CSA (EC-Council Certifications) key terms

A piece of evidence suggesting a system or network has been breached, such as a malicious file hash, suspicious IP address, unusual domain, or registry key. Analysts use IoCs to detect and confirm intrusions.

Evidence of adversary behavior or intent in progress, such as privilege escalation attempts or lateral movement, rather than a static artifact. IOAs focus on what an attacker is doing and can catch novel attacks.

A curated knowledge base of real-world adversary tactics and techniques organized by stage of attack. Defenders map detections and controls to its technique IDs to find coverage gaps.

The behavioral patterns of an attacker: the high-level goal (tactic), the method used (technique), and the specific implementation details (procedure). TTPs are more durable detection targets than hashes or IPs.

A model describing the sequential phases of an intrusion, from reconnaissance through exploitation, installation, command and control, and actions on objectives. Defenders aim to break the chain at any phase.

The channel an attacker uses to communicate with compromised systems, issuing instructions and receiving data. C2 traffic is often disguised as normal web or DNS traffic to evade detection.

Regular, periodic outbound communication from malware to its controller, producing predictable timing patterns. Detecting repeated connections at fixed intervals is a common network indicator of compromise.

A social engineering attack that tricks a recipient into revealing credentials, clicking a malicious link, or opening an infected attachment, typically delivered by email. Variants include spear phishing and whaling.

A targeted phishing message crafted for a specific person or small group using researched details to appear credible. Because it is tailored, it is harder to spot than mass phishing.

Fraud in which an attacker impersonates an executive, vendor, or colleague to trick staff into transferring funds or data. It often involves no malware, relying on deception and mailbox access.

Manipulating people through trust, urgency, or authority to get them to disclose information or perform unsafe actions. It targets human behavior rather than technical flaws.

Malware that encrypts or steals data and demands payment for its release or to prevent disclosure. Modern variants often exfiltrate data first and threaten publication to pressure victims.

Malicious activity that runs in memory or through legitimate system tools rather than dropping executable files on disk. It leaves few traditional file artifacts, complicating detection.

An attacker technique using built-in, legitimate operating system utilities to perform malicious actions, such as reconnaissance or downloading payloads. Because the tools are trusted, activity can blend with normal administration.

A platform that collects logs and events from many sources, normalizes them, correlates activity, and generates alerts. It provides centralized visibility and supports investigation and reporting.

Centralizing log data from disparate systems into one repository for search, retention, and analysis. It enables cross-source correlation and consistent retention policies.

Parsing and transforming log records from different formats into a common schema so fields can be compared and correlated. Without it, matching events across vendors becomes unreliable.

A logic statement in a SIEM that links multiple events or conditions across sources to produce an alert, such as several failed logins followed by a success. Poorly tuned rules cause false positives.

The process of reviewing, prioritizing, and validating alerts to decide which require investigation. It separates genuine incidents from benign noise and sets response priority.

An alert that fires for legitimate activity rather than an actual threat. Excessive false positives cause alert fatigue and can hide real detections.

The policy defining how long log data is kept and how it is protected before deletion. Retention must satisfy legal, regulatory, and investigative needs while controlling storage cost.

A standard protocol and message format for sending log events from devices to a central collector, typically over UDP or TCP port 514. It is widely used to ship network and system logs to a SIEM.

The built-in logging system in Windows that records security, system, and application events with numeric event IDs. Security auditing settings determine which activities are recorded.

A summary record of network connections showing source and destination addresses, ports, protocol, byte counts, and timestamps, but not payload content. It is useful for spotting anomalous traffic patterns.

Recording raw network traffic on an interface for later inspection, commonly with tools like tcpdump or Wireshark. Full packet data allows deep protocol analysis but consumes significant storage.

A sensor that monitors network or host activity and raises alerts on suspicious patterns. A network IDS inspects traffic at a tap or span port without blocking it.

A device deployed inline that detects malicious traffic and can actively block or drop it. Because it sits in the traffic path, false positives can disrupt legitimate business traffic.

Identifying attacks by matching activity against known patterns, such as byte sequences or rule sets. It catches known threats well but misses novel or heavily modified attacks.

Flagging activity that deviates from an established baseline of normal behavior. It can catch unknown attacks but often produces false positives when legitimate behavior changes.

A documented snapshot of normal system, network, or configuration state used as a reference for comparison. Deviations from the baseline can indicate compromise or unauthorized change.

Agent software on hosts that continuously records process, file, and network activity and enables investigation and containment. It provides deep telemetry that traditional antivirus lacks.

Any device that connects to the network and can run code, such as a workstation, server, or mobile device. Endpoints are frequent targets and require monitoring and hardening.

Firewall software running on an individual device that filters its inbound and outbound traffic by rule. It adds a layer of control beyond perimeter defenses and can restrict lateral movement.

Dividing a network into isolated zones with controlled traffic between them, limiting how far an attacker can move. It reduces blast radius and supports least-privilege access.

Techniques an attacker uses to move from one compromised host to others within a network, seeking higher privileges or valuable data. Segmentation and monitoring help detect and slow it.

Gaining a higher level of access than originally granted, such as moving from a standard user to administrator or root. It is often a required step before broader compromise.

Granting users and systems only the access necessary to perform their tasks. It limits the damage an attacker can do with a compromised account.

A documented set of roles, procedures, and communication paths for handling security incidents. It typically follows preparation, detection and analysis, containment, eradication, recovery, and lessons learned.

The incident response phase of limiting the spread and impact of a compromise, for example by isolating hosts or disabling accounts. It precedes eradication and recovery.

Removing the root cause of an incident, such as deleting malware, closing the exploited vulnerability, or resetting compromised credentials. Recovery follows once the threat is eliminated.

A documented, unbroken record of who handled evidence, when, and how, from collection through storage and analysis. It preserves evidence integrity and admissibility.

The principle of collecting the most perishable evidence first, such as memory and network connections, before more persistent data like disk contents. It prevents loss of time-sensitive artifacts.

Creating a bit-for-bit copy of a storage device or memory for analysis while preserving the original as evidence. Investigators work from the copy and verify it with a hash.

Communicating incident details to the appropriate internal and external parties, such as management, legal, regulators, or affected customers, within required timeframes. Accuracy and timeliness are essential.

Tailoring incident updates to different audiences, such as executives, technical teams, and customers, so each receives relevant detail without unnecessary confusion. It supports coordinated, consistent messaging.

Unauthorized transfer of data from a compromised environment to an attacker-controlled location. It may occur over the same channel as command and control or via separate covert paths.

A pattern-matching rule written to identify malware families or suspicious files by strings, byte sequences, or conditions. Analysts use YARA to scan files and memory for known threats.

The process of examining suspicious code to understand its behavior, capabilities, and indicators, using static inspection or dynamic execution in a controlled sandbox. Findings feed detections and response.

An isolated environment where suspicious files or code are executed safely to observe behavior. Observations such as created files or network callbacks become detection content.

A continuously updated source of threat data, such as malicious IPs, domains, or hashes, used to enrich detection and blocking. Quality and relevance vary, so feeds require validation.

Maintaining systems in a known, approved state through documented baselines, change control, and drift detection. It reduces exploitable misconfigurations and supports audit readiness.

The ongoing cycle of identifying, prioritizing, remediating, and verifying security weaknesses across systems. Prioritization weighs severity, exploitability, and business impact.

The process of testing, deploying, and verifying software updates that fix vulnerabilities. Timely patching removes a common path attackers use to gain initial access.