Search: agent — Cyber Encyclopedia

166 terms · 75/46/45

49 rezultata za „agent" · 2 direktna · 47 povezanih

Pretnje

1 direktan pogodak

№ 072
Prompt injection … hidden in a document, a web page or an email the agent reads. The victim often never sees the instruction, but the model will process it.
pretnja · AI / ML

Odbrane

1 direktan pogodak

№ 003
EDR EDR (Endpoint Detection and Response) is a technology that continuously monitors endpoint activity, records events, and enables detection, investigation, and response to threats that bypassed preventive controls.
odbrana · endpoints

↳ Povezano

47 stavki koje koriste „agent"

№ 027
Automation & Scripting Automation and scripting involves using scripts, tools, and automated procedures to accelerate and scale activities within a compromised environment. Attackers leverage system scripting interpreters, configuration management tools, and custom scripts.
tehnika · discovery
№ 006
Backdoor A backdoor is a hidden way in. Once placed or opened, it lets the attacker return to the machine — with no password, no authorization and no entry in the ordinary records. A backdoor can be opened by malware while it runs, but it can equally be a user account nobody watches, or web shell access left on a server.
pretnja · malware
№ 039
Command & Control Command and control communication involves establishing a persistent channel between the attacker and the compromised system for sending commands and receiving results. The attacker uses this channel to manage malware, launch new attack phases, and retrieve data.
tehnika · C2
№ 026
Configuration Abuse Configuration abuse involves exploiting misconfigured systems, services, or security controls. Attackers look for default passwords, overly broad permissions, open ports, and services without authentication.
tehnika · discovery
№ 013
Cryptominer A cryptominer steals what we rarely think of as a target: our computing power and our electricity. In the background it uses our processors and graphics cards to mine cryptocurrency for the attacker while we pay the bill. It has no interest in our data, only in our resources and how much of them there is.
pretnja · malware
№ 016
DLL Sideloading Technique of loading a malicious DLL through a legitimate program that requests it.
tehnika · execution
№ 034
DLP DLP watches where sensitive data goes and stops it where it shouldn't: an employee attaching a client list to a private email, copying a file with personal data to a USB, or pasting a database into a chat. It works by recognizing patterns (national IDs, card numbers, marked documents) and applying rules per channel — mail, web, endpoint, cloud.
odbrana · resilience
№ 034
Data Destruction Technique of permanently deleting or corrupting data on a compromised system.
tehnika · exfiltration / impact
№ 031
Data Exfiltration Data exfiltration involves transferring stolen information from the compromised environment to an attacker-controlled location. Data can be sent through encrypted channels, legitimate cloud services, email, or even physical media.
tehnika · exfiltration / impact
№ 040
DevSecOps Integrating security into all phases of the software development lifecycle.
odbrana · people
№ 007
Drive-by Download Drive-by download is automatic malware download when visiting a compromised site.
tehnika · initial access
№ 042
Encrypted C2 Channels Using HTTPS, DNS-over-HTTPS, or other encrypted protocols for C2.
tehnika · C2
№ 010
Exploitation Exploitation involves leveraging a flaw in software, hardware, or configuration to execute unauthorized code or bypass security controls. Vulnerabilities can exist in operating systems, applications, network services, or firmware.
tehnika · execution
№ 011
Fileless malware Fileless malware never writes itself to disk during the attack, so antivirus software has a harder time finding it. While it operates it lives in memory and works with tools the system already has — PowerShell, scripts, built-in commands. Because it delivers its payload through legitimate tools, its activity is not easy to tell apart from normal work.
pretnja · malware
№ 009
Identity & Access Management Identity and access management encompasses the policies, processes, and technologies for creating, managing, and revoking digital identities and their access rights. The goal is to ensure the right users have the right access to the right resources at the right time.
odbrana · identity / access
№ 012
Impair Defenses Defense evasion encompasses techniques by which an attacker conceals their activity from security tools, analysts, and automated detection systems. The goal is to remain undetected for as long as possible in the compromised environment.
tehnika · execution
№ 014
In-Memory Execution Executing malicious code in memory without writing files to disk.
tehnika · execution
№ 046
Indicator Removal A set of techniques for hindering or preventing digital forensics.
tehnika · evasion
№ 012
Infostealer An infostealer has one basic role: to collect your credentials. Saved browser passwords, cookies and session tokens, autofill data, crypto wallet keys — all of it is of interest. It stays in contact with the attacker and sends on what it gathers. When the job is done it can delete itself and disappear.
pretnja · malware
№ 004
Keylogger A keylogger is a program or hardware device that records every keystroke. Software keyloggers run covertly in the background, while hardware variants can be physically attached between the keyboard and the computer.
pretnja · malware
№ 019
Lateral Movement Lateral movement involves an attacker moving from one compromised system to another within the same network. The goal is to expand access to systems containing more valuable data or enabling further escalation.
tehnika · privileges
№ 015
Living off the Land Using legitimate system tools to execute malicious actions.
tehnika · execution
№ 005
Loader / Dropper Loaders and droppers are couriers. Their only job is to deliver the infection to the machine. A dropper carries the payload with it and writes it to the system; a loader is usually smaller and pulls the payload from the internet only once it has landed. Neither does anything more than that — and that is their advantage.
pretnja · malware
№ 016
Logging & Monitoring Logging and monitoring involves the systematic recording of activities and events on systems, networks, and applications, along with regular analysis of those records to detect anomalies and security incidents.
odbrana · monitoring / response
№ 032
