CTDC key terms

Regular, repeating outbound connections from an infected host to attacker infrastructure, often with consistent intervals and jitter, used to signal command-and-control presence and await tasking.

Randomized variation added to beacon sleep intervals so callback timing looks less machine-like, defeating simple periodicity detections and complicating traffic analysis.

The channel and infrastructure an adversary uses to send instructions to compromised hosts and receive results, carried over protocols such as HTTPS, DNS, or named pipes.

Encoding data inside DNS queries and responses to bypass egress controls, visible as high-entropy subdomains, unusual record types, or excessive query volume to one domain.

A documented profile of normal traffic volume, protocols, ports, and peer relationships for an environment, against which anomalies such as new external destinations are judged.

Network traffic between internal hosts, such as workstation-to-server or server-to-server flows, where lateral movement and credential abuse are most likely to appear.

Restricting outbound traffic to approved destinations and ports so that compromised hosts cannot freely reach attacker infrastructure, shrinking C2 and exfiltration options.

Unauthorized transfer of data from a victim environment to an attacker-controlled location, often staged, compressed, or encrypted and detectable through volume and destination anomalies.

High-fidelity endpoint records such as process creation, module loads, network connections, file writes, and registry changes collected by an endpoint agent for detection and investigation.

The parent-child ancestry of running processes, used to spot suspicious lineage such as an office application spawning a scripting interpreter or a shell.

Abusing legitimate preinstalled binaries and scripts, such as PowerShell, certutil, or rundll32, to perform attacker actions while blending with normal administrative activity.

Recording full command-line arguments for process execution events, which reveals encoded payloads, download URLs, and script blocks that bare process names would hide.

Cutting a compromised endpoint off from the network while preserving the agent connection, limiting attacker spread while analysts collect evidence and remediate.

The chain of agents, forwarders, brokers, and storage that moves log and sensor data from sources to the SIEM, where gaps or delays directly reduce detection coverage.

Mapping raw vendor log fields into a common schema so that events from different products can be correlated and searched consistently within the SIEM.

A SIEM detection that fires when a defined pattern of events across sources or time windows occurs, such as multiple failed logons followed by a success.

The process of connecting a new system's logs to the SIEM, including transport, parsing, field mapping, retention, and validation that expected events actually arrive.

Assurance that logs are complete, unaltered, and time-synchronized, including protection from tampering and detection of cleared or missing event records.

The structured first-pass review of an alert to confirm whether activity is malicious, benign, or inconclusive, gathering context and assigning severity before escalation.

An alert that correctly identifies the malicious or policy-violating behavior it was designed to detect, requiring a response decision rather than tuning.

Observable evidence of a past or present intrusion, such as a malicious file hash, domain, IP address, or registry key, used for matching and hunting.

A behavioral signal describing adversary intent or technique in progress, such as credential dumping or remote service creation, which is more durable than static artifacts.

A system that ingests, scores, deduplicates, and distributes indicator and actor intelligence to detection tools, managing confidence and expiry.

Assigning a reliability value to an indicator or intelligence report based on source trustworthiness and corroboration, guiding how strongly it should drive blocking or alerting.

Tactics, techniques, and procedures: the adversary's behavioral patterns and methods, which persist across campaigns even when tools and infrastructure change.

A curated knowledge base of adversary tactics and techniques organized by goal, used to map detections, assess coverage gaps, and describe observed behavior consistently.

Techniques adversaries use to move from one compromised host to others, such as remote service creation, pass-the-hash, or remote desktop, often visible as unusual internal authentication.

Gaining higher permissions than initially granted, through exploits, misconfigured services, or credential theft, enabling deeper access and defense evasion.

Extracting stored credentials or password hashes from memory or system files, such as LSASS access, to enable impersonation and further movement.

Adversary actions to avoid detection or logging, including disabling tools, clearing event logs, obfuscating scripts, and masquerading as legitimate software.

The response step that stops an incident from spreading, through host isolation, account disablement, credential resets, or network blocks, before eradication begins.

Predefined conditions, such as confirmed malware on a server or data exfiltration evidence, that require handing an incident to a higher tier or response team.

A rating combining business impact, data sensitivity, spread potential, and confidence, which determines response urgency and notification obligations.

Documented, unbroken record of who handled evidence, when, and how, preserving its admissibility and credibility during investigation or legal proceedings.

Granting identities and services only the access needed for their function, reducing the blast radius of compromised accounts and limiting privilege escalation paths.

Permitting execution only of approved binaries and scripts, which blocks many unapproved tools and payloads even when an attacker gains a foothold.

Comparing existing detections against a framework such as ATT&CK to reveal untested techniques, redundant rules, and blind spots that need new data or logic.

Managing detection rules in version control with peer review, testing, and automated deployment, so changes are traceable and regressions are caught before production.

An alert raised on legitimate activity, which erodes analyst trust and wastes capacity, usually addressed by refining logic, adding context, or excluding known-good behavior.

Iteratively adjusting detection thresholds, filters, and logic based on observed alert outcomes to raise precision without losing meaningful coverage.

A detection that fires only when an event count exceeds a defined limit within a time window, balancing sensitivity against noise from routine activity.