BTL1 key terms

A targeted email attack crafted for a specific person or team using researched details such as colleagues' names, projects, or vendors to make the lure believable and prompt a harmful action.

A packaged set of files and templates an attacker uses to build fake login pages, often including scripts that capture credentials and forward them to a collection address.

Collecting usernames and passwords through deceptive pages, forms, or messages so the attacker can reuse them for account takeover or further intrusion.

Examining email header fields such as Received, Return-Path, Message-ID, and authentication results to trace the message path and identify spoofing or anomalies.

A DNS record listing which mail servers are authorized to send email for a domain, letting receivers flag messages from unauthorized sending hosts.

A cryptographic signature added to outgoing email and published as a DNS key, allowing receivers to verify the message was authorized by the domain and not altered in transit.

A policy record that tells receivers how to handle mail failing SPF or DKIM checks, and can request reports about messages claiming to be from the domain.

Rewriting a live link so it cannot be clicked accidentally, for example replacing dots and scheme separators with bracketed text, while preserving the original address for analysis.

Querying threat intelligence services or blocklists with a link's host and path to learn whether it is associated with malware, phishing, or other malicious activity.

Running a suspicious attachment or link in an isolated environment to observe its behavior, such as file drops, network callbacks, or credential prompts, without risking production systems.

Observable evidence suggesting a system was breached, such as a malicious file hash, unusual domain, registry key, or IP address used by an attacker.

Evidence of adversary behavior or intent in progress, such as unusual process chains or command execution, which focuses detection on technique rather than static artifacts.

A curated knowledge base of adversary tactics and techniques observed in real intrusions, used to organize detections and map incident activity to known behavior.

The patterns describing an actor's goals, methods, and specific operational steps, which are more durable for detection than easily changed artifacts like IP addresses.

A person or group conducting malicious activity, often described by motivation, sophistication, and targeting, such as financially motivated criminals or state-sponsored groups.

A system that aggregates, normalizes, and scores threat data from multiple sources so analysts can search, deduplicate, and share indicators with detection tools.

Information gathered from publicly available sources such as websites, social media, DNS records, and public registries to support investigations and threat assessment.

Querying registration records for a domain or IP address to obtain creation dates, registrant details, and name servers, which can reveal infrastructure patterns or recently registered malicious domains.

Historical records of domain-to-IP resolutions collected by sensors, letting analysts see how infrastructure changed over time and link related malicious domains.

An analytic framework describing an intrusion through four linked features: adversary, infrastructure, capability, and victim, helping analysts pivot between related evidence.

A documented record of who handled evidence, when, and how, from collection through storage and analysis, preserving its integrity for legal or disciplinary proceedings.

Creating a bit-for-bit copy of a storage device or memory space, verified by hash, so analysis can proceed on the copy while the original remains unaltered.

A prioritization principle for collecting the most perishable evidence first, such as memory and network connections, before slower-changing data like disk contents.

Examining a captured memory image for running processes, network connections, loaded modules, and injected code that may not exist on disk.

Windows records of executed programs that store the executable name, run count, and referenced file paths, useful for showing what ran and when.

Registry hives and keys that record system configuration and user activity, such as autorun entries, recently used programs, and mounted devices.

Ordering file system, log, and artifact timestamps chronologically to reconstruct the sequence of events during an incident.

Comparing a computed cryptographic hash of evidence against a known value to confirm the data has not changed during collection, transfer, or storage.

Combining and comparing events from multiple sources, such as endpoint, network, and authentication logs, to identify related activity that a single source would miss.

A structured search against indexed log data using fields, operators, and time ranges to find events matching a hypothesis or detection rule.

Logic that evaluates log events against conditions and thresholds to generate alerts, ideally tuned to reduce false positives while catching the intended behavior.

Reviewing an alert to determine whether it reflects real malicious activity or benign behavior, then documenting the outcome and adjusting rules if needed.

Mapping fields from different log sources into a common schema so searches and correlations work consistently across varied systems.

A documented set of roles, procedures, and communication paths guiding an organization's response to a security incident from detection through recovery.

Actions taken to limit the spread and impact of an incident, such as isolating hosts, disabling accounts, or blocking malicious infrastructure.

Removing the cause of an incident, including malware, attacker accounts, and persistence mechanisms, so the environment can be safely restored.

A post-incident review that examines what happened, what worked, and what should change, producing concrete improvements to detection and response processes.