Malvertising Malvertising uses ad networks as a delivery channel for attacks. The user does not have to be on a dubious site; a malicious advert can appear on a legitimate portal too, because ad space often arrives through several intermediaries.
pretnja · social eng.
№ 038
Malware Delivery Malware delivery encompasses the methods by which malicious software is transferred to a target system. This includes infected attachments, compromised websites, malicious ads, removable media, and compromised software updates.
tehnika · C2
№ 013
Payload Obfuscation Payload obfuscation involves applying techniques to conceal the content and intent of malicious code. Attackers use encryption, compression, encoding, polymorphism, and packing to evade detection by security tools.
tehnika · execution
№ 011
Persistence Persistence encompasses techniques by which an attacker ensures their access or malicious code survives system reboots, password changes, or other interruptions. The goal is to maintain a foothold in the environment over an extended period.
tehnika · execution
№ 018
Privilege Escalation Privilege escalation is a technique by which an attacker with limited access gains a higher level of authorization. Vertical escalation means reaching administrator or root level, while horizontal escalation means accessing another user's resources at the same privilege level.
tehnika · privileges
№ 045
Process Injection Injecting malicious code into the address space of a legitimate process.
tehnika · evasion
№ 001
Ransomware Ransomware locks a company's data and demands payment to release it. The ransom is asked in cryptocurrency because it makes the money harder to follow — which is exactly why attackers use it.
pretnja · malware
№ 014
Remote access trojan - RAT A RAT gives the attacker remote control of your machine. Once inside they can browse files, switch on the camera and microphone, record what you type and run commands — all of it live, as if sitting in front of your screen. It resembles remote support tools, only on the wrong side of the law.
pretnja · malware
№ 010
Rootkit A rootkit is hard to see, and that is its most important property. It can settle beneath the operating system and beneath the layer where antivirus software can look: sometimes in drivers or in the kernel, out of reach of protective mechanisms, sometimes in the boot phase, even in the motherboard firmware. From there it hides itself and everything else the attacker does, so an infected system looks perfectly clean.
pretnja · malware
№ 017
Rootkit Installation Technique of installing a rootkit to deeply hide presence on a system.
tehnika · execution
№ 026
Secure Configuration Secure configuration involves applying established security baselines to all systems, services, and applications in an organization. The goal is to reduce the attack surface by eliminating unnecessary functions, default passwords, and insecure settings.
odbrana · resilience
№ 027
Spear Phishing Spear phishing is phishing cut to fit one person or a small group of users. Instead of sending the same message to thousands of addresses, the attacker first gathers information about the victim — where they work, who they work with, what they are working on right now, how the company addresses its clients — and then writes a message that reads as if it came from that world.
pretnja · social eng.
№ 003
Spyware Spyware watches the user and what they do. Hidden, it can spend months collecting what you type, what is on your screen, where you are, who calls you, and what you say through the microphone and camera. The point is not damage to the device but a record of the person, which can later be turned to any number of uses.
pretnja · malware
№ 060
Supply Chain Attack A supply chain attack does not always aim at the final victim directly. The attacker compromises software, hardware, a supplier, a build process or an update mechanism before the product or service reaches the user. The victim then carries the problem into their own environment, because it comes from a source they trust.
pretnja · trust
№ 006
Supply Chain Compromise Technique of injecting malicious code into the software supply chain.
tehnika · initial access
№ 044
Timestomping Changing file timestamps to hide when they were created or modified.
tehnika · evasion
№ 002
Trojan A Trojan does not break in; the victim opens the door. It usually presents itself as something useful — a program or a document, a fake installer, a cracked application, or a harmless-looking tool for speeding up the computer. The user runs what they meant to run, and the attacker gets what they were after.
pretnja · malware
№ 009
Virus A virus embeds itself in other executable files and runs together with them. It starts when the user launches the application or opens the infected file, and often attaches itself to other running processes and applications. That is what separates it from a worm: a virus needs a host and a user, while a worm spreads on its own.
pretnja · malware
№ 005
Watering Hole Technique of compromising websites that the target group regularly visits.
tehnika · initial access
№ 036
Watering Hole Attack A watering hole attack does not chase the victim directly. The attacker first finds a site the target group visits regularly, then compromises that site or the content loaded through it. The victim then comes to the place of the attack on their own, doing what they normally do.
pretnja · social eng.
№ 007
Wiper A wiper does not exist to steal or to extort — a wiper destroys data. It erases and overwrites, breaks file systems, and combined with worms and zero-day vulnerabilities it can bring down hundreds or thousands of networks within hours. Unlike ransomware it offers no ransom; recovery was never part of the plan, because the aim is damage, not money.
pretnja · malware
№ 008
Worm A worm spreads on its own. Unlike a virus it needs no host file and no click from the user — once it is on one machine it immediately looks for the next, and the next, and thousands of devices can be infected within minutes. Replication is its purpose, speed is its weapon, and whatever it carries is the real threat.
pretnja · malware
№ 044
Zero-Day Exploitation Zero-day exploitation uses a vulnerability for which the vendor has no patch yet, or does not know exists. The name says how much time the defense had to prepare: zero days. In practice a victim can be doing everything right, keeping systems and applications up to date, and still be exposed.
pretnja · applications