166 terms ·
75/46/45
96 rezultata za „persistence" ·
7 direktnih ·
89 povezanih
Pretnje
4 direktna pogotka-
№ 006
Backdoor A backdoor is a hidden way in. Once placed or opened, it lets the attacker return to the machine — with no password, no authorization and no entry in the ordinary records. A backdoor can be opened by malware while it runs, but it can equally be a user account nobody watches, or web shell access left on a server.pretnja · malware
-
№ 010
Rootkit A rootkit is defined by persistence and invisibility. It gives the attacker privileged access while concealing malicious processes, files and connections from s …pretnja · malware
-
№ 060
Supply Chain Attack A supply chain attack does not always aim at the final victim directly. The attacker compromises software, hardware, a supplier, a build process or an update mechanism before the product or service reaches the user. The victim then carries the problem into their own environment, because it comes from a source they trust.pretnja · trust
-
№ 011
Fileless malware … icuous file. A restart clears it from memory, but persistence techniques bring it back.pretnja · malware
Tehnike
3 direktna pogotka-
№ 011
Persistence Persistence encompasses techniques by which an attacker ensures their access or malicious code survives system reboots, password changes, or other interruptions …tehnika · execution
-
№ 003
Credential Abuse Credential abuse involves using stolen, leaked, or otherwise obtained login data to gain unauthorized access to systems and services. The attacker impersonates a legitimate user.tehnika · initial access
-
№ 017
Rootkit Installation Technique of installing a rootkit to deeply hide presence on a system.tehnika · execution
↳ Povezano
89 stavki koje koriste „persistence"-
№ 042
API Abuse API abuse arises when an attacker uses a programming interface in a way the application did not anticipate or did not restrict enough. An API is not merely a technical add-on to the application. It is often the main entrance to the data, the users, the orders, the payments and the administration.pretnja · applications
-
№ 021
Account Takeover Account takeover is the moment the attacker gains full control of an account — not only access, but the ability to change the password, the recovery mail address, the phone number and the second factor, while the real owner is shut out with no technical way back in on their own. Takeover is rarely the first stage of an attack. It is usually the destination of what came before: phishing, credential stuffing, token theft.pretnja · identity
-
№ 043
Authentication Bypass An authentication bypass means the attacker reaches a protected part of the system without logging in the ordinary way. They need not know a password. Sometimes a flaw in the logic is enough, or an unprotected endpoint, a predictable token, a misconfigured proxy, or a gap between two steps of the login.pretnja · applications
-
№ 015
Brute-force attack A brute-force attack breaks into an account by trying to log in over and over: automated tools work through password after password until one takes. It succeeds against short, weak and common passwords, and against systems that put no limit on failed attempts. It is not clever — it is only fast, and it can run for days.pretnja · identity
-
№ 028
Business Email Compromise Business email compromise is not an ordinary fake email. The attacker breaks into business correspondence, or imitates it well enough that somebody in the company believes the request comes from the director, from finance, from a supplier, a lawyer or a partner. The aim is usually money, but it can also be a confidential document, a change of payment details, or an opening for the next phase of the attack.pretnja · social eng.
-
№ 013
Certificate Management Managing the lifecycle of digital certificates — issuance, renewal, revocation.odbrana · identity / access
-
№ 075
Cloud IAM misconfiguration Cloud IAM misconfiguration means a user, a service account, an application or a role holds more rights than it needs. In the cloud an identity is not merely a login. An identity is permission to read data, spin up resources, change networks, assume roles and delete backups.pretnja · cloud
-
№ 039
Command & Control Command and control communication involves establishing a persistent channel between the attacker and the compromised system for sending commands and receiving results. The attacker uses this channel to manage malware, launch new attack phases, and retrieve data.tehnika · C2
-
№ 023
Container Escape Containers are meant to isolate an application from the host and from other containers. Container escape is when an attacker controlling a process inside a container breaks that isolation and reaches the host (or other containers). From an application-level foothold they get host-level reach.tehnika · privileges
-
№ 063
Contractor Abuse Contractor access abuse arises when a consultant, a contractor, an external firm or a temporarily engaged person uses access more widely or for longer than the work requires. The access is often granted legitimately, but afterwards it is not monitored, not narrowed and not withdrawn in time.pretnja · trust
-
№ 017
Credential stuffing Credential stuffing does not go after unknown passwords; it tries known ones. With username and password pairs from databases leaked across the internet, the attacker tries the most-used services such as Facebook and Instagram, counting on people reusing the same credentials on several services — which in most cases holds.pretnja · identity
-
№ 041
Cross-Site Request Forgery Cross-site request forgery, or CSRF, exploits the fact that a browser automatically sends existing session cookies to a site where the user is already logged in. The attacker does not need to know the password. It is enough to lead the user down the wrong path.pretnja · applications
-
№ 040
Cross-Site Scripting Cross-site scripting, better known as XSS, arises when a web application allows somebody else's script to be displayed and executed in the user's browser. The attacker does not have to break into the web server. It is enough for their code to end up in a page the victim opens as though it were entirely legitimate.pretnja · applications
-
№ 016
DLL Sideloading Technique of loading a malicious DLL through a legitimate program that requests it.tehnika · execution
-
№ 036
DNS Tunneling Technique of exfiltrating data or C2 communication through DNS queries.tehnika · exfiltration / impact
-
№ 031
Deception Technology Deploying decoy resources (honeypots, honeytokens) to detect attackers.odbrana · resilience
-
№ 035
Deepfake Attack A deepfake attack uses an artificially generated voice, image or video so that somebody can pose as a real person. In cyber attacks this usually means the director's voice on a call, a colleague's face in a video meeting, or a recording that feels real enough for the victim to accept the request.pretnja · social eng.
