166 terms ·
75/46/45
96 rezultata za „filtering" ·
13 direktnih ·
83 povezanih
Pretnje
5 direktnih pogodaka-
№ 056
BGP Hijacking … users. That is why RPKI, route validation, prefix filtering and monitoring of changes matter so much in the defense. Without them, routes are too fragile for th …pretnja · availability
-
№ 051
DNS Amplification BCP38 source address filtering and closing open resolvers reduce the chance that the infrastructure is turned against others.pretnja · availability
-
№ 032
Malvertising … date browser, blocking suspicious adverts and web filtering are not comfort here but a reduction of the attack surface.pretnja · social eng.
-
№ 026
Phishing The defense works on two levels. Technical: mail filtering, link checking, two-factor authentication that makes a stolen password unusable. Human: through train …pretnja · social eng.
-
№ 039
SQL Injection SQL injection is not solved by filtering out a few dangerous characters, but by parameterized queries and correct handling of the database.pretnja · applications
Tehnike
1 direktan pogodakOdbrane
7 direktnih pogodaka-
№ 029
DNS Security DNS filtering can block access to known malicious domains, phishing sites, and command-and-control servers before a connection is established. DNS traffic analy …odbrana · resilience
-
№ 002
Email Security Email security encompasses technologies that filter inbound and outbound messages to prevent phishing, malware delivery, and business email compromise. It operates at the server or cloud level before the message reaches the user.odbrana · endpoints
-
№ 027
WAF WAF (Web Application Firewall) is a firewall that filters, monitors, and blocks HTTP/HTTPS traffic to web applications. It sits between users and the web server, analyzing each request against defined rules.odbrana · resilience
-
№ 028
DDoS Protection … ns operate at the network and application layers, filtering malicious traffic while allowing legitimate requests through. They can be implemented as a cloud ser …odbrana · resilience
-
№ 001
Endpoint Protection … ontrol, exploit protection, on-device web traffic filtering, and the ability to isolate suspicious processes. They often serve as the foundation upon which more …odbrana · endpoints
-
№ 035
Firewall … all is not only a barrier at the entrance. Egress filtering is often more valuable: many intrusions surface only when a compromised host tries to reach its comm …odbrana · resilience
-
№ 038
Phishing Simulations Regular testing of employees with simulated phishing messages.odbrana · people
↳ Povezano
83 stavke koje koriste „filtering"-
№ 042
API Abuse API abuse arises when an attacker uses a programming interface in a way the application did not anticipate or did not restrict enough. An API is not merely a technical add-on to the application. It is often the main entrance to the data, the users, the orders, the payments and the administration.pretnja · applications
-
№ 021
Account Takeover Account takeover is the moment the attacker gains full control of an account — not only access, but the ability to change the password, the recovery mail address, the phone number and the second factor, while the real owner is shut out with no technical way back in on their own. Takeover is rarely the first stage of an attack. It is usually the destination of what came before: phishing, credential stuffing, token theft.pretnja · identity
-
№ 043
Authentication Bypass An authentication bypass means the attacker reaches a protected part of the system without logging in the ordinary way. They need not know a password. Sometimes a flaw in the logic is enough, or an unprotected endpoint, a predictable token, a misconfigured proxy, or a gap between two steps of the login.pretnja · applications
-
№ 027
Automation & Scripting Automation and scripting involves using scripts, tools, and automated procedures to accelerate and scale activities within a compromised environment. Attackers leverage system scripting interpreters, configuration management tools, and custom scripts.tehnika · discovery
-
№ 006
Backdoor A backdoor is a hidden way in. Once placed or opened, it lets the attacker return to the machine — with no password, no authorization and no entry in the ordinary records. A backdoor can be opened by malware while it runs, but it can equally be a user account nobody watches, or web shell access left on a server.pretnja · malware
-
№ 053
Botnet Attacks A botnet is a set of compromised devices the attacker controls remotely. That network can hold computers, servers, routers, cameras, NAS devices, phones and IoT equipment. The owner of the device often does not know that it is carrying out somebody else's requests.pretnja · availability
-
№ 006
Browser Isolation Executing web content in an isolated environment separate from the local system.odbrana · endpoints
-
№ 015
Brute-force attack A brute-force attack breaks into an account by trying to log in over and over: automated tools work through password after password until one takes. It succeeds against short, weak and common passwords, and against systems that put no limit on failed attempts. It is not clever — it is only fast, and it can run for days.pretnja · identity
-
№ 028
Business Email Compromise Business email compromise is not an ordinary fake email. The attacker breaks into business correspondence, or imitates it well enough that somebody in the company believes the request comes from the director, from finance, from a supplier, a lawyer or a partner. The aim is usually money, but it can also be a confidential document, a change of payment details, or an opening for the next phase of the attack.pretnja · social eng.
