their effectiveness in safeguarding sensitive information. It's widely adopted globally in government and various industries.
105
OpenFlow
A network communication protocol used between controllers and forwarders in an SDN architecture.
106
Software Defined Networking (SDN)
An approach to networking that uses software controllers that can be driven by application programming interfaces (APIs) to communicate with hardware infrastructure to direct network traffic. The architecture is comprised of three layers that communicate using northbound and southbound APIs.
107
Register
A critical component of computer memory that stores data and instructions for quick processing. It serves as an efficient temporary storage area where information can be accessed and manipulated quickly in order to carry out complex tasks. Highly volatile.
108
Cache Memory
A chip-based computer component that makes retrieving data from the computer's memory more efficient. It stores program instructions and data that are used repeatedly in the operations of programs or information the CPU is likely to need next. Highly volatile. Has three levels.
109
Random Access Memory (RAM)
The hardware in a computing device where the operating system (OS), application programs, and data in current use are kept so they can quickly be reached by the device's processor. Highly volatile.
110
Routing Table
A set of rules, often viewed in table format, that is used to determine where data packets traveling over an Internet Protocol (IP) network will be directed.
111
ARP Cache
A collection of Address Resolution Protocols entries that are created when an IP address is resolved to a MAC address.
112
Process Table
Contains an entry for each process present in the system. The entry is created when the process is created by a fork system call. Each entry contains several fields that stores all the information pertaining to a single process.
113
Temporary Swap File
A special type of file used by the computer's operating system (OS) to manage memory. When a computer's physical RAM is filled up with running programs and data, the operating system may use a portion of the computer's storage (like hard drive or SSD) as virtual memory.
114
Persistent Mass Storage
Refers to non-volatile storage that retains data even when the computer is powered off.
115
Hard Disk Drive (HDD)
An electro-mechanical data storage device that stores and retrieves digital data using magnetic storage with one or more rigid rapidly routing platters coated with magnetic material. Non-volatile.
116
Solid State Drive (SSD)
A solid storage device that uses integrated circuit assemblers to store data persistently, typically in flash memory. Non-volatile.
117
EnCase
A digital forensics case management product created by Guidance Software with built-in pathways or workflow templates that show the key steps in many types of investigations.
118
The Forensic Toolkit (FTK)
A digital forensics investigation suite by AccessData that runs on a Window's server or server clusters for faster searching and analysis due to data indexing when importing evidence.
119
The Sleuth Kit
An open-source digital forensics collection of command line tools and programming libraries for disk imaging and file analysis that interfaces with Autopsy as a graphical user front-end interface.
120
Live Acquisition (Memory)
Capture the contents of memory while the computer is running using a specialist hardware or software tool. Must be installed on system prior. Examples are Memoryze and TACTICAL.
121
Crash Dump
The contents of memory are written to a dump file when Windows encounters an unrecoverable Kernel error.
122
Hibernation File
A file that is written to the disk when the workstation is put into a sleep state. Some malware can detect the use of a sleep state and perform anti-forensics.
123
Pagefile (Swap File)
A file that stores pages of memory in use that exceed the capacity of the host's physical RAM modules. It is written on the hard drive, so it stays on the hard drive when the computer is turned off.
124
Live Acquisition (Disk)
Capture the contents of the disk drive while the computer is still running. Contents of the drive could be changed during acquisition.
125
Static Acquisition by Shutting Down
The computer is shut down through the operating system properly, and the disk is acquired. Malware may detect the shutdown and perform anti-forensics.
126
Static Acquisition by Pulling the Plug
The system's power is disconnected by removing the power plug from the wall socket. Files can't be changed, and anti-forensics can't be done. Captures disk in state it's in.
127
Physical Acquisition
Bit-by-bit copy of a disk that includes every non-bad sector on the target disk including deleted or hidden data. Takes time.
128
Logical Acquisition
Copies files and folders from partitions using the file system table stored on the media. Fast but will miss files marked as deleted.