-
№ 040
DevSecOps Integrating security into all phases of the software development lifecycle.odbrana · people
-
№ 040
Domain Fronting Technique of hiding C2 traffic behind legitimate CDN domains.tehnika · C2
-
№ 003
EDR EDR (Endpoint Detection and Response) is a technology that continuously monitors endpoint activity, records events, and enables detection, investigation, and response to threats that bypassed preventive controls.odbrana · endpoints
-
№ 042
Encrypted C2 Channels Using HTTPS, DNS-over-HTTPS, or other encrypted protocols for C2.tehnika · C2
-
№ 001
Endpoint Protection Endpoint protection encompasses software solutions that protect computers, servers, and mobile devices from malicious software and unauthorized activities. It combines classic signature-based malware detection with heuristic analysis and behavior-based detection.odbrana · endpoints
-
№ 068
Evil Twin A fake Wi-Fi network, known as an evil twin, imitates a legitimate wireless network so that users connect to an access point the attacker controls. The network name looks familiar, the signal can be stronger, and the device often suggests or restores the connection by itself.pretnja · physical / IoT
-
№ 010
Exploitation Exploitation involves leveraging a flaw in software, hardware, or configuration to execute unauthorized code or bypass security controls. Vulnerabilities can exist in operating systems, applications, network services, or firmware.tehnika · execution
-
№ 035
Firewall A firewall is a control placed at the boundary between networks that permits or blocks traffic according to predefined rules — deciding who may talk to whom, on which ports and protocols.odbrana · resilience
-
№ 022
IDS/IPS IDS/IPS are systems that monitor network traffic (or host activity) for patterns indicating an attack. An IDS (Intrusion Detection System) only reports suspicious activity; an IPS (Intrusion Prevention System) sits inline and can block it immediately.odbrana · monitoring / response
-
№ 009
Identity & Access Management Identity and access management encompasses the policies, processes, and technologies for creating, managing, and revoking digital identities and their access rights. The goal is to ensure the right users have the right access to the right resources at the right time.odbrana · identity / access
-
№ 012
Impair Defenses Defense evasion encompasses techniques by which an attacker conceals their activity from security tools, analysts, and automated detection systems. The goal is to remain undetected for as long as possible in the compromised environment.tehnika · execution
-
№ 014
In-Memory Execution Executing malicious code in memory without writing files to disk.tehnika · execution
-
№ 020
Incident Response A planned process of identifying, containing, eradicating, and recovering from cyber incidents.odbrana · monitoring / response
-
№ 046
Indicator Removal A set of techniques for hindering or preventing digital forensics.tehnika · evasion
-
№ 012
Infostealer An infostealer has one basic role: to collect your credentials. Saved browser passwords, cookies and session tokens, autofill data, crypto wallet keys — all of it is of interest. It stays in contact with the attacker and sends on what it gathers. When the job is done it can delete itself and disappear.pretnja · malware
-
№ 058
Insider Threat An insider threat comes from a person who has, or once had, legitimate access to an organization's systems, data or premises. That can be an employee, a former employee, an administrator, an associate, a supplier or a partner. The trouble is that the access was not necessarily unauthorized to begin with.pretnja · trust
-
№ 067
IoT Device Compromise IoT device compromise hits cameras, routers, sensors, smart televisions, locks, controllers and all the equipment connected to a network that does not behave like a classic computer. The problem is that these devices are often forgotten the moment they are switched on.pretnja · physical / IoT
-
№ 022
Kerberoasting Kerberoasting is an attack specific to Windows domain networks and Active Directory (AD). User logins are handled by the Kerberos protocol, which issues tickets as proof of identity. In a domain environment there are non-user accounts — service accounts — under which most background tasks and services run, such as databases and business applications. Service accounts are set up so that any user can request a ticket for access to a given service. The catch is that the ticket is encrypted with the service account's password.pretnja · identity
-
№ 004
Keylogger A keylogger is a program or hardware device that records every keystroke. Software keyloggers run covertly in the background, while hardware variants can be physically attached between the keyboard and the computer.pretnja · malware