-
№ 039
Command & Control Command and control communication involves establishing a persistent channel between the attacker and the compromised system for sending commands and receiving results. The attacker uses this channel to manage malware, launch new attack phases, and retrieve data.tehnika · C2
-
№ 003
Credential Abuse Credential abuse involves using stolen, leaked, or otherwise obtained login data to gain unauthorized access to systems and services. The attacker impersonates a legitimate user.tehnika · initial access
-
№ 017
Credential stuffing Credential stuffing does not go after unknown passwords; it tries known ones. With username and password pairs from databases leaked across the internet, the attacker tries the most-used services such as Facebook and Instagram, counting on people reusing the same credentials on several services — which in most cases holds.pretnja · identity
-
№ 041
Cross-Site Request Forgery Cross-site request forgery, or CSRF, exploits the fact that a browser automatically sends existing session cookies to a site where the user is already logged in. The attacker does not need to know the password. It is enough to lead the user down the wrong path.pretnja · applications
-
№ 040
Cross-Site Scripting Cross-site scripting, better known as XSS, arises when a web application allows somebody else's script to be displayed and executed in the user's browser. The attacker does not have to break into the web server. It is enough for their code to end up in a page the victim opens as though it were entirely legitimate.pretnja · applications
-
№ 037
Crypto-wallet drainer A crypto wallet works by signing transactions that move crypto assets. Draining a wallet is the process in which the user, believing they are doing something legitimate, signs a transaction or an approval that hands the attacker control of those assets.pretnja · social eng.
-
№ 013
Cryptominer A cryptominer steals what we rarely think of as a target: our computing power and our electricity. In the background it uses our processors and graphics cards to mine cryptocurrency for the attacker while we pay the bill. It has no interest in our data, only in our resources and how much of them there is.pretnja · malware
-
№ 016
DLL Sideloading Technique of loading a malicious DLL through a legitimate program that requests it.tehnika · execution
-
№ 057
DNS Poisoning DNS poisoning is an attack in which a user or a resolver is given a false answer for a domain. The result is that the user types a familiar address into the browser and DNS takes them to the wrong web server. On paper the name is the same. In reality the road leads somewhere else.pretnja · availability
-
№ 036
DNS Tunneling Technique of exfiltrating data or C2 communication through DNS queries.tehnika · exfiltration / impact
-
№ 031
Data Exfiltration Data exfiltration involves transferring stolen information from the compromised environment to an attacker-controlled location. Data can be sent through encrypted channels, legitimate cloud services, email, or even physical media.tehnika · exfiltration / impact
-
№ 050
Denial of Service / DoS DoS is a denial-of-service attack that tries to bring a service down or slow it so far that legitimate users can no longer use it. Unlike DDoS it need not come from a large network of compromised devices. Sometimes one source and a well-chosen vulnerability are enough.pretnja · availability
-
№ 048
Dependency Confusion Dependency confusion is an attack on the process by which software build platforms find and deliver software dependencies. An attacker can publish a package on a public registry with the same name as an organization's internal package, or with the name of another public and valid package, counting on the fetching tool choosing their version over the real one.pretnja · applications
-
№ 049
Distributed Denial of Service / DDoS DDoS is a distributed denial-of-service attack. Instead of attacking from one place, the attacker uses a large number of compromised devices, rented infrastructure and reflected traffic to bury the target in web requests until the server is blocked. The aim is not data theft but choking the service into unavailability.pretnja · availability
-
№ 040
Domain Fronting Technique of hiding C2 traffic behind legitimate CDN domains.tehnika · C2
-
№ 007
Drive-by Download Drive-by download is automatic malware download when visiting a compromised site.tehnika · initial access
-
№ 003
EDR EDR (Endpoint Detection and Response) is a technology that continuously monitors endpoint activity, records events, and enables detection, investigation, and response to threats that bypassed preventive controls.odbrana · endpoints
-
№ 042
Encrypted C2 Channels Using HTTPS, DNS-over-HTTPS, or other encrypted protocols for C2.tehnika · C2
-
№ 010
Exploitation Exploitation involves leveraging a flaw in software, hardware, or configuration to execute unauthorized code or bypass security controls. Vulnerabilities can exist in operating systems, applications, network services, or firmware.tehnika · execution
-
№ 041
Fast-Flux DNS Rapid rotation of IP addresses associated with a C2 domain.tehnika · C2
-
№ 011
Fileless malware Fileless malware never writes itself to disk during the attack, so antivirus software has a harder time finding it. While it operates it lives in memory and works with tools the system already has — PowerShell, scripts, built-in commands. Because it delivers its payload through legitimate tools, its activity is not easy to tell apart from normal work.pretnja · malware