129
Write Blockers
Forensic tool to prevent the capture or analysis device or workstation from changing data on a target disk or media. Can be hardware or software.
130
Imaging Utilities
A software utility that conducts the disk imaging of a target. May will perform cryptographic hashing of data during acquisition.
131
dd
A Unix/Linux/macOS command that can perform disk image acquisition.
132
Hash
A function that converts an arbitrary length string input into a fixed length string output.
133
Secure Hash Algorithm (SHA)
A cryptographic hashing algorithm created to address possible weaknesses in the older MD5 hashing algorithm. The first version uses 160-bit hash digest and the second version uses a 256-bit or 512-bit hash digest.
134
Message Digest Algorithm
A cryptographic algorithm created in 1990 with the most commonly used variant being MD5 which uses a 128-bit hash digest. No longer widely used.
135
certutil
In Windows, a command-line program installed as part of Certificate Services. It is used to display certificate authority (CA) configuration information, configure Certificate Services, and back-up and restore CA components. Also can be used to hash files.
136
File Checksum
A unique alphanumeric value generated by a mathematical algorithm, such as MD5 or SHA-256, to represent the content of a file.
137
File Integrity Monitoring (FIM)
A type of software that reviews system files to ensure they have not been tampered with.
138
Timeline
A tool that shows the sequence of file system events within a source image in a graphical format.
139
Block/Cluster
A fixed-size group of consecutive data storage units on a storage device, such as HDDs and SDDs. It serves as the basic unit for storing and managing data. The default size is 4096 bytes.
140
Master File Table (MFT)
A table that contains metadata with the location of each file in terms of blocks/clusters for disks formatted as New Technology File System (NTFS).
141
New Technology File System (NTFS)
A file system used by Windows operating systems to organize and store files on a storage device. It provides features such as support for larger file sizes, file and folder permissions, encryption, and improved reliability compared to systems like FAT32.
142
File Carving
The process of extracting data from a computer when that data has no associated file system metadata. It attempts to piece together data fragments from unallocated and slack space to reconstruct deleted files, or parts of them.
143
scalpel
An open-source Windows and Linux command that is used to conduct file carving.
144
Distributed Denial of Service
An attack that uses multiple compromised hosts (a botnet) to overwhelm a service with requests or response traffic.
145
Load Balancing
Refers to efficiently distributing incoming network traffic across a group of backend servers.
146
Web Server State Table
A list or record that keeps track of the current status and interactions with clients (like web browsers) that are communicating with a web server.
147
Distributed Reflection DoS (DRDoS)
A network-based attack where the attacker dramatically increases the bandwidth sent to a victim during a DDoS attack by implementing an amplification factor.
148
Network Time Protocol (NTP)
An internet protocol used to synchronize with computer clock time sources in a network.
149
Cloud Flare and Akami
Enterprise DDoS protection services.
150
Beaconing
Activity sent to a C&C system as part of a botnet or malware remote control system and is typically sent as either HTTP or HTTPS traffic.
151
DNS Fast Flux
Associating multiple IP addresses with a single domain name and changing out those IP addresses rapidly.
152
Jitter
An adversary's use of random delay to frustrate indicators based on regular connection attempt intervals.
153
Irregular Peer-to-Peer Communication
Attack indicator where hosts within a network establish connections over unauthorized ports or data transfers.
154
Server Message Blocks (SMB)
A network protocol used for sharing files, printers, and other resources between devices on a local network or over the internet.
155
ARP Spoofing or ARP Poisoning
Occurs when an attacker redirects an IP address to a MAC address that was not the intended destination.
156
Internet Protocol Security (IPSec)
A secure network protocol suite that authenticates and encrypts packets of data to provide secure encrypted communication between two computers over an Internet Protocol network.
157
Rogue Devices
An unauthorized device or service, such as a wireless access point, DHCP server, or DNS server, on a corporate or private network that allows unauthorized individuals to connect to the network.
