Threats
11 / 75 · identityAccount Takeover
Account takeover is the moment the attacker gains full control of an account — not only access, but the ability to change the password, the recovery mail address, the phone number and the second factor, while the real owner is shut out with no technical way back in on their own. Takeover is rarely the first stage of an attack. It is usually the destination of what came before: phishing, credential stuffing, token theft.
Brute-force attack
A brute-force attack breaks into an account by trying to log in over and over: automated tools work through password after password until one takes. It succeeds against short, weak and common passwords, and against systems that put no limit on failed attempts. It is not clever — it is only fast, and it can run for days.
Credential stuffing
Credential stuffing does not go after unknown passwords; it tries known ones. With username and password pairs from databases leaked across the internet, the attacker tries the most-used services such as Facebook and Instagram, counting on people reusing the same credentials on several services — which in most cases holds.
Kerberoasting
Kerberoasting is an attack specific to Windows domain networks and Active Directory (AD). User logins are handled by the Kerberos protocol, which issues tickets as proof of identity. In a domain environment there are non-user accounts — service accounts — under which most background tasks and services run, such as databases and business applications. Service accounts are set up so that any user can request a ticket for access to a given service. The catch is that the ticket is encrypted with the service account's password.
MFA Fatigue
MFA fatigue is social-engineering pressure applied to two-factor authentication. The attacker has the password, leaked or phished, but is stopped at the second factor — a confirmation the user has to approve on their phone. So the attacker starts the login over and over, burying the phone in approval requests. The arithmetic is simple: out of irritation, confusion, or the thought that it must be some glitch, the user approves one at some point — and the attacker is through the whole authentication.
Pass-the-Hash
So that it does not keep the password in readable form, Windows remembers its cryptographic fingerprint — the hash. With older Windows authentication (NTLM), the password is not required to prove identity; the hash is enough. Pass-the-hash abuses exactly that: if the attacker obtains a user's hash, they can log in with it without ever learning the real password.
Password spraying
Password spraying is brute force turned around. Instead of trying many passwords on one account, the attacker tries common passwords across many accounts. That avoids lockout, because each individual account sees only an attempt or two.
Privilege Escalation
Privilege escalation is the attempt by an attacker who already holds some level of access to widen their rights in order to move through the network. Escalation is rarely the first stage — it comes after entry through, say, an ordinary user account or a compromised service. It takes the attacker from the crack they slipped through to control of the whole system. There are two directions: vertical escalation, from an ordinary user to domain administrator, and horizontal, moving from one account to another user's resources at the same level of rights.
SIM Swapping
SIM swapping does not attack the phone but the phone number. The attacker persuades, or bribes, a mobile operator to move the number to a new SIM card, citing a lost phone or a damaged card. They usually come armed with personal details from leaked databases and phishing. The moment the number moves to their card, the real phone loses signal and every call and message goes to the attacker.
Session Hijacking
When you log in, the service opens a session — a state that remembers you are you, together with everything that goes with it, such as your preferences and settings. The main benefit is that you do not have to type a password every few minutes as you move through the features. That session is marked by an identifier, usually held in a browser cookie. Session hijacking is the taking over of a session that is already open. The attacker does not attack the login; they slip into a session that has already passed authentication and carry on operating the service in your name.
Token Theft
A token is proof that you have already logged in. When you sign in and confirm your identity with a second factor, the service issues a token, stored in the browser, which vouches that you have already been checked the next time round. The token is sent automatically with every further request, so you do not have to type the password again. Token theft is the taking of that proof. With it in hand, the attacker presents themselves as you — without your password and without the second factor, because both have already been approved.
Techniques
46 pojmovaAccess Token Manipulation
Token abuse involves stealing or manipulating authentication tokens, session cookies, or access keys to assume the identity of a legitimate user or service. The attacker can use a token without knowing the password.
AiTM
AiTM sits between the user and the real service. Classic phishing steals a password; AiTM steals the live session. The victim gets a link, lands on a proxy that looks exactly like the real login (because it forwards everything to the real site), enters credentials and even the MFA code — the proxy passes them through, the real service issues a session token, and the attacker captures that token.
