Search: dns — Cyber Encyclopedia

166 terms · 75/46/45

79 rezultata za „dns" · 12 direktnih · 67 povezanih

Pretnje

2 direktna pogotka

№ 057
DNS Poisoning DNS poisoning is an attack in which a user or a resolver is given a false answer for a domain. The result is that the user types a familiar address into the bro …
pretnja · availability
№ 051
DNS Amplification DNS amplification is a reflected DDoS attack in which the attacker uses open DNS resolvers to multiply the traffic aimed at a victim. The attacker sends relativ …
pretnja · availability

Tehnike

8 direktnih pogodaka

№ 036
DNS Tunneling … of exfiltrating data or C2 communication through DNS queries.
tehnika · exfiltration / impact
№ 041
Fast-Flux DNS DNS records change every few minutes to new IP addresses.
tehnika · C2
№ 009
AiTM AiTM sits between the user and the real service. Classic phishing steals a password; AiTM steals the live session. The victim gets a link, lands on a proxy that looks exactly like the real login (because it forwards everything to the real site), enters credentials and even the MFA code — the proxy passes them through, the real service issues a session token, and the attacker captures that token.
tehnika · initial access
№ 039
Command & Control Using DNS queries to transfer commands and data in small segments
tehnika · C2
№ 031
Data Exfiltration Using DNS queries to incrementally encode and send stolen data
tehnika · exfiltration / impact
№ 040
Domain Fronting APT29 used domain fronting via Google and Amazon CDNs
tehnika · C2
№ 042
Encrypted C2 Channels Using HTTPS, DNS-over-HTTPS, or other encrypted protocols for C2.
tehnika · C2
№ 030
OSINT Includes LinkedIn profiles, DNS records, Shodan, GitHub, social media.
tehnika · discovery

Odbrane

2 direktna pogotka

№ 029
DNS Security DNS security encompasses technologies that protect DNS infrastructure and use DNS traffic as a control point for blocking access to malicious domains and detect …
odbrana · resilience
№ 007
SPF/DKIM/DMARC It's set on DNS, costs little, and is among the cheapest controls with real effect — but only when DMARC is actually in reject mode, not merely 'monitor'. Many …
odbrana · endpoints

↳ Povezano

67 stavki koje koriste „dns"