-
№ 015
Living off the Land Using legitimate system tools to execute malicious actions.tehnika · execution
-
№ 005
Loader / Dropper Loaders and droppers are couriers. Their only job is to deliver the infection to the machine. A dropper carries the payload with it and writes it to the system; a loader is usually smaller and pulls the payload from the internet only once it has landed. Neither does anything more than that — and that is their advantage.pretnja · malware
-
№ 043
Log Tampering Deleting, modifying, or disabling logs to hide activity.tehnika · evasion
-
№ 016
Logging & Monitoring Logging and monitoring involves the systematic recording of activities and events on systems, networks, and applications, along with regular analysis of those records to detect anomalies and security incidents.odbrana · monitoring / response
-
№ 017
MDR MDR (Managed Detection and Response) is a service where an external security team provides continuous monitoring, threat detection, and incident response on behalf of an organization. It combines technology with human expertise.odbrana · monitoring / response
-
№ 024
MFA Fatigue MFA fatigue is social-engineering pressure applied to two-factor authentication. The attacker has the password, leaked or phished, but is stopped at the second factor — a confirmation the user has to approve on their phone. So the attacker starts the login over and over, burying the phone in approval requests. The arithmetic is simple: out of irritation, confusion, or the thought that it must be some glitch, the user approves one at some point — and the attacker is through the whole authentication.pretnja · identity
-
№ 038
Malware Delivery Malware delivery encompasses the methods by which malicious software is transferred to a target system. This includes infected attachments, compromised websites, malicious ads, removable media, and compromised software updates.tehnika · C2
-
№ 005
Mobile Device Security Managing and protecting mobile devices through MDM and MAM solutions.odbrana · endpoints
-
№ 008
Multi-Factor Authentication Multi-factor authentication requires two or more independent proofs of identity at login. It typically combines something the user knows (password), something they possess (phone, hardware key), and something they are (biometrics).odbrana · identity / access
-
№ 025
Network Segmentation Network segmentation is the practice of dividing network infrastructure into smaller, isolated segments with controlled communication between them. The goal is to limit an attacker's ability to move through the network after compromising a single system.odbrana · resilience
-
№ 023
Pass-the-Hash So that it does not keep the password in readable form, Windows remembers its cryptographic fingerprint — the hash. With older Windows authentication (NTLM), the password is not required to prove identity; the hash is enough. Pass-the-hash abuses exactly that: if the attacker obtains a user's hash, they can log in with it without ever learning the real password.pretnja · identity
-
№ 012
Password Manager Tool for generating, storing, and auto-filling strong, unique passwords.odbrana · identity / access
-
№ 016
Password spraying Password spraying is brute force turned around. Instead of trying many passwords on one account, the attacker tries common passwords across many accounts. That avoids lockout, because each individual account sees only an attempt or two.pretnja · identity
-
№ 026
Phishing Phishing is the most widespread form of social-engineering attack and, in a great many cases, the first link in any serious break-in. The attacker sends a message that appears to come from a known organization — a bank, a courier, a government service, a colleague — and leads the victim into doing one of three things: clicking a link, opening an attachment, or entering their credentials somewhere.pretnja · social eng.
-
№ 071
Physical Access Attack Physical access is the oldest form of compromise: the attacker reaches the device, the room, a port, a cable or a piece of paper. Once somebody can sit down at a computer, walk up to a server, put a device into a port or carry a laptop away, digital protection no longer helps.pretnja · physical / IoT
-
№ 031
Pretexting Pretexting is social engineering with a prepared story. The attacker does not simply send a link and wait for a click; they build a scenario in which what they are doing looks normal. They present themselves as a colleague, technical support, an auditor, a bank, a supplier, a courier or an official.pretnja · social eng.