Automation & Scripting
Automation and scripting involves using scripts, tools, and automated procedures to accelerate and scale activities within a compromised environment. Attackers leverage system scripting interpreters, configuration management tools, and custom scripts.
Brute Force
Brute force as a technique involves the systematic testing of a large number of credential combinations to gain unauthorized access. It includes classic exhaustive testing, dictionary attacks with common passwords, and password spraying.
Cloud lateral movement
In the cloud, identities can assume roles — temporarily take on another identity's rights. It's built for legitimate delegation, but it becomes lateral movement when an attacker who got one identity chains the steps: identity A can become B, B can become C with more rights, C reaches another account. No new password at each step — just inherited delegation.
Command & Control
Command and control communication involves establishing a persistent channel between the attacker and the compromised system for sending commands and receiving results. The attacker uses this channel to manage malware, launch new attack phases, and retrieve data.
Configuration Abuse
Configuration abuse involves exploiting misconfigured systems, services, or security controls. Attackers look for default passwords, overly broad permissions, open ports, and services without authentication.
Container Escape
Containers are meant to isolate an application from the host and from other containers. Container escape is when an attacker controlling a process inside a container breaks that isolation and reaches the host (or other containers). From an application-level foothold they get host-level reach.
Credential Abuse
Credential abuse involves using stolen, leaked, or otherwise obtained login data to gain unauthorized access to systems and services. The attacker impersonates a legitimate user.
DLL Sideloading
Technique of loading a malicious DLL through a legitimate program that requests it.
DNS Tunneling
Technique of exfiltrating data or C2 communication through DNS queries.
Data Destruction
Technique of permanently deleting or corrupting data on a compromised system.
Data Exfiltration
Data exfiltration involves transferring stolen information from the compromised environment to an attacker-controlled location. Data can be sent through encrypted channels, legitimate cloud services, email, or even physical media.
Domain Account Discovery
Mapping users, groups, permissions, and Active Directory structure.
Domain Fronting
Technique of hiding C2 traffic behind legitimate CDN domains.
Double Extortion
Technique where data is first exfiltrated, then encrypted for ransom.
Drive-by Download
Drive-by download is automatic malware download when visiting a compromised site.
Encrypted C2 Channels
Using HTTPS, DNS-over-HTTPS, or other encrypted protocols for C2.
Exploitation
Exploitation involves leveraging a flaw in software, hardware, or configuration to execute unauthorized code or bypass security controls. Vulnerabilities can exist in operating systems, applications, network services, or firmware.
Fast-Flux DNS
Rapid rotation of IP addresses associated with a C2 domain.
Forge Kerberos Tickets
A set of techniques exploiting the Kerberos protocol in Active Directory.
Impair Defenses
Defense evasion encompasses techniques by which an attacker conceals their activity from security tools, analysts, and automated detection systems. The goal is to remain undetected for as long as possible in the compromised environment.
In-Memory Execution
Executing malicious code in memory without writing files to disk.
Indicator Removal
A set of techniques for hindering or preventing digital forensics.
Lateral Movement
Lateral movement involves an attacker moving from one compromised system to another within the same network. The goal is to expand access to systems containing more valuable data or enabling further escalation.
Living off the Land
Using legitimate system tools to execute malicious actions.
Log Tampering
Deleting, modifying, or disabling logs to hide activity.
Malware Delivery
Malware delivery encompasses the methods by which malicious software is transferred to a target system. This includes infected attachments, compromised websites, malicious ads, removable media, and compromised software updates.
Network Sniffing
Passively intercepting network traffic to collect sensitive data.
OSINT
Gathering information about targets from publicly available sources before an attack.
Pass-the-Hash
Using NTLM hashes instead of plaintext passwords for authentication.
Payload Obfuscation
Payload obfuscation involves applying techniques to conceal the content and intent of malicious code. Attackers use encryption, compression, encoding, polymorphism, and packing to evade detection by security tools.
Persistence
Persistence encompasses techniques by which an attacker ensures their access or malicious code survives system reboots, password changes, or other interruptions. The goal is to maintain a foothold in the environment over an extended period.
