Indicators of Attacks Flashcards
Virus
Viruses are malicious programs that must be triggered by the activation of their host; objective is to spread.
Worm
Worms are stand-alone malicious programs that can self-replicate and propagate independently as soon as they have breached the system.
Ransomeware
Ransomware is a form of malware that encrypts a victim’s files. The attacker then demands a ransom from the victim to restore access to the data upon payment. Ransomware requires that someone pay the ransom.
Crypto-malware
Crypto-malware can operate indefinitely on a system, benefiting the criminal without the victim having to do anything, and may never be noticed.
Malware
Malicious Software
Trojan
A Trojan horse, or Trojan, is a type of malicious code or software that looks legitimate but can take control of your computer. A Trojan is designed to damage, disrupt, steal, or in general inflict some other harmful action on your data or network. A Trojan acts like a bona fide application or file to trick you.
RAT
A Remote Access Trojan (RAT) is a type of malware that allows covert surveillance, a backdoor for administrative control and unfettered and unauthorized remote access to a victim’s machine. The RAT is very dangerous because it enables intruders to get remote control of the compromised computer.
Bot
A botnet is a collection of internet-connected devices (IoT devices) infected by malware that allow hackers to control them. Cyber criminals use botnets to instigate botnet attacks, which include malicious activities such as credentials leaks, unauthorized access, data theft and DDoS attacks.
Command and Control
A command-and-control [C&C] server is a computer controlled by an attacker or cybercriminal which is used to send commands to systems compromised by malware and receive stolen data from a target network. It can be used to disseminate commands that can steal data, spread malware, disrupt web services, and more. Runs the botnet.
Fileless Virus
Fileless malware is a type of malicious software that uses legitimate programs to infect a computer. It does not rely on files and leaves no footprint, making it challenging to detect and remove. Stays in RAM.
Logic Bomb
A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met.
Spyware
Spyware describes software with malicious behavior that aims to gather information about a person or organization and send such information to another entity in a way that harms the user.
Rootkit
A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed and often masks its existence or the existence of other software. Root privilege’s on the computer.
Backdoor
A backdoor is a malware type that negates normal authentication procedures to access a system. As a result, remote access is granted to resources within an application, such as databases and file servers, giving perpetrators the ability to remotely issue system commands and update malware.
Adversarial Artificial Intelligence
Adversarial AI is a technique employed in the field of artificial intelligence which attempts to fool models through malicious input. This technique can be applied for a variety of reasons, the most common being to attack or cause a malfunction in standard AI models.
Adversarial Artificial Intelligence: Evasion
Evasion attacks are the most prevalent type of attack.. Samples are modified to evade detection; that is, to be classified as legitimate. This does not involve influence over the training data. A clear example of evasion is image-based spam in which the spam content is embedded within an attached image to evade textual analysis by anti-spam filters. Another example of evasion is given by spoofing attacks against biometric verification systems.
Adversarial Artificial Intelligence: Poisoning
Poisoning is adversarial contamination of training data. Machine learning systems can be re-trained using data collected during operations. For instance, intrusion detection systems (IDSs) are often re-trained using such data. An attacker may poison this data by injecting malicious samples during operation that subsequently disrupt retraining.
Adversarial Artificial Intelligence: Model Stealing
Model stealing (also called model extraction) involves an adversary probing a black box machine learning system in order to either reconstruct the model or extract the data it was trained on. This can cause issues when either the training data or the model itself is sensitive and confidential. For example, model stealing could be used to extract a proprietary stock trading model which the adversary could then use for their own financial benefit.
Malicious USB Cables
A malicious cable is any cable (electrical or optical) which performs an unexpected, and unwanted function. The most common malicious capabilities are found in USB cables. Data exfiltration, GPS tracking, and audio eavesdropping are the primary malicious functions.
Malicious USB Drives
Malicious USB sticks are leveraged where an attacker needs physical access to a computer. In the most basic of USB drop attacks, the user clicks on one of the files on the drive.