-
№ 020
Privilege Escalation Privilege escalation is the attempt by an attacker who already holds some level of access to widen their rights in order to move through the network. Escalation is rarely the first stage — it comes after entry through, say, an ordinary user account or a compromised service. It takes the attacker from the crack they slipped through to control of the whole system. There are two directions: vertical escalation, from an ordinary user to domain administrator, and horizontal, moving from one account to another user's resources at the same level of rights.pretnja · identity
-
№ 018
Privilege Escalation Privilege escalation is a technique by which an attacker with limited access gains a higher level of authorization. Vertical escalation means reaching administrator or root level, while horizontal escalation means accessing another user's resources at the same privilege level.tehnika · privileges
-
№ 061
Privilege Misuse Privilege misuse arises when somebody uses rights they genuinely hold for actions they have no business reason to take. Unlike privilege escalation, the attacker or insider here does not have to acquire new authority. The trouble is that the existing authority is enough to do damage.pretnja · trust
-
№ 010
Privileged Access Management Privileged access management controls, monitors, and records the use of accounts with elevated permissions such as administrator accounts, service accounts, and root access. These accounts are the most valuable targets for attackers as they provide broad access to critical systems.odbrana · identity / access
-
№ 045
Process Injection Injecting malicious code into the address space of a legitimate process.tehnika · evasion
-
№ 034
QR phishing - Quishing Quishing is phishing through a QR code. Instead of a visible link, the user is given an image to scan with their phone. The QR code then takes them to a fake page for a login, a payment, a document download or an account confirmation.pretnja · social eng.
-
№ 043
Regulatory Compliance Meeting requirements of regulatory frameworks and standards for cybersecurity.odbrana · governance
-
№ 014
Remote access trojan - RAT A RAT gives the attacker remote control of your machine. Once inside they can browse files, switch on the camera and microphone, record what you type and run commands — all of it live, as if sitting in front of your screen. It resembles remote support tools, only on the wrong side of the law.pretnja · malware
-
№ 041
Risk Assessment Systematic process of identifying, analyzing, and prioritizing cyber risks.odbrana · governance
-
№ 015
SIEM SIEM (Security Information and Event Management) is a system that collects logs and events from diverse sources across the entire infrastructure, centralizes them, and applies correlation rules to detect suspicious patterns and security incidents.odbrana · monitoring / response
-
№ 025
SIM Swapping SIM swapping does not attack the phone but the phone number. The attacker persuades, or bribes, a mobile operator to move the number to a new SIM card, citing a lost phone or a damaged card. They usually come armed with personal details from leaked databases and phishing. The moment the number moves to their card, the real phone loses signal and every call and message goes to the attacker.pretnja · identity
-
№ 030
SMS phishing - Smishing Smishing is phishing over SMS or messaging apps. The attacker sends a short message with a link, a request to confirm something, or an instruction for an urgent action, counting on messages being read quickly on a phone and without much checking.pretnja · social eng.
-
№ 018
SOAR Security Orchestration, Automation and Response — automating security operations.odbrana · monitoring / response
-
№ 039
SQL Injection SQL injection usually arises when a web application passes user input blindly to the database on the web server. Instead of ordinary text, the attacker can put part of an SQL command into a login, search or filter field. If the application does not stop it, the database can execute something the designer never had in mind, and certainly never intended.pretnja · applications
-
№ 045
SSRF SSRF is a vulnerability in which the attacker gets a web server to send a request to an address of the attacker's choosing. The distinction matters: the request is not sent by the user's browser but by the server. That opens the door to internal services which from the outside ought to remain invisible.pretnja · applications
-
№ 014
Secrets Management Applications, scripts, and services need secrets to do their work — passwords, API keys, certificates, database connection strings. The wrong place for them is code, a config file, a repository, or a chat message. Secrets management means a central, protected store (a vault) from which an application fetches a secret exactly when it needs it, instead of carrying it around in plaintext.odbrana · identity / access
-
№ 026
Secure Configuration Secure configuration involves applying established security baselines to all systems, services, and applications in an organization. The goal is to reduce the attack surface by eliminating unnecessary functions, default passwords, and insecure settings.odbrana · resilience
-
№ 037
Security Awareness Employee education programs about cyber threats and safe behavior.odbrana · people
-
№ 039
Security Champions An ambassador program for security within development and business teams.odbrana · people
-
№ 042
Security Policies Formal documents defining an organization's cybersecurity rules and standards.odbrana · governance
