eCDFP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Confidentiality, integrity, and availability, the three properties security controls protect. Confidentiality stops unauthorized disclosure, integrity stops unauthorized modification, and availability keeps systems usable.

Residual risk

The risk that remains after existing controls are applied. It is calculated from likelihood and impact, and management formally accepts or further mitigates it.

Least privilege

Granting an identity only the access needed for its current function. It limits blast radius when an account is compromised and reduces accidental or malicious misuse of broad permissions.

Defense in depth

Layering independent controls across perimeter, network, host, application, and data tiers so failure of one layer does not expose the asset. Compensating controls substitute when a primary control is infeasible.

MFA factor categories

Authentication factors fall into knowledge, possession, and inherence. True MFA combines two different categories, so two separate passwords do not satisfy the requirement.

Vulnerability versus exploit

A vulnerability is a weakness in a system; an exploit is the technique or code that abuses it. CVSS rates technical severity, while organizational risk also depends on exposure and asset value.

TCP handshake anomalies

A normal session completes SYN, SYN/ACK, ACK. Many SYNs without completed handshakes indicate SYN scanning or flooding, while RST to SYN shows the port is closed.

DNS tunneling indicators

Long high-entropy subdomain labels, heavy TXT or NULL query volume, many NXDOMAIN replies, and one client querying a single domain at a steady cadence suggest data exfiltration over DNS.

Beaconing detection

Command-and-control beaconing appears as repeated connections at near-constant intervals, often with jitter, consistent small byte counts, and destinations with low reputation or recent registration.

JA3 fingerprint

A hash of TLS client hello fields such as version, cipher suites, and extensions. It identifies client software stacks even when traffic is encrypted, helping spot unusual or malicious tooling.

NetFlow records

Metadata about network sessions including source and destination IP, ports, protocol, byte and packet counts, and timestamps. It supports volume and long-duration session analysis when full packet capture is unavailable.

East-west traffic

Traffic between internal hosts rather than to the internet. It carries lateral movement over SMB, RDP, and WinRM, so segmentation and monitoring must cover it as well as perimeter traffic.

PCAP triage workflow

Start with protocol hierarchy and conversation statistics to find outliers, filter on suspect IPs or ports, then follow the stream to reconstruct payloads and extract transferred files.

Egress filtering

Restricting outbound connections to approved destinations. It blocks command-and-control callbacks and data exfiltration even when a host is already compromised and attempting to reach attacker infrastructure.

Sysmon Event ID 1

Process creation, recording image path, command line, parent process, user, and hashes. It is a primary source for spotting suspicious process ancestry and encoded command lines.

LOLBins

Legitimate signed Windows utilities such as certutil, mshta, regsvr32, rundll32, and bitsadmin that attackers repurpose for download or execution, evading simple blocklists of unknown binaries.

Encoded PowerShell commands

PowerShell invoked with -enc or -EncodedCommand carrying a Base64 blob, often combined with -nop and hidden window flags. Decode the blob offline to see the actual script executed.

Process injection indicator

Sysmon Event ID 8, remote thread creation, where one process starts a thread in another. Legitimate cases exist, but injection into browser or office processes is highly suspicious.

LSASS credential dumping

Access to the LSASS process by unusual tools, or use of comsvcs.dll MiniDump, indicates attempts to extract cached credentials and hashes from memory for later reuse.

Windows persistence locations

Run and RunOnce registry keys, Startup folders, scheduled tasks, services, WMI event subscriptions, and logon scripts. Autoruns enumerates most of these in a single view.

Linux deleted binary

A running process whose executable was removed shows a (deleted) suffix in /proc. It often indicates malware that deleted itself from disk after execution to hinder analysis.

Timestomping

Attackers alter file timestamps so creation and modification times conflict with the sequence of surrounding events. Inconsistencies between file and log times are a detection clue.

Windows event 4624 logon types

Type 2 interactive, 3 network, 5 service, 7 unlock, 8 cleartext, 9 runas, 10 RDP, 11 cached. Type 3 NTLM logons to many hosts suggest lateral movement.

Kerberoasting signature

Event 4769 requesting a service ticket with RC4 encryption, type 0x17, often without a preceding 4768. Attackers request tickets to crack service account passwords offline.

Event 1102 log cleared

The Windows Security audit log was cleared. It is rare in normal operations and frequently signals an attacker removing evidence, so it should trigger immediate investigation.

Logon type 3 meaning

A network logon, such as SMB or NTLM authentication from another host. Many type 3 logons from one source to multiple machines indicate credential reuse and lateral movement.

Syslog severity levels

Numbered 0 emergency through 7 debug. Authentication events typically arrive through auth, authpriv, or security facilities and are correlated with sshd and sudo entries on Linux hosts.

Detection rule structure

Select a data source, define the event condition, add baseline or threshold context, and specify the response. Rules without thresholds generate alert fatigue on routine administrative activity.

Order of volatility

Capture evidence from most to least volatile: CPU registers and cache, memory, network state, running processes, disk, remote logs, then archival media. Volatile data disappears on shutdown.

Chain of custody

A documented record of who handled evidence, when, where, and how, with hashes taken at acquisition and verified later. Breaks in custody weaken evidentiary value.

Threat hunting hypothesis

A testable statement derived from threat intelligence or ATT&CK coverage rather than an existing alert. Confirmed findings become new detection rules and hardening tasks.

Atomic versus behavioral indicators

Atomic indicators such as IPs, domains, and hashes are trivially changed by attackers. Behavioral indicators like process chains and command-line patterns survive retooling and yield durable detections.