OffSec Threat Hunter key terms

A well-resourced, patient adversary that maintains long-term covert access to a target network to steal data or disrupt operations, typically tied to a nation-state or state-sponsored group with named tracking designations.

A criminal business model in which operators develop encryptor malware and lease it to affiliates who carry out intrusions, splitting ransom proceeds; the operator handles branding, leak sites, and negotiation infrastructure.

A ransomware tactic that combines file encryption with theft of sensitive data, threatening public release on a leak site to pressure payment even when victims have reliable backups.

A prolific RaaS operation known for fast, automated encryption, a self-service affiliate panel, and pressure tactics against victims; heavily targeted by law enforcement disruption and widely tracked through its unique ransom note and file extension patterns.

A ransomware group that shifted toward mass exploitation of managed file-transfer software vulnerabilities, using data theft and leak-site shaming more than encryption, and known for extorting many victims from a single software flaw.

A RaaS operation notable for using the Rust programming language, offering cross-platform encryptors, and pioneering affiliate models and searchable leak sites; its code and infrastructure are widely studied by defenders.

An intermediary who gains footholds in victim networks, such as stolen VPN credentials or exposed remote-access services, and sells that access to ransomware affiliates or other intruders.

An attack pattern where adversaries scan the internet for a specific unpatched vulnerability and compromise every reachable host at once, producing many simultaneous victims and unusually broad, shallow intrusion footprints.

Gaining code execution or unauthorized access by abusing a software flaw; defenders prioritize flaws that are publicly exploited, internet-facing, and allow unauthenticated remote access, especially in edge devices.

A curated catalog of vulnerabilities confirmed to be exploited in the wild, used to prioritize patching ahead of generic severity scores because it reflects real adversary activity rather than theoretical risk.

An observable artifact such as a file hash, domain, IP address, or registry key that suggests a system has been breached; useful for fast matching but brittle because adversaries rotate them frequently.

A behavioral signal describing adversary intent or technique in progress, such as credential dumping or remote-service creation, which stays detectable even when specific tools and infrastructure change.

The behavioral patterns of an adversary: the goals pursued, the methods used to achieve them, and the specific operational details; TTPs are more durable and more useful for hunting than atomic indicators.

A pattern-matching rule written in YARA syntax that describes textual or binary features of malware families, used to scan files and memory for suspicious content across endpoints and sandboxes.

A vendor-neutral, YAML-formatted detection rule describing log-based behavior; it can be converted into queries for many SIEM and EDR platforms, making detections portable across environments.

Infrastructure and channels adversaries use to send instructions to compromised hosts and receive stolen data, often disguised as normal web traffic, DNS queries, or cloud service API calls.

Regular, periodic outbound communication from malware to its controller; the timing regularity and consistent destination distinguish it from human browsing and make it a strong network hunting signal.

Using legitimate, preinstalled system tools such as PowerShell, WMI, certutil, or rundll32 to perform malicious actions, blending into normal administration and evading signature-based detection.

Unauthorized transfer of data from a victim network to attacker-controlled storage; detection relies on volume anomalies, unusual destinations, and transfers to newly registered or cloud-storage domains.

A monitoring system that inspects network or host activity and raises alerts on suspicious patterns; it observes and reports but does not block traffic, so response depends on a human or downstream tool.

An inline sensor that inspects traffic and actively drops or resets malicious sessions; because it sits in the traffic path, false positives can break legitimate business activity and must be tuned carefully.

An open-source, high-performance network threat detection engine supporting signature, protocol, and anomaly detection plus file extraction, with rule formats compatible with Snort-style syntax.

A structured rule containing action, protocol, source and destination, and options that match packet content, flow state, or protocol fields; well-written rules use flow and direction keywords to reduce noise.

Suricata's structured event output format, recording alerts, flows, DNS, TLS, and file metadata as JSON lines; it is the primary source for feeding network telemetry into a SIEM for correlation.

Detecting known-bad patterns such as byte sequences, domains, or user agents; fast and precise for known threats but blind to novel or obfuscated activity, so it is paired with anomaly and behavioral analytics.

Flagging activity that deviates from an established baseline of normal behavior, such as unusual login times or traffic volumes; powerful for unknown threats but prone to noise without context and tuning.

Inline sensors sit in the traffic path and can block, while passive sensors receive mirrored traffic and can only observe; the choice affects latency, failover risk, and whether prevention is possible.

The process of reducing spurious alerts by adjusting rule thresholds, suppressing known-benign patterns, and adding context, balancing detection coverage against analyst alert fatigue.

Proactively searching telemetry for patterns of adversary behavior, such as unusual parent-child process relationships or credential access, rather than waiting for alerts on known indicators.

The recorded ancestry of a process, including parent and command line; anomalies such as a word processor spawning PowerShell reveal malicious execution chains that individual event names would miss.

A cloud-delivered endpoint protection platform that records rich process, network, and identity telemetry, queried through its event search language to support proactive hunting and detection validation.

Joining events from multiple sources, such as endpoint, identity, and network logs, by shared identifiers like host, user, or timestamp, to reconstruct an attack sequence that no single source reveals.

The raw security-relevant data collected from sensors and endpoints, including process starts, network connections, authentication events, and file writes; hunting quality depends on its breadth and retention.

A structured method that starts from a testable statement about adversary behavior, defines the data needed to confirm or refute it, and ends with a documented finding and new detection logic.

A framework describing progressive hunting capability, from relying on automated alerting through structured hypothesis testing to data-driven, automated analytics that continuously generate new detections.

A knowledge base of adversary tactics and techniques observed in real intrusions, organized by platform and used to map detections, identify coverage gaps, and structure hunt plans.

The discipline of designing, testing, deploying, and maintaining detection logic as a product, including versioning, false-positive measurement, and mapping each rule to the behavior it intends to catch.

A documented profile of normal network behavior, such as typical traffic volumes, protocols, and destinations per host; deviations become hunting leads for C2, exfiltration, or scanning activity.

Ordering events from multiple sources by normalized timestamps to reconstruct attacker actions, resolve clock skew, and identify the sequence and dwell time of an intrusion.

Converting logs from different products into a common schema and field naming so that events can be searched and correlated consistently across endpoint, network, and identity sources.