158
Wireless Access Point (WAP)
A network device that transmits and revives data over a wireless local area network (WLAN). Relays over 802.11.
159
Dynamic Host Configuration Protocol (DHCP)
A network protocol that automatically assigns and manages IP addresses and other network configuration information to devices within a network.
160
Wireless Sniffing and Discovery
The process of discovering unknown or unidentifiable service set identifiers (SSIDs) showing up within range of an office.
161
Packet Sniffing and Traffic Flow
Processes used to identify the use of unauthorized protocols on the network and unusual peer-to-peer communication flows.
162
Port Scan
Enumerating the states of TCP and UDP ports on a target system using software tools.
163
Fingerprinting
Identifying they type and version of an operating system (or service application) by analyzing its response to network scans.
164
Sweep
A scan directed at multiple IP addresses to discover whether a host responds to connection requests for particular ports.
165
Footprinting
The phase of an attack or penetration test in which the attacker or tester gathers information about the target before attacking it.
166
Well-Known Ports
0-1023
167
Registered Ports
1024-49151
168
Dynamic Ports
49152-65535
169
Non-Standard Port
Communicating TCP/IP application traffic, such as HTTP (80), FTP (21), or DNS (53), over a port that is not the registered or well-known port established for the protocol.
170
Shell
A command-line interface or a program that allows users to interact with the operating system by entering commands.
171
Reverse Shell
An attacker opens a listening port on the remote host and causes the infected host to connect to it. A way to work around firewalls.
172
Netcat (nc)
A versatile networking utility tool that operates at the command line. It can establish and manage network connections making it useful for a variety of tasks such as transferring files, port scanning, banner grabbing, and acting as a simple network server or client.
173
TCP Port 21
File Transfer Protocol (FTP)
174
TCP Port 22
Secure Shell/FTP over SSH (SSH/SFTP)
175
TCP Port 23
TELNET
176
TCP Port 25
Simple Mail Transfer Protocol (SMTP)
177
TCP Port 53
Domain Name System (DNS) used for zone transfers.
178
Zone Transfers
Copies the DNS data from one DNS server to another.
179
TCP Port 80
HTTP
180
TCP Port 110
POP3 (Post Office Protocol)
181
TCP Port 111
RCPBIND
182
TCP Port 139
NetBIOS-SSN
183
TCP/UDP Port 135
MSRPC
184
Microsoft Remote Procedure Call (MSRPC)
A Microsoft protocol that facilitates communication between processes on a Windows network, enabling remote execution of procedures and facilitating distributed computing.
185
NetBIOS (Network Basic Input/Output System)
A networking protocol used for communication between computers on a local network. Replaces by SMB.
186
TCP Port 143
Internet Mail Access Protocol (IMAP)
187
IMAP (Internet Mail Access Protocol)
An internet standard protocol used by email clients to retrieve email messages from a mail server. Replaced POP3.
188
TCP Port 443
HTTPS
189
TCP/UDP Port 445
MICROSOFT-DS
190
Microsoft-Directory Service (DS)
The SMB protocol over port 445 on TCP/IP networks commonly used for file and printer sharing, as well as other networking functionalities in Windows environment.
