Domain 1 Flashcards
Threats, Attacks & Vulnerabilities
POC
Predictor of Compromise is a signal or warning that an incident may occur in the future.
IOC
Indicator of Compromise is substantive or corroborating evidence* that an incident may have occurred or may be occurring now.
*Specific artefacts (Virus Signature, IP address, malicious URL, C2, file changes).
List Malware characteristics
Transparent Designed to exploit an OS or software vulnerability OS and device agnostic Activates programmatically Responds to commands Often evades scanning
Virus
Types + Objective + Characteristics
Types:
Boot Sector Virus
File Infector Virus
Macro Virus
Objective: Malicious code whose primary function is to replicate and deliver it’s payload.
Characteristics:
Requires user intervention (clicking on a link).
Requires a host to execute and replicate.
Stealth, Memory Resident, Polymorphic, Metamorphic.
Worm
Types + Objective + Characteristics
Types: Crypto C&C APT Bot
Objective: Malicious code that exploits known vulnerabilities.
Characteristics:
Self replicating
Takes advantage of network transport features to spread (email attachments, instant messages, network connections).
Trojan
Types + Objective + Characteristics
Types: RAT Backdoor Downloader Keylogger
Objective: Malicious code disguised as a legitimate application.
Characteristics:
Spread through user interaction.
Rootkit
Types + Objectives + Characteristics
Types: Firmware Kernel Persistent Application Library
Objective: Malicious code designed to allow a remote user “root” access.
Characteristics:
Embedded in software or hardware.
Very difficult to remove.
Spyware
Types + Objectives + Characteristics
Types: Keylogger Adware Tracking cookies Click fraud
Objective: Code that collects information without consent.
Characteristics:
Can be used to manipulate configuration settings.
Spreads through user interaction.
Programmatic
Types + Objectives + Characteristics
Types:
Backdoor
Logic Bomb
Objective: Created / inserted by application programmers (coders) or publishers.
Characteristics:
Should be removed prior to production release.
Malware Types:
Stealth
Stealth malware is designed to be inconspicuous in order to avoid detection.
Malware Types:
Memory Resident
Memory Resident malware stays resident in memory upon execution can infect other programs running at the same time.
Malware Types:
Armored
Armoured malware hides itself by obfuscation or by adding confusing or unnecessary code.
Malware Types:
Polymorphic
Polymorphic malware evades pattern-matching detection by frequently changing identifiable characteristics like file name, file type or encryption keys.
Malware Types:
Metamorphic
Metamorphic malware is rewritten with each iteration so that each succeeding version of the code is different from the preceding one.
Digital infrastructure attacks:
Poisoning
Description + Technique
Description:
Manipulating a trusted source of data (DNS cache, ARP cache). Enables an attacker to control the trusted source of data.
Techqniue: DNS/ARP cache
Digital infrastructure attacks:
Hijacking
Description + Technique
Description: Intercepting communication between two or more systems. Enables an attacker to eavesdrop, capture, manipulate, and/or reuse data packets.
Techqniue:
MiTM/ MiTB
Replay
Clickjacking
Digital infrastructure attacks:
Denial of Service
Description + Technique
Description: Overwhelming system resources. Enables an attacker to make services unavailable for their intended use.
Technique:
DoS
DDoS
Digital infrastructure attacks:
Code
Description + Technique
Description: Exploiting weaknesses in server or client-side code or applications. Enables an attacker to take control.
Technique:
Injection
XSS
Wireless Attacks - Close Range
Technique: Bluejacking
Target + Description
Target: Bluetooth
Description: Enables an attacker to discover Bluetooth devices and send unsolicited/unwanted messages.