Phishing
Phishing as a technique involves sending fraudulent emails, SMS messages, or chat messages to trick the victim into clicking a malicious link, opening an infected attachment, or entering credentials on a fake page.
Physical Access
Using physical access to a device or space as an attack vector.
Privilege Escalation
Privilege escalation is a technique by which an attacker with limited access gains a higher level of authorization. Vertical escalation means reaching administrator or root level, while horizontal escalation means accessing another user's resources at the same privilege level.
Process Injection
Injecting malicious code into the address space of a legitimate process.
Reconnaissance
Reconnaissance involves the systematic gathering of information about the target environment, both externally before the attack and internally after compromise. The goal is to understand the topology, identify targets, and plan the next stages.
Resource Exhaustion
Resource exhaustion as a technique involves deliberately overloading target systems to make them unavailable to legitimate users. The attacker targets CPU, memory, network bandwidth, disk, or connection limits.
Rootkit Installation
Technique of installing a rootkit to deeply hide presence on a system.
Service Abuse
Service abuse as a technique involves using legitimate system functionalities in unintended ways to cause damage, gain unauthorized access, or achieve financial gain.
Social Engineering
Social engineering as a technique involves manipulating human behavior to obtain information, access, or the execution of actions that benefit the attacker. It relies on trust, authority, urgency, or fear.
Supply Chain Compromise
Technique of injecting malicious code into the software supply chain.
Timestomping
Changing file timestamps to hide when they were created or modified.
Watering Hole
Technique of compromising websites that the target group regularly visits.
Website Defacement
Unauthorized modification of website content to send a message.
Defenses
45 pojmovaBackup & Recovery
Backup and recovery encompasses the processes and technologies for regularly creating copies of data and systems, storing them securely, and enabling reliable restoration in the event of loss, corruption, or destruction of original data.
Browser Isolation
Executing web content in an isolated environment separate from the local system.
CSPM
CSPM continuously checks how the cloud environment is configured against good-practice and compliance rules: which buckets are public, which identities hold too many rights, where encryption is off, where logging is off. Instead of someone clicking manually through the console, the tool watches the whole account or subscription and flags when a setting drifts into danger.
Certificate Management
Managing the lifecycle of digital certificates — issuance, renewal, revocation.
DDoS Protection
DDoS protection encompasses technologies and services that detect and mitigate distributed denial-of-service attacks before malicious traffic reaches or overwhelms the target infrastructure.
DLP
DLP watches where sensitive data goes and stops it where it shouldn't: an employee attaching a client list to a private email, copying a file with personal data to a USB, or pasting a database into a chat. It works by recognizing patterns (national IDs, card numbers, marked documents) and applying rules per channel — mail, web, endpoint, cloud.
DNS Security
DNS security encompasses technologies that protect DNS infrastructure and use DNS traffic as a control point for blocking access to malicious domains and detecting suspicious communications.
Data Encryption
Protecting data by encrypting it at rest and in transit.
Deception Technology
Deploying decoy resources (honeypots, honeytokens) to detect attackers.
DevSecOps
Integrating security into all phases of the software development lifecycle.
Digital Forensics
Collecting, preserving, and analyzing digital evidence after a cyber incident.
EDR
EDR (Endpoint Detection and Response) is a technology that continuously monitors endpoint activity, records events, and enables detection, investigation, and response to threats that bypassed preventive controls.
Email Security
Email security encompasses technologies that filter inbound and outbound messages to prevent phishing, malware delivery, and business email compromise. It operates at the server or cloud level before the message reaches the user.
Endpoint Protection
Endpoint protection encompasses software solutions that protect computers, servers, and mobile devices from malicious software and unauthorized activities. It combines classic signature-based malware detection with heuristic analysis and behavior-based detection.
Firewall
A firewall is a control placed at the boundary between networks that permits or blocks traffic according to predefined rules — deciding who may talk to whom, on which ports and protocols.
IDS/IPS
IDS/IPS are systems that monitor network traffic (or host activity) for patterns indicating an attack. An IDS (Intrusion Detection System) only reports suspicious activity; an IPS (Intrusion Prevention System) sits inline and can block it immediately.
