Threats
5 / 75 · physical-iotEvil Twin
A fake Wi-Fi network, known as an evil twin, imitates a legitimate wireless network so that users connect to an access point the attacker controls. The network name looks familiar, the signal can be stronger, and the device often suggests or restores the connection by itself.
IoT Device Compromise
IoT device compromise hits cameras, routers, sensors, smart televisions, locks, controllers and all the equipment connected to a network that does not behave like a classic computer. The problem is that these devices are often forgotten the moment they are switched on.
Physical Access Attack
Physical access is the oldest form of compromise: the attacker reaches the device, the room, a port, a cable or a piece of paper. Once somebody can sit down at a computer, walk up to a server, put a device into a port or carry a laptop away, digital protection no longer helps.
SCADA/OT Attack
An attack on SCADA and OT systems targets industrial processes, not only data. These are the systems that run manufacturing, energy, water, transport, buildings, sensors, PLC controllers and HMI stations. When such a system stops or starts working wrongly, the consequences can be fatal.
USB Drop Attack
A USB drop attack uses human curiosity and the habit of plugging an unknown device into a computer to see what is on it. The attacker leaves a USB stick or device where an employee will notice it: a car park, a corridor, a reception desk, a meeting room, a bag of promotional material.
Techniques
46 pojmovaAccess Token Manipulation
Token abuse involves stealing or manipulating authentication tokens, session cookies, or access keys to assume the identity of a legitimate user or service. The attacker can use a token without knowing the password.
AiTM
AiTM sits between the user and the real service. Classic phishing steals a password; AiTM steals the live session. The victim gets a link, lands on a proxy that looks exactly like the real login (because it forwards everything to the real site), enters credentials and even the MFA code — the proxy passes them through, the real service issues a session token, and the attacker captures that token.
Automation & Scripting
Automation and scripting involves using scripts, tools, and automated procedures to accelerate and scale activities within a compromised environment. Attackers leverage system scripting interpreters, configuration management tools, and custom scripts.
Brute Force
Brute force as a technique involves the systematic testing of a large number of credential combinations to gain unauthorized access. It includes classic exhaustive testing, dictionary attacks with common passwords, and password spraying.
Cloud lateral movement
In the cloud, identities can assume roles — temporarily take on another identity's rights. It's built for legitimate delegation, but it becomes lateral movement when an attacker who got one identity chains the steps: identity A can become B, B can become C with more rights, C reaches another account. No new password at each step — just inherited delegation.
Command & Control
Command and control communication involves establishing a persistent channel between the attacker and the compromised system for sending commands and receiving results. The attacker uses this channel to manage malware, launch new attack phases, and retrieve data.
Configuration Abuse
Configuration abuse involves exploiting misconfigured systems, services, or security controls. Attackers look for default passwords, overly broad permissions, open ports, and services without authentication.
Container Escape
Containers are meant to isolate an application from the host and from other containers. Container escape is when an attacker controlling a process inside a container breaks that isolation and reaches the host (or other containers). From an application-level foothold they get host-level reach.
Credential Abuse
Credential abuse involves using stolen, leaked, or otherwise obtained login data to gain unauthorized access to systems and services. The attacker impersonates a legitimate user.
DLL Sideloading
Technique of loading a malicious DLL through a legitimate program that requests it.
DNS Tunneling
Technique of exfiltrating data or C2 communication through DNS queries.
Data Destruction
Technique of permanently deleting or corrupting data on a compromised system.
Data Exfiltration
Data exfiltration involves transferring stolen information from the compromised environment to an attacker-controlled location. Data can be sent through encrypted channels, legitimate cloud services, email, or even physical media.
Domain Account Discovery
Mapping users, groups, permissions, and Active Directory structure.
Domain Fronting
Technique of hiding C2 traffic behind legitimate CDN domains.
Double Extortion
Technique where data is first exfiltrated, then encrypted for ransom.
Drive-by Download
Drive-by download is automatic malware download when visiting a compromised site.
Encrypted C2 Channels
Using HTTPS, DNS-over-HTTPS, or other encrypted protocols for C2.
Exploitation
Exploitation involves leveraging a flaw in software, hardware, or configuration to execute unauthorized code or bypass security controls. Vulnerabilities can exist in operating systems, applications, network services, or firmware.
Fast-Flux DNS
Rapid rotation of IP addresses associated with a C2 domain.
Forge Kerberos Tickets
A set of techniques exploiting the Kerberos protocol in Active Directory.
Impair Defenses
Defense evasion encompasses techniques by which an attacker conceals their activity from security tools, analysts, and automated detection systems. The goal is to remain undetected for as long as possible in the compromised environment.
In-Memory Execution
Executing malicious code in memory without writing files to disk.