-
№ 022
IDS/IPS IDS/IPS are systems that monitor network traffic (or host activity) for patterns indicating an attack. An IDS (Intrusion Detection System) only reports suspicious activity; an IPS (Intrusion Prevention System) sits inline and can block it immediately.odbrana · monitoring / response
-
№ 014
In-Memory Execution Executing malicious code in memory without writing files to disk.tehnika · execution
-
№ 012
Infostealer An infostealer has one basic role: to collect your credentials. Saved browser passwords, cookies and session tokens, autofill data, crypto wallet keys — all of it is of interest. It stays in contact with the attacker and sends on what it gathers. When the job is done it can delete itself and disappear.pretnja · malware
-
№ 046
Insecure Deserialization Deserialization is the return of a packed object into a form the application can use. The problem arises when an application accepts an object from an untrusted source and handles it as though it were safe. At that point the attacker is not sending mere data but a specially prepared structure that can change the flow of execution.pretnja · applications
-
№ 067
IoT Device Compromise IoT device compromise hits cameras, routers, sensors, smart televisions, locks, controllers and all the equipment connected to a network that does not behave like a classic computer. The problem is that these devices are often forgotten the moment they are switched on.pretnja · physical / IoT
-
№ 004
Keylogger A keylogger is a program or hardware device that records every keystroke. Software keyloggers run covertly in the background, while hardware variants can be physically attached between the keyboard and the computer.pretnja · malware
-
№ 019
Lateral Movement Lateral movement involves an attacker moving from one compromised system to another within the same network. The goal is to expand access to systems containing more valuable data or enabling further escalation.tehnika · privileges
-
№ 005
Loader / Dropper Loaders and droppers are couriers. Their only job is to deliver the infection to the machine. A dropper carries the payload with it and writes it to the system; a loader is usually smaller and pulls the payload from the internet only once it has landed. Neither does anything more than that — and that is their advantage.pretnja · malware
-
№ 016
Logging & Monitoring Logging and monitoring involves the systematic recording of activities and events on systems, networks, and applications, along with regular analysis of those records to detect anomalies and security incidents.odbrana · monitoring / response
-
№ 005
Mobile Device Security Managing and protecting mobile devices through MDM and MAM solutions.odbrana · endpoints
-
№ 073
Model theft / extraction Model theft and extraction means an attacker obtains a model an organization trained, bought or adapted to its own needs. That can be direct theft of the files, the weights and the configuration, but also controlled extraction through an API, where the model is queried enough times to build an approximate copy.pretnja · AI / ML
-
№ 008
Multi-Factor Authentication Multi-factor authentication requires two or more independent proofs of identity at login. It typically combines something the user knows (password), something they possess (phone, hardware key), and something they are (biometrics).odbrana · identity / access
-
№ 025
Network Segmentation Network segmentation is the practice of dividing network infrastructure into smaller, isolated segments with controlled communication between them. The goal is to limit an attacker's ability to move through the network after compromising a single system.odbrana · resilience
-
№ 028
Network Sniffing Passively intercepting network traffic to collect sensitive data.tehnika · discovery
-
№ 023
Patch Management Patch management is the process of identifying, testing, and applying software updates that fix known vulnerabilities. The goal is to reduce the time window in which an attacker can exploit a known weakness.odbrana · resilience
-
№ 047
Path Traversal Path traversal is an attack in which the attacker tries to step out of the permitted directory and reach files the application should never display. The best-known pattern is a sequence such as `../`, which walks the path back up the file system level by level.pretnja · applications
-
№ 013
Payload Obfuscation Payload obfuscation involves applying techniques to conceal the content and intent of malicious code. Attackers use encryption, compression, encoding, polymorphism, and packing to evade detection by security tools.tehnika · execution
-
№ 045
Penetration Testing Simulation of real attacks to identify vulnerabilities that automated tools miss.odbrana · governance
-
№ 001
Phishing Phishing as a technique involves sending fraudulent emails, SMS messages, or chat messages to trick the victim into clicking a malicious link, opening an infected attachment, or entering credentials on a fake page.tehnika · initial access
-
№ 008
Physical Access Using physical access to a device or space as an attack vector.tehnika · initial access
-
№ 045
Process Injection Injecting malicious code into the address space of a legitimate process.tehnika · evasion
-
№ 034
QR phishing - Quishing Quishing is phishing through a QR code. Instead of a visible link, the user is given an image to scan with their phone. The QR code then takes them to a fake page for a login, a payment, a document download or an account confirmation.pretnja · social eng.