№ 042
API Abuse API abuse arises when an attacker uses a programming interface in a way the application did not anticipate or did not restrict enough. An API is not merely a technical add-on to the application. It is often the main entrance to the data, the users, the orders, the payments and the administration.
pretnja · applications
№ 065
Accidental Data Leak An accidental data leak is not an attack in the classic sense, but the consequences can look the same. Data becomes available to the wrong people through human error, bad configuration, wrong sharing, a public repository, open cloud storage, or mail sent to the wrong address.
pretnja · trust
№ 027
Automation & Scripting Automation and scripting involves using scripts, tools, and automated procedures to accelerate and scale activities within a compromised environment. Attackers leverage system scripting interpreters, configuration management tools, and custom scripts.
tehnika · discovery
№ 056
BGP Hijacking BGP hijacking is an attack, or a serious mistake, in which internet traffic is diverted by wrong routing. BGP is the protocol by which autonomous systems on the internet tell each other which path leads to particular IP ranges. If somebody announces another party's range as their own, part of the internet can believe them.
pretnja · availability
№ 006
Backdoor A backdoor is a hidden way in. Once placed or opened, it lets the attacker return to the machine — with no password, no authorization and no entry in the ordinary records. A backdoor can be opened by malware while it runs, but it can equally be a user account nobody watches, or web shell access left on a server.
pretnja · malware
№ 053
Botnet Attacks A botnet is a set of compromised devices the attacker controls remotely. That network can hold computers, servers, routers, cameras, NAS devices, phones and IoT equipment. The owner of the device often does not know that it is carrying out somebody else's requests.
pretnja · availability
№ 028
Business Email Compromise Business email compromise is not an ordinary fake email. The attacker breaks into business correspondence, or imitates it well enough that somebody in the company believes the request comes from the director, from finance, from a supplier, a lawyer or a partner. The aim is usually money, but it can also be a confidential document, a change of payment details, or an opening for the next phase of the attack.
pretnja · social eng.
№ 013
Certificate Management Managing the lifecycle of digital certificates — issuance, renewal, revocation.
odbrana · identity / access
№ 074
Cloud storage exposure Cloud storage exposure arises when data that ought to be private becomes publicly reachable through a bad configuration of a cloud service. That can be S3 buckets, blob storage, backups, logs, documents, images, database exports or configuration files.
pretnja · cloud
№ 063
Contractor Abuse Contractor access abuse arises when a consultant, a contractor, an external firm or a temporarily engaged person uses access more widely or for longer than the work requires. The access is often granted legitimately, but afterwards it is not monitored, not narrowed and not withdrawn in time.
pretnja · trust
№ 040
Cross-Site Scripting Cross-site scripting, better known as XSS, arises when a web application allows somebody else's script to be displayed and executed in the user's browser. The attacker does not have to break into the web server. It is enough for their code to end up in a page the victim opens as though it were entirely legitimate.
pretnja · applications
№ 028
DDoS Protection DDoS protection encompasses technologies and services that detect and mitigate distributed denial-of-service attacks before malicious traffic reaches or overwhelms the target infrastructure.
odbrana · resilience
№ 034
DLP DLP watches where sensitive data goes and stops it where it shouldn't: an employee attaching a client list to a private email, copying a file with personal data to a USB, or pasting a database into a chat. It works by recognizing patterns (national IDs, card numbers, marked documents) and applying rules per channel — mail, web, endpoint, cloud.
odbrana · resilience
№ 030
Data Encryption Protecting data by encrypting it at rest and in transit.
odbrana · resilience
№ 003
EDR EDR (Endpoint Detection and Response) is a technology that continuously monitors endpoint activity, records events, and enables detection, investigation, and response to threats that bypassed preventive controls.
odbrana · endpoints
№ 068
Evil Twin A fake Wi-Fi network, known as an evil twin, imitates a legitimate wireless network so that users connect to an access point the attacker controls. The network name looks familiar, the signal can be stronger, and the device often suggests or restores the connection by itself.
pretnja · physical / IoT
№ 010
Exploitation Exploitation involves leveraging a flaw in software, hardware, or configuration to execute unauthorized code or bypass security controls. Vulnerabilities can exist in operating systems, applications, network services, or firmware.
tehnika · execution
№ 035
Firewall A firewall is a control placed at the boundary between networks that permits or blocks traffic according to predefined rules — deciding who may talk to whom, on which ports and protocols.
odbrana · resilience
№ 022
IDS/IPS IDS/IPS are systems that monitor network traffic (or host activity) for patterns indicating an attack. An IDS (Intrusion Detection System) only reports suspicious activity; an IPS (Intrusion Prevention System) sits inline and can block it immediately.
odbrana · monitoring / response
№ 020
Incident Response A planned process of identifying, containing, eradicating, and recovering from cyber incidents.
odbrana · monitoring / response
№ 012
Infostealer An infostealer has one basic role: to collect your credentials. Saved browser passwords, cookies and session tokens, autofill data, crypto wallet keys — all of it is of interest. It stays in contact with the attacker and sends on what it gathers. When the job is done it can delete itself and disappear.
pretnja · malware
№ 058
Insider Threat An insider threat comes from a person who has, or once had, legitimate access to an organization's systems, data or premises. That can be an employee, a former employee, an administrator, an associate, a supplier or a partner. The trouble is that the access was not necessarily unauthorized to begin with.
pretnja · trust
№ 067
IoT Device Compromise IoT device compromise hits cameras, routers, sensors, smart televisions, locks, controllers and all the equipment connected to a network that does not behave like a classic computer. The problem is that these devices are often forgotten the moment they are switched on.