-
№ 054
Service Abuse Service abuse uses legitimate functions of a system in an unforeseen way. The attacker does not have to find a classic vulnerability. It is enough to work out how a normal function can be automated, overloaded, or turned against the service and its users.pretnja · availability
-
№ 019
Session Hijacking When you log in, the service opens a session — a state that remembers you are you, together with everything that goes with it, such as your preferences and settings. The main benefit is that you do not have to type a password every few minutes as you move through the features. That session is marked by an identifier, usually held in a browser cookie. Session hijacking is the taking over of a session that is already open. The attacker does not attack the login; they slip into a session that has already passed authentication and carry on operating the service in your name.pretnja · identity
-
№ 064
Shadow IT Shadow IT is the use of applications, cloud services, accounts and tools without the knowledge or approval of the IT team. Employees usually do not bring them in to cause a problem but to get the work done faster: a file needs sharing, a team needs a chat, marketing needs a tool, sales needs a PDF now.pretnja · trust
-
№ 062
Shared Account Abuse Shared account abuse begins wherever several people use the same username and password. The system then no longer knows who actually did something. It knows only that a particular account was used, which for accountability is the same as knowing nothing.pretnja · trust
-
№ 027
Spear Phishing Spear phishing is phishing cut to fit one person or a small group of users. Instead of sending the same message to thousands of addresses, the attacker first gathers information about the victim — where they work, who they work with, what they are working on right now, how the company addresses its clients — and then writes a message that reads as if it came from that world.pretnja · social eng.
-
№ 006
Supply Chain Compromise Technique of injecting malicious code into the software supply chain.tehnika · initial access
-
№ 059
Third-Party Compromise Third-party compromise happens when the attacker does not go at an organization directly but at a supplier, a partner, a service provider or an external associate who already holds some form of trust and authorized access. Instead of forcing the front door, the attacker looks for a side entrance somebody else has already opened.pretnja · trust
-
№ 019
Threat Intelligence Collecting, analyzing, and applying data about current cyber threats.odbrana · monitoring / response
-
№ 044
Timestomping Changing file timestamps to hide when they were created or modified.tehnika · evasion
-
№ 018
Token Theft A token is proof that you have already logged in. When you sign in and confirm your identity with a second factor, the service issues a token, stored in the browser, which vouches that you have already been checked the next time round. The token is sent automatically with every further request, so you do not have to type the password again. Token theft is the taking of that proof. With it in hand, the attacker presents themselves as you — without your password and without the second factor, because both have already been approved.pretnja · identity
-
№ 002
Trojan A Trojan does not break in; the victim opens the door. It usually presents itself as something useful — a program or a document, a fake installer, a cracked application, or a harmless-looking tool for speeding up the computer. The user runs what they meant to run, and the attacker gets what they were after.pretnja · malware
-
№ 036
Virtual Private Network A VPN (virtual private network) creates an encrypted tunnel between a device and the network it connects to. For an organization this primarily means controlled remote access to internal resources — from home, on the road, in the field. Traffic inside the tunnel cannot be read in transit, even on hotel Wi-Fi.odbrana · resilience
-
№ 009
Virus A virus embeds itself in other executable files and runs together with them. It starts when the user launches the application or opens the infected file, and often attaches itself to other running processes and applications. That is what separates it from a worm: a virus needs a host and a user, while a worm spreads on its own.pretnja · malware
-
№ 033
Whaling Whaling is targeted phishing aimed at senior management, owners, directors and people who can approve large decisions. The target is not chosen by chance. The attacker knows who they are after and why that person is worth more than an ordinary account.pretnja · social eng.
-
№ 004
XDR XDR (Extended Detection and Response) unifies data from endpoints, network, email, and cloud.odbrana · endpoints
-
№ 011
Zero Trust Zero Trust is a security concept that assumes no user, device, or network segment should be automatically trusted, regardless of whether it is inside or outside the corporate network. Every access request is verified before approval.odbrana · identity / access
-
№ 029
voice phishing - Vishing Vishing is phishing over the telephone. Instead of an email and a link, the attacker uses a voice, a phone number and the pressure of the moment. They present themselves as a bank, technical support, a courier, the police, the tax office, or somebody from the company, while trying to extract details or lead the victim into doing something they otherwise would not.pretnja · social eng.