191
TCP Port 993
Internet Mail Access Protocol Secure (IMAPS)
192
TCP Port 995
POP3S (Post Office Protocol Secure)
193
TCP Port 1723
Point-to-Point Tunneling Protocol
194
TCP Port 3306
MySQL
195
TCP Port 3389
Remote Desktop Access Protocol (RDAP)
196
TCP Port 5900
Virtual Network Computing (VNC)
197
TCP Port 8080
HTTP-PROXY
198
UDP Port 53
Domain Name System (DNS) used for queries
199
UDP Port 67
Dynamic Host Configuration Protocol (DHCP), server port
200
UDP Port 68
Dynamic Host Configuration Protocol (DHCP), client port
201
UDP Port 69
Trivial File Transfer Protocol (TFTP)
202
UDP Port 123
Network Time Protocol (NTP)
203
UDP Port 137
NetBIOS-Name Service (NS)
204
UDP Port 138
NetBIOS-Datagram Service (DGM)
205
UDP Port 139
NetBIOS-Session Service (SSN)
206
UDP Port 161
Simple Network Management Protocol (SNMP)
207
UDP Port 162
SNMP
208
UDP Port 500
Internet Security Association and Key Management Protocol (ISAKMP)
209
UDP Port 514
SYSLOG
210
UDP Port 520
Routing Information Protocol (RIP)
211
UDP Port 631
Internet Printing Protocol (IPP)
212
UDP Port 1434
Microsoft SQL
213
UDP Port 1900
Universal Plug and Play (UPNP)
214
UDP Port 4500
NAT-T-IKE
215
Data Exfiltration
The process by which an attacker takes data that is stored inside of a private network and moves it to an external network.
216
DNS TXT Records
Contains textual information associated with a domain, often used for verification, configuration, or storing additional data for various online services and protocols.
217
DNS CNAME (Canonical)
DNS record that resolves a domain or subdomain to another domain name (example.com, www.example.com)
218
DNS MX Record
Points to the server where emails should be delivered for that domain.
219
Explicit Tunnels
The use of SSH or VPNs to create a tunnel to transmit the data across a given network.
220
Covert Channels
Communication path that allows data to be sent outside of the network without alerting any intrusion detection or data loss countermeasures.
221
Steganography
The practice of concealing data within another file, message, or video.
222
Dynamic Link Library (DLL)
A library that contains code and data that can be used by more than one program at the same time.
223
Performance Monitoring (perfmon)
A Windows tool that monitors a wide range of devices and services, including energy, USB, and disk usage.
224
Resource Monitoring (resmon)
A Windows tool that monitors memory, CPU, and disk usage.
225
System Center Operations Manager (SCOM)
A Window's tool focused on monitoring and maintaining the health, performance, and availability of computer systems, applications, and devices within an enterprise network.
226
tasklist
A Windows command-line utility used to display lists all running processes or tasks on a computer. When executed, it provides information such as the process name, PID, memory usage, process trees, and individual operations for each process.
227
PE Explorer
A Window's proprietary software that has the ability to browse the structure of executable Windows files. It's useful to dig into processes and what they're calling.
228
Deamons
In Linux, are background processes that quietly handle tasks like providing services (e.g., network or printing), run independently of user sessions, and ensure system functionality without needing constant support. Has the letter 'd' after it (hpptd, sshd, ftpd).
229
systemd
The initial deamon in Linux that is the first executed by the kernel during the boot up process and always has the PID of 1.
230
pstree
A Linux command that provides the parent/child relationship of the process on a given system.
231
ps
Command in Linux that is used to display information about currently running processes. Information includes CPU and memory utilization, the time the process was started, how long the process has run, and the command that started the process. Point in time.
232
The Volatility Framework
An open-source memory forensics tool that has many different modules for analyzing specific elements of memory such as a web browser module, command prompt history module, and others.
233
Task Manager
A component in the Window's operating system (OS) that help administrators and end users monitor, manage, and trouble shoot tasks. It provides information about running processes, performance metrics, and allows users to manage applications. You can see a list of all running programs, their resource usage (CPU and memory), and perform actions like ending tasks or launching new applications.
234
free
A Linux command that outputs the amount of used and freely available memory on the computer.
235
top
A Linux command that provides CPU utilization under CPU stats and also shows memory usage as well as other details about running processes. It also provides interaction via hotkeys, including allowing quick identification of top consumers by entering A. Dynamic.
236
w
A Linux command that indicates which accounts are logged in.
237
df
A Linux command that displays a report of the system's disk usage and available space, with various flags providing additional or formatting.
