Search: kernel — Cyber Encyclopedia

166 terms · 75/46/45

39 rezultata za „kernel" · 5 direktnih · 34 povezanih

Pretnje

2 direktna pogotka

№ 010
Rootkit … software can look: sometimes in drivers or in the kernel, out of reach of protective mechanisms, sometimes in the boot phase, even in the motherboard firmware. …
pretnja · malware
№ 020
Privilege Escalation … xploiting a vulnerability in the operating system kernel to go from an ordinary user account to full control of the machine.
pretnja · identity

Tehnike

3 direktna pogotka

№ 017
Rootkit Installation Can operate at user-space, kernel, or firmware (UEFI) level.
tehnika · execution
№ 023
Container Escape … host paths mounted in, dangerous capabilities), a kernel vulnerability, or a too-permissive runtime or orchestrator. Once on the host, the attacker reaches ever …
tehnika · privileges
№ 018
Privilege Escalation Attackers exploit kernel vulnerabilities, misconfigurations, services running with excessive privileges, or weaknesses in access control mechanisms.
tehnika · privileges

↳ Povezano

34 stavke koje koriste „kernel"

№ 020
Access Token Manipulation Token abuse involves stealing or manipulating authentication tokens, session cookies, or access keys to assume the identity of a legitimate user or service. The attacker can use a token without knowing the password.
tehnika · privileges
№ 043
Authentication Bypass An authentication bypass means the attacker reaches a protected part of the system without logging in the ordinary way. They need not know a password. Sometimes a flaw in the logic is enough, or an unprotected endpoint, a predictable token, a misconfigured proxy, or a gap between two steps of the login.
pretnja · applications
№ 006
Backdoor A backdoor is a hidden way in. Once placed or opened, it lets the attacker return to the machine — with no password, no authorization and no entry in the ordinary records. A backdoor can be opened by malware while it runs, but it can equally be a user account nobody watches, or web shell access left on a server.
pretnja · malware
№ 075
Cloud IAM misconfiguration Cloud IAM misconfiguration means a user, a service account, an application or a role holds more rights than it needs. In the cloud an identity is not merely a login. An identity is permission to read data, spin up resources, change networks, assume roles and delete backups.
pretnja · cloud
№ 024
Cloud lateral movement In the cloud, identities can assume roles — temporarily take on another identity's rights. It's built for legitimate delegation, but it becomes lateral movement when an attacker who got one identity chains the steps: identity A can become B, B can become C with more rights, C reaches another account. No new password at each step — just inherited delegation.
tehnika · privileges
№ 003
Credential Abuse Credential abuse involves using stolen, leaked, or otherwise obtained login data to gain unauthorized access to systems and services. The attacker impersonates a legitimate user.
tehnika · initial access
№ 029
Domain Account Discovery Mapping users, groups, permissions, and Active Directory structure.
tehnika · discovery
№ 003
EDR EDR (Endpoint Detection and Response) is a technology that continuously monitors endpoint activity, records events, and enables detection, investigation, and response to threats that bypassed preventive controls.
odbrana · endpoints
№ 001
Endpoint Protection Endpoint protection encompasses software solutions that protect computers, servers, and mobile devices from malicious software and unauthorized activities. It combines classic signature-based malware detection with heuristic analysis and behavior-based detection.
odbrana · endpoints
№ 010
Exploitation Exploitation involves leveraging a flaw in software, hardware, or configuration to execute unauthorized code or bypass security controls. Vulnerabilities can exist in operating systems, applications, network services, or firmware.
tehnika · execution
№ 022
Forge Kerberos Tickets A set of techniques exploiting the Kerberos protocol in Active Directory.
tehnika · privileges
№ 012
Impair Defenses Defense evasion encompasses techniques by which an attacker conceals their activity from security tools, analysts, and automated detection systems. The goal is to remain undetected for as long as possible in the compromised environment.
tehnika · execution
№ 046
Indicator Removal A set of techniques for hindering or preventing digital forensics.
tehnika · evasion
№ 046
Insecure Deserialization Deserialization is the return of a packed object into a form the application can use. The problem arises when an application accepts an object from an untrusted source and handles it as though it were safe. At that point the attacker is not sending mere data but a specially prepared structure that can change the flow of execution.
pretnja · applications
№ 058
Insider Threat An insider threat comes from a person who has, or once had, legitimate access to an organization's systems, data or premises. That can be an employee, a former employee, an administrator, an associate, a supplier or a partner. The trouble is that the access was not necessarily unauthorized to begin with.
