CCOA (ISACA) key terms

The combination of source IP address, source port, destination IP address, destination port, and transport protocol that identifies a single network flow. Analysts use it to group packets into conversations and to pivot between firewall, proxy, and flow records.

Regular, repeating outbound connections from a host to the same destination, typical of malware checking in with command-and-control infrastructure. Detection relies on low variance in connection intervals, consistent payload sizes, and destinations with poor reputation.

Deliberate randomization of sleep intervals between beacon connections so traffic does not appear perfectly periodic. Higher jitter makes timing-based detection harder, so analysts also weigh payload size, URI patterns, and destination reputation.

The channel and infrastructure an attacker uses to send instructions to compromised hosts and receive results. It may ride over HTTP, DNS, TLS, or a legitimate cloud service, which is why detection blends traffic metadata with endpoint evidence.

Encapsulating data inside DNS queries and responses to move traffic past controls that permit DNS. Signs include unusually long or high-entropy labels, rare record types such as TXT, high query volume to one domain, and many unique subdomains.

Rapidly rotating the IP addresses returned for a domain, often with short DNS time-to-live values, to keep malicious infrastructure alive despite takedown attempts. Analysts see many A records and frequent address changes for one hostname.

Sending a TLS SNI value for a permitted front domain while the HTTP Host header names a different blocked domain hosted on the same content delivery network. It hides the true destination from network inspection that only reads one layer.

A TLS handshake field that carries the hostname the client wants to reach, visible even when the session is encrypted. Proxy and intrusion detection logs record it, making it a key pivot when full packet decryption is unavailable.

A hash derived from the fields a client (JA3) or server (JA3S) offers during a TLS handshake, such as cipher suites and extensions. It identifies tooling families even when traffic is encrypted and certificates or domains change.

Summarized connection metadata exported by routers and firewalls, typically covering addresses, ports, protocol, byte and packet counts, and timestamps. It supports volume analysis and lateral movement hunting without storing full packet contents.

Storage of complete packet payloads for later reconstruction and protocol-level analysis. It provides the richest network evidence but is expensive to retain, so it is usually limited by time window or filtered to high-value segments.

The standard file format for saved packet captures, readable by tools such as Wireshark and tcpdump. Investigators extract transferred files, reconstruct sessions, and confirm whether a suspicious connection actually carried malicious content.

The parent-child hierarchy of running processes on a host, showing which program launched which. Unexpected parents, such as a word processor spawning a shell or a web server spawning a scripting interpreter, are strong evidence of exploitation.

A process launch relationship that deviates from normal baselines for that environment, such as an email client starting PowerShell. It is one of the most reliable host-based indicators and is best confirmed against a known-good process inventory.

Abusing signed, preinstalled system utilities such as PowerShell, certutil, or rundll32 to download, decode, or execute payloads. Because the binaries are legitimate, detection depends on command-line content and context rather than file reputation.

Logging the full command line of every process start, including arguments and working directory. It exposes encoded scripts, download URLs, and credential access flags that process names alone would hide.

Any configuration change that lets attacker code survive reboot or logoff, such as a scheduled task, run key, service, or startup folder entry. Investigators enumerate these to find all footholds before declaring containment complete.

A Sysinternals utility that enumerates autostart locations including logon entries, services, drivers, scheduled tasks, and browser extensions. Analysts use it to spot unsigned or oddly located binaries configured to launch automatically.

A Windows registry location under which a value causes a program to start at user logon. Unfamiliar values pointing to user-writable paths or script interpreters are a common, easily checked persistence indicator.

Windows files recording execution history for programs, including run count and referenced file paths. They help confirm whether a suspicious binary actually ran and roughly when, even if the file was later deleted.

A Windows compatibility database that records paths and timestamps of executables the system has encountered. It evidences file presence and possible execution but not proof of launch, so it is correlated with Prefetch or event logs.

A Windows registry hive storing metadata about installed and executed programs, including file paths, hashes, and first-seen times. It is useful for proving a suspicious binary existed on disk and for matching it to known-bad hashes.

The Master File Table in NTFS, holding a record for every file and directory with timestamps, size, and allocated clusters. Parsing it can recover deleted file names and reveal timestomping inconsistencies.

Altering file timestamps to make malicious files blend with legitimate ones or to frustrate timeline analysis. Inconsistencies between creation, modification, and access times, or between MFT and log records, expose the manipulation.

A Windows service that writes detailed event logs for process creation, network connections, file creation, registry changes, and image loads. Its event IDs, such as 1, 3, 11, and 22, anchor most host-based detection rules.

A numeric code identifying the type of a logged event within a specific log source. Correct interpretation depends on knowing the source, since the same number means different things in Security, System, and Sysmon logs.

The record written when a logon succeeds, including logon type, account, source address, and authentication package. Logon type 3 indicates network access and type 10 indicates remote desktop, which helps scope lateral movement.