Identity & Access Management
Identity and access management encompasses the policies, processes, and technologies for creating, managing, and revoking digital identities and their access rights. The goal is to ensure the right users have the right access to the right resources at the right time.
Incident Response
A planned process of identifying, containing, eradicating, and recovering from cyber incidents.
Logging & Monitoring
Logging and monitoring involves the systematic recording of activities and events on systems, networks, and applications, along with regular analysis of those records to detect anomalies and security incidents.
MDR
MDR (Managed Detection and Response) is a service where an external security team provides continuous monitoring, threat detection, and incident response on behalf of an organization. It combines technology with human expertise.
Microsegmentation
Finer network division at workload or application level, not just VLANs.
Mobile Device Security
Managing and protecting mobile devices through MDM and MAM solutions.
Multi-Factor Authentication
Multi-factor authentication requires two or more independent proofs of identity at login. It typically combines something the user knows (password), something they possess (phone, hardware key), and something they are (biometrics).
Network Segmentation
Network segmentation is the practice of dividing network infrastructure into smaller, isolated segments with controlled communication between them. The goal is to limit an attacker's ability to move through the network after compromising a single system.
Password Manager
Tool for generating, storing, and auto-filling strong, unique passwords.
Patch Management
Patch management is the process of identifying, testing, and applying software updates that fix known vulnerabilities. The goal is to reduce the time window in which an attacker can exploit a known weakness.
Penetration Testing
Simulation of real attacks to identify vulnerabilities that automated tools miss.
Phishing Simulations
Regular testing of employees with simulated phishing messages.
Privileged Access Management
Privileged access management controls, monitors, and records the use of accounts with elevated permissions such as administrator accounts, service accounts, and root access. These accounts are the most valuable targets for attackers as they provide broad access to critical systems.
Regulatory Compliance
Meeting requirements of regulatory frameworks and standards for cybersecurity.
Risk Assessment
Systematic process of identifying, analyzing, and prioritizing cyber risks.
SIEM
SIEM (Security Information and Event Management) is a system that collects logs and events from diverse sources across the entire infrastructure, centralizes them, and applies correlation rules to detect suspicious patterns and security incidents.
SOAR
Security Orchestration, Automation and Response — automating security operations.
SPF/DKIM/DMARC
By default, anyone can put your domain in the sender field — that's how spoofed mail 'from the director' works. SPF, DKIM, and DMARC are three records you publish for your domain that let a recipient check whether mail claiming to be from you actually came from your systems. SPF says which servers may send for you, DKIM signs the message, and DMARC tells the recipient what to do with mail that fails the check and sends you reports.
Secrets Management
Applications, scripts, and services need secrets to do their work — passwords, API keys, certificates, database connection strings. The wrong place for them is code, a config file, a repository, or a chat message. Secrets management means a central, protected store (a vault) from which an application fetches a secret exactly when it needs it, instead of carrying it around in plaintext.
Secure Configuration
Secure configuration involves applying established security baselines to all systems, services, and applications in an organization. The goal is to reduce the attack surface by eliminating unnecessary functions, default passwords, and insecure settings.
Security Awareness
Employee education programs about cyber threats and safe behavior.
Security Champions
An ambassador program for security within development and business teams.
Security Policies
Formal documents defining an organization's cybersecurity rules and standards.
Threat Intelligence
Collecting, analyzing, and applying data about current cyber threats.
Virtual Private Network
A VPN (virtual private network) creates an encrypted tunnel between a device and the network it connects to. For an organization this primarily means controlled remote access to internal resources — from home, on the road, in the field. Traffic inside the tunnel cannot be read in transit, even on hotel Wi-Fi.
Vulnerability Management
Continuous process of discovering, classifying, prioritizing, and remediating vulnerabilities.
WAF
WAF (Web Application Firewall) is a firewall that filters, monitors, and blocks HTTP/HTTPS traffic to web applications. It sits between users and the web server, analyzing each request against defined rules.
XDR
XDR (Extended Detection and Response) unifies data from endpoints, network, email, and cloud.
Zero Trust
Zero Trust is a security concept that assumes no user, device, or network segment should be automatically trusted, regardless of whether it is inside or outside the corporate network. Every access request is verified before approval.