pretnja · trust
№ 022
Kerberoasting Kerberoasting is an attack specific to Windows domain networks and Active Directory (AD). User logins are handled by the Kerberos protocol, which issues tickets as proof of identity. In a domain environment there are non-user accounts — service accounts — under which most background tasks and services run, such as databases and business applications. Service accounts are set up so that any user can request a ticket for access to a given service. The catch is that the ticket is encrypted with the service account's password.
pretnja · identity
№ 016
Logging & Monitoring Logging and monitoring involves the systematic recording of activities and events on systems, networks, and applications, along with regular analysis of those records to detect anomalies and security incidents.
odbrana · monitoring / response
№ 017
MDR MDR (Managed Detection and Response) is a service where an external security team provides continuous monitoring, threat detection, and incident response on behalf of an organization. It combines technology with human expertise.
odbrana · monitoring / response
№ 032
Microsegmentation Finer network division at workload or application level, not just VLANs.
odbrana · resilience
№ 025
Network Segmentation Network segmentation is the practice of dividing network infrastructure into smaller, isolated segments with controlled communication between them. The goal is to limit an attacker's ability to move through the network after compromising a single system.
odbrana · resilience
№ 023
Patch Management Patch management is the process of identifying, testing, and applying software updates that fix known vulnerabilities. The goal is to reduce the time window in which an attacker can exploit a known weakness.
odbrana · resilience
№ 045
Penetration Testing Simulation of real attacks to identify vulnerabilities that automated tools miss.
odbrana · governance
№ 011
Persistence Persistence encompasses techniques by which an attacker ensures their access or malicious code survives system reboots, password changes, or other interruptions. The goal is to maintain a foothold in the environment over an extended period.
tehnika · execution
№ 061
Privilege Misuse Privilege misuse arises when somebody uses rights they genuinely hold for actions they have no business reason to take. Unlike privilege escalation, the attacker or insider here does not have to acquire new authority. The trouble is that the existing authority is enough to do damage.
pretnja · trust
№ 010
Privileged Access Management Privileged access management controls, monitors, and records the use of accounts with elevated permissions such as administrator accounts, service accounts, and root access. These accounts are the most valuable targets for attackers as they provide broad access to critical systems.
odbrana · identity / access
№ 038
Remote Code Execution Remote code execution is one of the most dangerous classes of vulnerability, because it lets an attacker run their own code on a vulnerable system from somewhere else entirely. If the application runs on a server, the attacker is no longer merely a user on the outside; they gain a way to influence what the server executes.
pretnja · applications
№ 026
Secure Configuration Secure configuration involves applying established security baselines to all systems, services, and applications in an organization. The goal is to reduce the attack surface by eliminating unnecessary functions, default passwords, and insecure settings.
odbrana · resilience
№ 062
Shared Account Abuse Shared account abuse begins wherever several people use the same username and password. The system then no longer knows who actually did something. It knows only that a particular account was used, which for accountability is the same as knowing nothing.
pretnja · trust
№ 060
Supply Chain Attack A supply chain attack does not always aim at the final victim directly. The attacker compromises software, hardware, a supplier, a build process or an update mechanism before the product or service reaches the user. The victim then carries the problem into their own environment, because it comes from a source they trust.
pretnja · trust
№ 044
Timestomping Changing file timestamps to hide when they were created or modified.
tehnika · evasion
№ 044
Vulnerability Management Continuous process of discovering, classifying, prioritizing, and remediating vulnerabilities.
odbrana · governance
№ 004
XDR XDR (Extended Detection and Response) unifies data from endpoints, network, email, and cloud.
odbrana · endpoints
№ 011
Zero Trust Zero Trust is a security concept that assumes no user, device, or network segment should be automatically trusted, regardless of whether it is inside or outside the corporate network. Every access request is verified before approval.
odbrana · identity / access
№ 044
Zero-Day Exploitation Zero-day exploitation uses a vulnerability for which the vendor has no patch yet, or does not know exists. The name says how much time the defense had to prepare: zero days. In practice a victim can be doing everything right, keeping systems and applications up to date, and still be exposed.
pretnja · applications