Indicator Removal
A set of techniques for hindering or preventing digital forensics.
Lateral Movement
Lateral movement involves an attacker moving from one compromised system to another within the same network. The goal is to expand access to systems containing more valuable data or enabling further escalation.
Living off the Land
Using legitimate system tools to execute malicious actions.
Log Tampering
Deleting, modifying, or disabling logs to hide activity.
Malware Delivery
Malware delivery encompasses the methods by which malicious software is transferred to a target system. This includes infected attachments, compromised websites, malicious ads, removable media, and compromised software updates.
Network Sniffing
Passively intercepting network traffic to collect sensitive data.
OSINT
Gathering information about targets from publicly available sources before an attack.
Pass-the-Hash
Using NTLM hashes instead of plaintext passwords for authentication.
Payload Obfuscation
Payload obfuscation involves applying techniques to conceal the content and intent of malicious code. Attackers use encryption, compression, encoding, polymorphism, and packing to evade detection by security tools.
Persistence
Persistence encompasses techniques by which an attacker ensures their access or malicious code survives system reboots, password changes, or other interruptions. The goal is to maintain a foothold in the environment over an extended period.
Phishing
Phishing as a technique involves sending fraudulent emails, SMS messages, or chat messages to trick the victim into clicking a malicious link, opening an infected attachment, or entering credentials on a fake page.
Physical Access
Using physical access to a device or space as an attack vector.
Privilege Escalation
Privilege escalation is a technique by which an attacker with limited access gains a higher level of authorization. Vertical escalation means reaching administrator or root level, while horizontal escalation means accessing another user's resources at the same privilege level.
Process Injection
Injecting malicious code into the address space of a legitimate process.
Reconnaissance
Reconnaissance involves the systematic gathering of information about the target environment, both externally before the attack and internally after compromise. The goal is to understand the topology, identify targets, and plan the next stages.
Resource Exhaustion
Resource exhaustion as a technique involves deliberately overloading target systems to make them unavailable to legitimate users. The attacker targets CPU, memory, network bandwidth, disk, or connection limits.
Rootkit Installation
Technique of installing a rootkit to deeply hide presence on a system.
Service Abuse
Service abuse as a technique involves using legitimate system functionalities in unintended ways to cause damage, gain unauthorized access, or achieve financial gain.
Social Engineering
Social engineering as a technique involves manipulating human behavior to obtain information, access, or the execution of actions that benefit the attacker. It relies on trust, authority, urgency, or fear.
Supply Chain Compromise
Technique of injecting malicious code into the software supply chain.
Timestomping
Changing file timestamps to hide when they were created or modified.
Watering Hole
Technique of compromising websites that the target group regularly visits.
Website Defacement
Unauthorized modification of website content to send a message.
Defenses
45 pojmovaBackup & Recovery
Backup and recovery encompasses the processes and technologies for regularly creating copies of data and systems, storing them securely, and enabling reliable restoration in the event of loss, corruption, or destruction of original data.
Browser Isolation
Executing web content in an isolated environment separate from the local system.
CSPM
CSPM continuously checks how the cloud environment is configured against good-practice and compliance rules: which buckets are public, which identities hold too many rights, where encryption is off, where logging is off. Instead of someone clicking manually through the console, the tool watches the whole account or subscription and flags when a setting drifts into danger.
Certificate Management
Managing the lifecycle of digital certificates — issuance, renewal, revocation.
DDoS Protection
DDoS protection encompasses technologies and services that detect and mitigate distributed denial-of-service attacks before malicious traffic reaches or overwhelms the target infrastructure.
DLP
DLP watches where sensitive data goes and stops it where it shouldn't: an employee attaching a client list to a private email, copying a file with personal data to a USB, or pasting a database into a chat. It works by recognizing patterns (national IDs, card numbers, marked documents) and applying rules per channel — mail, web, endpoint, cloud.
DNS Security
DNS security encompasses technologies that protect DNS infrastructure and use DNS traffic as a control point for blocking access to malicious domains and detecting suspicious communications.
Data Encryption
Protecting data by encrypting it at rest and in transit.
Deception Technology
Deploying decoy resources (honeypots, honeytokens) to detect attackers.
DevSecOps
Integrating security into all phases of the software development lifecycle.
Digital Forensics
Collecting, preserving, and analyzing digital evidence after a cyber incident.
EDR
EDR (Endpoint Detection and Response) is a technology that continuously monitors endpoint activity, records events, and enables detection, investigation, and response to threats that bypassed preventive controls.
Email Security
Email security encompasses technologies that filter inbound and outbound messages to prevent phishing, malware delivery, and business email compromise. It operates at the server or cloud level before the message reaches the user.