238
dig
A Linux DNS lookup tool that provides detailed information about DNS queries, including domain name resolution, IP addresses, and other related DNS records.
239
dir
dir/Ax
dir/Q
A Windows command-line utility used to display a list of files and directories within a specific directory. It provides information such as file names, sizes, and modification dates.
Filters all file/folder types that match the given parameter (x).
Displays who owns each file, along with the standard information.
240
lsof
A Linux utility that provides detailed information about files and processes that are currently opened or in a Unix-like system. I can reveal which processes have a particular file open, the type of access they have, and other related details.
241
Data Owner
An individual or entity responsible for making decisions regarding the use, and protection of a dataset, typically holding legal or organizational authority over the data.
242
Data Steward
A person or team responsible for managing and ensuring the quality, integrity, and compliance of data throughout its lifecycle, often acting as a liaison between data owners and users.
243
Data Custodian
The role or entity responsible for the physical storage, maintenance, and security of data, ensuring that it is stored and processed in accordance with established policies and procedures.
244
Tokenization
Replaces sensitive values with a unique identifier using a lookup table.
245
Masking
Partially redacts sensitive information by replacing some or all sensitive fields with blank characters.
246
Pretexting
A type of social engineering attack that involves a situation, or pretext, created by an attacker in order to lure a victim into a vulnerable situation and to trick them into giving private information.
247
Telnet
A network protocol that allows users to access and manage remote computer systems over a network, providing a text-based interface for command-line interaction.
248
Rapid Application Development (RAD) Model
An application model that is an iterative process and relies on building prototypes. There is no planning phase; instead planning is done as the software is written. It involves five phases: business modeling, data modeling, process modeling, application generation, testing and turnover.
249
Secure/Multipurpose Internet Mail Extensions (S/MIME)
A widely accepted protocol for sending digitally signed and encrypted messages. It provides encryption and digital signatures for email messages.
250
DomainKeys Identified Main (DKIM)
An email authentication method that adds a digital signature to email messages, allowing the recipient to verify that the message was sent by the claimed sender and that it has not been altered in transit.
251
Sender Policy Frameworks (SPF)
An email authentication method that allows the owner of a domain to specify which mail servers are authorized to send emails on behalf of that domain.
252
ifconfig
A Linux command that displays information about the network interfaces on your system. It typically shows details such as the IP address, MAC address, networks status, and other related information for each active network interface on your machine.
253
Five security functions described in the NIST framework
Identify, Protect, Detect, Respond, Recover
254
OAuth
An open authorization standard that allows users to share elements of their identity or account information while authenticating via the original identity provider. Relies on access tokens, which are issued are an authorization server and then presented to resource servers like third-party web applications by clients.
255
Single Sign On (SSO)
A system that allows users to access multiple applications or services with a single set of longin credentials.
256
Security Assertion Markup Language (SAML)
An XML-based standard for exchanging authentication and authorization data between parties, typically used in SSO.
257
Role-Based Access Control (RBAC)
A security model where access permissions are assigned based on roles, and individuals are assigned to those roles, simplifying the management of permissions by grouping users with similar responsibilities.
258
Attribute-Based Access Controls (ABAC)
A security model that determines access permissions based on a set of attributes with the user, the resource, and the environment.
259
kill
Command used to end a process in Linux.
260
htop
An interactive user-friendly process viewer for Unix-like systems, offering a color-coded and feature-rich interface to monitor and manage system resources and processes.
261
auditctl
A Linux command-line tool used to interact with the Linux Audit Framework, allowing users to configure rules for auditing system events and monitoring activities for security and compliance purposes.
262
Succession Planning
A security control designed to create a pool of reserve candidates ready to step into positions when a vacancy occurs. It is an important continuity control.
263
DNS Zone Transfer
The process of copying or replicating DNS data (such as domain records) from one DNS server to another, facilitating the synchronization of information across multiple servers.