pretnja · physical / IoT
№ 004
Keylogger A keylogger is a program or hardware device that records every keystroke. Software keyloggers run covertly in the background, while hardware variants can be physically attached between the keyboard and the computer.
pretnja · malware
№ 005
Loader / Dropper Loaders and droppers are couriers. Their only job is to deliver the infection to the machine. A dropper carries the payload with it and writes it to the system; a loader is usually smaller and pulls the payload from the internet only once it has landed. Neither does anything more than that — and that is their advantage.
pretnja · malware
№ 016
Logging & Monitoring Logging and monitoring involves the systematic recording of activities and events on systems, networks, and applications, along with regular analysis of those records to detect anomalies and security incidents.
odbrana · monitoring / response
№ 017
MDR MDR (Managed Detection and Response) is a service where an external security team provides continuous monitoring, threat detection, and incident response on behalf of an organization. It combines technology with human expertise.
odbrana · monitoring / response
№ 032
Malvertising Malvertising uses ad networks as a delivery channel for attacks. The user does not have to be on a dubious site; a malicious advert can appear on a legitimate portal too, because ad space often arrives through several intermediaries.
pretnja · social eng.
№ 038
Malware Delivery Malware delivery encompasses the methods by which malicious software is transferred to a target system. This includes infected attachments, compromised websites, malicious ads, removable media, and compromised software updates.
tehnika · C2
№ 032
Microsegmentation Finer network division at workload or application level, not just VLANs.
odbrana · resilience
№ 073
Model theft / extraction Model theft and extraction means an attacker obtains a model an organization trained, bought or adapted to its own needs. That can be direct theft of the files, the weights and the configuration, but also controlled extraction through an API, where the model is queried enough times to build an approximate copy.
pretnja · AI / ML
№ 025
Network Segmentation Network segmentation is the practice of dividing network infrastructure into smaller, isolated segments with controlled communication between them. The goal is to limit an attacker's ability to move through the network after compromising a single system.
odbrana · resilience
№ 047
Path Traversal Path traversal is an attack in which the attacker tries to step out of the permitted directory and reach files the application should never display. The best-known pattern is a sequence such as `../`, which walks the path back up the file system level by level.
pretnja · applications
№ 026
Phishing Phishing is the most widespread form of social-engineering attack and, in a great many cases, the first link in any serious break-in. The attacker sends a message that appears to come from a known organization — a bank, a courier, a government service, a colleague — and leads the victim into doing one of three things: clicking a link, opening an attachment, or entering their credentials somewhere.
pretnja · social eng.
№ 001
Phishing Phishing as a technique involves sending fraudulent emails, SMS messages, or chat messages to trick the victim into clicking a malicious link, opening an infected attachment, or entering credentials on a fake page.
tehnika · initial access
№ 061
Privilege Misuse Privilege misuse arises when somebody uses rights they genuinely hold for actions they have no business reason to take. Unlike privilege escalation, the attacker or insider here does not have to acquire new authority. The trouble is that the existing authority is enough to do damage.
pretnja · trust
№ 072
Prompt injection Prompt injection exploits the weakness of language models in telling an instruction apart from the content they are processing. When a model reads an email, a document, a page, a ticket or a message, the attacker can put text into that content which reads like an instruction.
pretnja · AI / ML
№ 001
Ransomware Ransomware locks a company's data and demands payment to release it. The ransom is asked in cryptocurrency because it makes the money harder to follow — which is exactly why attackers use it.
pretnja · malware
№ 043
Regulatory Compliance Meeting requirements of regulatory frameworks and standards for cybersecurity.
odbrana · governance
№ 038
Remote Code Execution Remote code execution is one of the most dangerous classes of vulnerability, because it lets an attacker run their own code on a vulnerable system from somewhere else entirely. If the application runs on a server, the attacker is no longer merely a user on the outside; they gain a way to influence what the server executes.
pretnja · applications
№ 014
Remote access trojan - RAT A RAT gives the attacker remote control of your machine. Once inside they can browse files, switch on the camera and microphone, record what you type and run commands — all of it live, as if sitting in front of your screen. It resembles remote support tools, only on the wrong side of the law.
pretnja · malware
№ 032
Resource Exhaustion Resource exhaustion as a technique involves deliberately overloading target systems to make them unavailable to legitimate users. The attacker targets CPU, memory, network bandwidth, disk, or connection limits.
tehnika · exfiltration / impact
№ 041
Risk Assessment Systematic process of identifying, analyzing, and prioritizing cyber risks.
odbrana · governance
№ 070
SCADA/OT Attack An attack on SCADA and OT systems targets industrial processes, not only data. These are the systems that run manufacturing, energy, water, transport, buildings, sensors, PLC controllers and HMI stations. When such a system stops or starts working wrongly, the consequences can be fatal.
pretnja · physical / IoT
№ 015
SIEM SIEM (Security Information and Event Management) is a system that collects logs and events from diverse sources across the entire infrastructure, centralizes them, and applies correlation rules to detect suspicious patterns and security incidents.
odbrana · monitoring / response
№ 018
SOAR Security Orchestration, Automation and Response — automating security operations.
odbrana · monitoring / response
№ 039
SQL Injection SQL injection usually arises when a web application passes user input blindly to the database on the web server. Instead of ordinary text, the attacker can put part of an SQL command into a login, search or filter field. If the application does not stop it, the database can execute something the designer never had in mind, and certainly never intended.