Endpoint Protection
Endpoint protection encompasses software solutions that protect computers, servers, and mobile devices from malicious software and unauthorized activities. It combines classic signature-based malware detection with heuristic analysis and behavior-based detection.
Firewall
A firewall is a control placed at the boundary between networks that permits or blocks traffic according to predefined rules — deciding who may talk to whom, on which ports and protocols.
IDS/IPS
IDS/IPS are systems that monitor network traffic (or host activity) for patterns indicating an attack. An IDS (Intrusion Detection System) only reports suspicious activity; an IPS (Intrusion Prevention System) sits inline and can block it immediately.
Identity & Access Management
Identity and access management encompasses the policies, processes, and technologies for creating, managing, and revoking digital identities and their access rights. The goal is to ensure the right users have the right access to the right resources at the right time.
Incident Response
A planned process of identifying, containing, eradicating, and recovering from cyber incidents.
Logging & Monitoring
Logging and monitoring involves the systematic recording of activities and events on systems, networks, and applications, along with regular analysis of those records to detect anomalies and security incidents.
MDR
MDR (Managed Detection and Response) is a service where an external security team provides continuous monitoring, threat detection, and incident response on behalf of an organization. It combines technology with human expertise.
Microsegmentation
Finer network division at workload or application level, not just VLANs.
Mobile Device Security
Managing and protecting mobile devices through MDM and MAM solutions.
Multi-Factor Authentication
Multi-factor authentication requires two or more independent proofs of identity at login. It typically combines something the user knows (password), something they possess (phone, hardware key), and something they are (biometrics).
Network Segmentation
Network segmentation is the practice of dividing network infrastructure into smaller, isolated segments with controlled communication between them. The goal is to limit an attacker's ability to move through the network after compromising a single system.
Password Manager
Tool for generating, storing, and auto-filling strong, unique passwords.
Patch Management
Patch management is the process of identifying, testing, and applying software updates that fix known vulnerabilities. The goal is to reduce the time window in which an attacker can exploit a known weakness.
Penetration Testing
Simulation of real attacks to identify vulnerabilities that automated tools miss.
Phishing Simulations
Regular testing of employees with simulated phishing messages.
Privileged Access Management
Privileged access management controls, monitors, and records the use of accounts with elevated permissions such as administrator accounts, service accounts, and root access. These accounts are the most valuable targets for attackers as they provide broad access to critical systems.
Regulatory Compliance
Meeting requirements of regulatory frameworks and standards for cybersecurity.
Risk Assessment
Systematic process of identifying, analyzing, and prioritizing cyber risks.
SIEM
SIEM (Security Information and Event Management) is a system that collects logs and events from diverse sources across the entire infrastructure, centralizes them, and applies correlation rules to detect suspicious patterns and security incidents.
SOAR
Security Orchestration, Automation and Response — automating security operations.
SPF/DKIM/DMARC
By default, anyone can put your domain in the sender field — that's how spoofed mail 'from the director' works. SPF, DKIM, and DMARC are three records you publish for your domain that let a recipient check whether mail claiming to be from you actually came from your systems. SPF says which servers may send for you, DKIM signs the message, and DMARC tells the recipient what to do with mail that fails the check and sends you reports.
Secrets Management
Applications, scripts, and services need secrets to do their work — passwords, API keys, certificates, database connection strings. The wrong place for them is code, a config file, a repository, or a chat message. Secrets management means a central, protected store (a vault) from which an application fetches a secret exactly when it needs it, instead of carrying it around in plaintext.
Secure Configuration
Secure configuration involves applying established security baselines to all systems, services, and applications in an organization. The goal is to reduce the attack surface by eliminating unnecessary functions, default passwords, and insecure settings.
Security Awareness
Employee education programs about cyber threats and safe behavior.
Security Champions
An ambassador program for security within development and business teams.
Security Policies
Formal documents defining an organization's cybersecurity rules and standards.
Threat Intelligence
Collecting, analyzing, and applying data about current cyber threats.
Virtual Private Network
A VPN (virtual private network) creates an encrypted tunnel between a device and the network it connects to. For an organization this primarily means controlled remote access to internal resources — from home, on the road, in the field. Traffic inside the tunnel cannot be read in transit, even on hotel Wi-Fi.
Vulnerability Management
Continuous process of discovering, classifying, prioritizing, and remediating vulnerabilities.
WAF
WAF (Web Application Firewall) is a firewall that filters, monitors, and blocks HTTP/HTTPS traffic to web applications. It sits between users and the web server, analyzing each request against defined rules.
XDR
XDR (Extended Detection and Response) unifies data from endpoints, network, email, and cloud.
Zero Trust
Zero Trust is a security concept that assumes no user, device, or network segment should be automatically trusted, regardless of whether it is inside or outside the corporate network. Every access request is verified before approval.