Exploring Threat Intelligence and Threat Hunting Concepts Flashcards
Advanced Persistent
Threat actors with the ability to craft novel exploits and techniques to obtain, maintain, and diversify unauthorized access to network systems over a long period.
Virus
Malicious code inserted into an executable file image. The malicious code is executed when the file is run and can deliver a payload, such as attempting to infect other files.
Command and Control
Infrastructure of hosts and services with which attackers direct, distribute, and control malware over botnets
Exploits
A specific method by which malware code infects a target host, often via some vulnerability in a software process.
Metasploit
A platform for launching modularized attacks against known software vulnerabilities
Tactics, techniques, and procedures (TTPs)
TTPs are the methods used to conduct an action, such as performing an attack, and can be beneficial when attempting to ascertain attack patterns.
User and Entity Behavior Analytics(UEBA)
A system that can provide automated identification of suspicious activity by user accounts and computer hosts.
Adversarial Tactics, Techniques, and Common Knowledge(ATT&CK)
A knowledge base maintained by the MITRE Corporation for listing and explaining specific adversary tactics, techniques, and procedures.
Open-source Intelligence(OSINT)
Publicly available information plus the tools used to aggregate and search it
Information Sharing and Analysis Centers(ISACs)
A not-for-profit group set up to share sector-specific threat intelligence and security best practices among its members.
Confidence Level
A metric that helps rank or score threat intelligence to help isolate highly applicable or highly likely threat intelligence
Threat Hunting
A cybersecurity technique designed to detect presence of threats that have not been discovered by normal security monitoring.
Cyber Threat Intelligence
The process of investigating, collecting, analyzing, and disseminating information about emerging threats and threat sources.
Indicators of Attack(IoAs)
Signs or clues indicating a malicious attack on a system or network is currently occurring. These include, but are not limited to, unusual network traffic, strange log file entries, or suspicious user account activity.
Crowdsourced
A process in which a large group of individuals, usually from the public, are asked to contribute to a project or task. It often involves the collection of ideas, information, opinions, or feedback from a wide range of people, typically through an online platform.