-
№ 055
Ransom DDoS Ransom DDoS joins an attack on availability to extortion. The attackers threaten to bring the service down, or first run a short demonstration attack, and then ask for money for the attack to stop or for a larger one not to happen.pretnja · availability
-
№ 001
Ransomware Ransomware locks a company's data and demands payment to release it. The ransom is asked in cryptocurrency because it makes the money harder to follow — which is exactly why attackers use it.pretnja · malware
-
№ 025
Reconnaissance Reconnaissance involves the systematic gathering of information about the target environment, both externally before the attack and internally after compromise. The goal is to understand the topology, identify targets, and plan the next stages.tehnika · discovery
-
№ 038
Remote Code Execution Remote code execution is one of the most dangerous classes of vulnerability, because it lets an attacker run their own code on a vulnerable system from somewhere else entirely. If the application runs on a server, the attacker is no longer merely a user on the outside; they gain a way to influence what the server executes.pretnja · applications
-
№ 014
Remote access trojan - RAT A RAT gives the attacker remote control of your machine. Once inside they can browse files, switch on the camera and microphone, record what you type and run commands — all of it live, as if sitting in front of your screen. It resembles remote support tools, only on the wrong side of the law.pretnja · malware
-
№ 032
Resource Exhaustion Resource exhaustion as a technique involves deliberately overloading target systems to make them unavailable to legitimate users. The attacker targets CPU, memory, network bandwidth, disk, or connection limits.tehnika · exfiltration / impact
-
№ 052
Resource Exhaustion Resource exhaustion targets what a system cannot work without: processor, memory, disk, network connections, threads, the database or processing queues. The aim is not necessarily to send enormous traffic but to make the system spend what it has.pretnja · availability
-
№ 010
Rootkit A rootkit is hard to see, and that is its most important property. It can settle beneath the operating system and beneath the layer where antivirus software can look: sometimes in drivers or in the kernel, out of reach of protective mechanisms, sometimes in the boot phase, even in the motherboard firmware. From there it hides itself and everything else the attacker does, so an infected system looks perfectly clean.pretnja · malware
-
№ 017
Rootkit Installation Technique of installing a rootkit to deeply hide presence on a system.tehnika · execution
-
№ 070
SCADA/OT Attack An attack on SCADA and OT systems targets industrial processes, not only data. These are the systems that run manufacturing, energy, water, transport, buildings, sensors, PLC controllers and HMI stations. When such a system stops or starts working wrongly, the consequences can be fatal.pretnja · physical / IoT
-
№ 007
SPF/DKIM/DMARC By default, anyone can put your domain in the sender field — that's how spoofed mail 'from the director' works. SPF, DKIM, and DMARC are three records you publish for your domain that let a recipient check whether mail claiming to be from you actually came from your systems. SPF says which servers may send for you, DKIM signs the message, and DMARC tells the recipient what to do with mail that fails the check and sends you reports.odbrana · endpoints
-
№ 045
SSRF SSRF is a vulnerability in which the attacker gets a web server to send a request to an address of the attacker's choosing. The distinction matters: the request is not sent by the user's browser but by the server. That opens the door to internal services which from the outside ought to remain invisible.pretnja · applications
-
№ 026
Secure Configuration Secure configuration involves applying established security baselines to all systems, services, and applications in an organization. The goal is to reduce the attack surface by eliminating unnecessary functions, default passwords, and insecure settings.odbrana · resilience
-
№ 037
Security Awareness Employee education programs about cyber threats and safe behavior.odbrana · people
-
№ 033
Service Abuse Service abuse as a technique involves using legitimate system functionalities in unintended ways to cause damage, gain unauthorized access, or achieve financial gain.tehnika · exfiltration / impact
-
№ 002
Social Engineering Social engineering as a technique involves manipulating human behavior to obtain information, access, or the execution of actions that benefit the attacker. It relies on trust, authority, urgency, or fear.tehnika · initial access
-
№ 027
Spear Phishing Spear phishing is phishing cut to fit one person or a small group of users. Instead of sending the same message to thousands of addresses, the attacker first gathers information about the victim — where they work, who they work with, what they are working on right now, how the company addresses its clients — and then writes a message that reads as if it came from that world.pretnja · social eng.