pretnja · applications
№ 045
SSRF SSRF is a vulnerability in which the attacker gets a web server to send a request to an address of the attacker's choosing. The distinction matters: the request is not sent by the user's browser but by the server. That opens the door to internal services which from the outside ought to remain invisible.
pretnja · applications
№ 026
Secure Configuration Secure configuration involves applying established security baselines to all systems, services, and applications in an organization. The goal is to reduce the attack surface by eliminating unnecessary functions, default passwords, and insecure settings.
odbrana · resilience
№ 037
Security Awareness Employee education programs about cyber threats and safe behavior.
odbrana · people
№ 019
Session Hijacking When you log in, the service opens a session — a state that remembers you are you, together with everything that goes with it, such as your preferences and settings. The main benefit is that you do not have to type a password every few minutes as you move through the features. That session is marked by an identifier, usually held in a browser cookie. Session hijacking is the taking over of a session that is already open. The attacker does not attack the login; they slip into a session that has already passed authentication and carry on operating the service in your name.
pretnja · identity
№ 064
Shadow IT Shadow IT is the use of applications, cloud services, accounts and tools without the knowledge or approval of the IT team. Employees usually do not bring them in to cause a problem but to get the work done faster: a file needs sharing, a team needs a chat, marketing needs a tool, sales needs a PDF now.
pretnja · trust
№ 002
Social Engineering Social engineering as a technique involves manipulating human behavior to obtain information, access, or the execution of actions that benefit the attacker. It relies on trust, authority, urgency, or fear.
tehnika · initial access
№ 027
Spear Phishing Spear phishing is phishing cut to fit one person or a small group of users. Instead of sending the same message to thousands of addresses, the attacker first gathers information about the victim — where they work, who they work with, what they are working on right now, how the company addresses its clients — and then writes a message that reads as if it came from that world.
pretnja · social eng.
№ 003
Spyware Spyware watches the user and what they do. Hidden, it can spend months collecting what you type, what is on your screen, where you are, who calls you, and what you say through the microphone and camera. The point is not damage to the device but a record of the person, which can later be turned to any number of uses.
pretnja · malware
№ 060
Supply Chain Attack A supply chain attack does not always aim at the final victim directly. The attacker compromises software, hardware, a supplier, a build process or an update mechanism before the product or service reaches the user. The victim then carries the problem into their own environment, because it comes from a source they trust.
pretnja · trust
№ 059
Third-Party Compromise Third-party compromise happens when the attacker does not go at an organization directly but at a supplier, a partner, a service provider or an external associate who already holds some form of trust and authorized access. Instead of forcing the front door, the attacker looks for a side entrance somebody else has already opened.
pretnja · trust
№ 019
Threat Intelligence Collecting, analyzing, and applying data about current cyber threats.
odbrana · monitoring / response
№ 018
Token Theft A token is proof that you have already logged in. When you sign in and confirm your identity with a second factor, the service issues a token, stored in the browser, which vouches that you have already been checked the next time round. The token is sent automatically with every further request, so you do not have to type the password again. Token theft is the taking of that proof. With it in hand, the attacker presents themselves as you — without your password and without the second factor, because both have already been approved.
pretnja · identity
№ 002
Trojan A Trojan does not break in; the victim opens the door. It usually presents itself as something useful — a program or a document, a fake installer, a cracked application, or a harmless-looking tool for speeding up the computer. The user runs what they meant to run, and the attacker gets what they were after.
pretnja · malware
№ 066
Typosquatting Typosquatting exploits small mistakes in typing, reading or recognizing a name. The attacker registers a domain, an account or a software package that resembles a legitimate name, counting on a user, a developer or a system to miss one letter, swap a character or overlook the difference.
pretnja · trust
№ 036
Virtual Private Network A VPN (virtual private network) creates an encrypted tunnel between a device and the network it connects to. For an organization this primarily means controlled remote access to internal resources — from home, on the road, in the field. Traffic inside the tunnel cannot be read in transit, even on hotel Wi-Fi.
odbrana · resilience
№ 036
Watering Hole Attack A watering hole attack does not chase the victim directly. The attacker first finds a site the target group visits regularly, then compromises that site or the content loaded through it. The victim then comes to the place of the attack on their own, doing what they normally do.
pretnja · social eng.
№ 033
Whaling Whaling is targeted phishing aimed at senior management, owners, directors and people who can approve large decisions. The target is not chosen by chance. The attacker knows who they are after and why that person is worth more than an ordinary account.
pretnja · social eng.
№ 004
XDR XDR (Extended Detection and Response) unifies data from endpoints, network, email, and cloud.
odbrana · endpoints
№ 011
Zero Trust Zero Trust is a security concept that assumes no user, device, or network segment should be automatically trusted, regardless of whether it is inside or outside the corporate network. Every access request is verified before approval.
odbrana · identity / access
№ 044
Zero-Day Exploitation Zero-day exploitation uses a vulnerability for which the vendor has no patch yet, or does not know exists. The name says how much time the defense had to prepare: zero days. In practice a victim can be doing everything right, keeping systems and applications up to date, and still be exposed.
pretnja · applications