The record written when a logon attempt fails, capturing the target account and failure reason. Clusters of these events across many accounts indicate password spraying, while repeats against one account suggest brute force.

Mapping fields from diverse sources into a common schema so events can be searched and correlated consistently. It enables cross-device queries such as matching a firewall destination with a host process making that connection.

A platform that centralizes logs from many sources, indexes them for search, and evaluates detection rules against the stream. Analysts use it for correlation, alerting, dashboards, and retrospective hunting across retained data.

Logic that triggers an alert when multiple events or conditions occur together within a defined time window. Examples include several failed logons followed by a success, or a process creating a connection to a low-reputation domain.

Firing an alert only when an event count crosses a set limit within a period, which suppresses noise from isolated occurrences. Thresholds must be tuned to environment baselines or they generate excessive false positives.

An alert raised for activity that is actually benign, such as an administrative script that resembles attacker tooling. Tracking and tuning false positives preserves analyst trust and keeps detection rules meaningful.

An observable such as a file hash, domain, IP address, or registry key associated with known malicious activity. IOCs are easy to share and search but decay quickly as attackers rotate infrastructure.

Evidence of adversary behavior or intent, such as credential dumping or lateral movement patterns, rather than a specific atomic value. IOAs survive infrastructure changes and generally produce more durable detections than IOCs.

A sharing marking that defines how widely information may be distributed, from restricted (RED) to fully public (CLEAR). Analysts must honor the marking when forwarding indicators to partners or including them in reports.

A system that ingests, deduplicates, scores, and distributes threat intelligence feeds to detection tools. It tracks indicator age and confidence so stale or low-quality data does not drive alerting.

A historical record of domain-to-IP resolutions collected from recursive resolvers and sensors. It reveals infrastructure overlap, fast flux behavior, and domains that recently pointed to known malicious addresses.

A fixed-length digest computed from file contents that identifies a specific sample. SHA-256 is preferred for sharing and matching; MD5 still appears in older feeds and tools but is vulnerable to crafted collisions.

A documented adversary method with a unique identifier, organized by tactic, such as T1059 for command and scripting interpreters. Mapping detections and findings to techniques communicates coverage and gaps consistently.

The response phase that stops the spread of an intrusion, for example by isolating a host, disabling an account, or blocking a domain. It is chosen to limit damage while preserving evidence needed for investigation.

Removing the attacker's foothold entirely, including malware, persistence, and compromised credentials. It follows containment and must be verified before recovery, or the intrusion resurfaces during the return to normal operations.

A rating of an incident's business and technical impact that drives priority, staffing, and notification obligations. It weighs data sensitivity, number of affected hosts, privilege level reached, and whether the activity is ongoing.

The defined sequence of people and teams to notify as an incident grows in scope or severity, with trigger criteria and time expectations. Clear paths prevent delays and ensure the right authority approves disruptive actions.

A documented record of who handled evidence, when, and what was done to it, from collection through storage and analysis. Gaps or undocumented access can render evidence unusable in legal or disciplinary proceedings.

Evidence that disappears when a system is powered off, such as memory contents, running processes, network connections, and logged-in sessions. It should be captured first, in a documented order, before shutdown or reimaging.

A bit-for-bit copy of a storage device, verified by hash, that analysts examine instead of the original. It preserves evidence integrity while allowing repeated analysis and recovery of deleted content.

Running a suspicious file in an isolated instrumented environment to observe its behavior, including file, registry, and network activity. Results yield behavioral indicators and often the C2 addresses contacted during execution.

Examining a file without executing it, using strings, headers, imports, and code inspection to infer capability. It is safe and fast but can be defeated by packing or obfuscation, so it is paired with dynamic methods.

Compressing or encrypting an executable so its original code is hidden until runtime, often to evade signature detection. High entropy, few imports, and a small unpacking stub in a large file are typical signs.

A malware capability that ensures execution after reboot, logoff, or removal attempts, using mechanisms such as services, scheduled tasks, or registry keys. Identifying it determines what must be cleaned during eradication.

Techniques malware or an intruder uses to avoid detection, such as disabling logging, masquerading as a system process, or clearing event logs. These actions often generate their own detectable artifacts.

A check malware performs before acting, such as verifying the host is not a sandbox or that a specific file or domain exists. Guardrails explain why a sample behaves benignly in analysis but maliciously in production.

A chronological reconstruction of attacker and defender actions built from multiple evidence sources. It establishes initial access, dwell time, and scope, and it underpins both the report narrative and lessons learned.

The opening section of a report that states what happened, the business impact, current status, and recommended actions in plain language. It must stand alone for readers who will not read the technical detail that follows.

The report section pairing each observed weakness or gap with a specific, prioritized remediation action and owner. Vague advice such as improving security awareness is replaced by concrete, verifiable steps.

Comparing existing detections against a framework such as MITRE ATT&CK to show which techniques are covered and which are blind. It guides rule development and communicates residual risk to leadership.