-
№ 003
Spyware Spyware watches the user and what they do. Hidden, it can spend months collecting what you type, what is on your screen, where you are, who calls you, and what you say through the microphone and camera. The point is not damage to the device but a record of the person, which can later be turned to any number of uses.pretnja · malware
-
№ 060
Supply Chain Attack A supply chain attack does not always aim at the final victim directly. The attacker compromises software, hardware, a supplier, a build process or an update mechanism before the product or service reaches the user. The victim then carries the problem into their own environment, because it comes from a source they trust.pretnja · trust
-
№ 019
Threat Intelligence Collecting, analyzing, and applying data about current cyber threats.odbrana · monitoring / response
-
№ 002
Trojan A Trojan does not break in; the victim opens the door. It usually presents itself as something useful — a program or a document, a fake installer, a cracked application, or a harmless-looking tool for speeding up the computer. The user runs what they meant to run, and the attacker gets what they were after.pretnja · malware
-
№ 066
Typosquatting Typosquatting exploits small mistakes in typing, reading or recognizing a name. The attacker registers a domain, an account or a software package that resembles a legitimate name, counting on a user, a developer or a system to miss one letter, swap a character or overlook the difference.pretnja · trust
-
№ 069
USB Drop Attack A USB drop attack uses human curiosity and the habit of plugging an unknown device into a computer to see what is on it. The attacker leaves a USB stick or device where an employee will notice it: a car park, a corridor, a reception desk, a meeting room, a bag of promotional material.pretnja · physical / IoT
-
№ 009
Virus A virus embeds itself in other executable files and runs together with them. It starts when the user launches the application or opens the infected file, and often attaches itself to other running processes and applications. That is what separates it from a worm: a virus needs a host and a user, while a worm spreads on its own.pretnja · malware
-
№ 044
Vulnerability Management Continuous process of discovering, classifying, prioritizing, and remediating vulnerabilities.odbrana · governance
-
№ 035
Website Defacement Unauthorized modification of website content to send a message.tehnika · exfiltration / impact
-
№ 033
Whaling Whaling is targeted phishing aimed at senior management, owners, directors and people who can approve large decisions. The target is not chosen by chance. The attacker knows who they are after and why that person is worth more than an ordinary account.pretnja · social eng.
-
№ 007
Wiper A wiper does not exist to steal or to extort — a wiper destroys data. It erases and overwrites, breaks file systems, and combined with worms and zero-day vulnerabilities it can bring down hundreds or thousands of networks within hours. Unlike ransomware it offers no ransom; recovery was never part of the plan, because the aim is damage, not money.pretnja · malware
-
№ 008
Worm A worm spreads on its own. Unlike a virus it needs no host file and no click from the user — once it is on one machine it immediately looks for the next, and the next, and thousands of devices can be infected within minutes. Replication is its purpose, speed is its weapon, and whatever it carries is the real threat.pretnja · malware
-
№ 004
XDR XDR (Extended Detection and Response) unifies data from endpoints, network, email, and cloud.odbrana · endpoints
-
№ 044
Zero-Day Exploitation Zero-day exploitation uses a vulnerability for which the vendor has no patch yet, or does not know exists. The name says how much time the defense had to prepare: zero days. In practice a victim can be doing everything right, keeping systems and applications up to date, and still be exposed.pretnja · applications