Glossary

146 terms from Attacks and Indicators, in plain words, each with the chapter that teaches it.

Search the glossary

#

/var/log/auth.log: The Linux log file that records logins, SSH sessions and `sudo` use. Analysts search it for failed passwords, invalid users, lockouts, accepted logins and 'user NOT in sudoers' lines to spot password attacks and privilege escalation attempts.

A

acceptable use policy: The rules for using company IT. Every new Kettle & Crane hire signs it in their first week.
access control vestibule: Two doors where only one can open at a time, so only one person gets through per badge. It is the main fix for tailgating.
access log: A web server's record of every request it receives, with the client address, time, requested URL and status code. Searching it for patterns such as `UNION`, `%27`, `../` and `%3b` reveals injection and directory traversal attempts, and a `200` status shows which ones worked.
account lockout: Blocking an account after a set number of failed logins in a row, which is 5 in login.py. It stops brute force, but attackers can also use it to lock staff out on purpose.
adware: Malware that shows unwanted ads, pop-ups or a changed homepage, and often tracks the user too. The front-desk laptop's 'Coupon Saver' extension is an example.
amplification: Choosing questions whose answers are much bigger than the question. A small amount of attacker traffic then becomes a large flood at the victim.
amplification factor: The answer size divided by the question size. In the lab, a 63-byte DNS question got a 1,103-byte answer, a factor of about 17.5.
application-layer DDoS: A DDoS that sends many real-looking requests to slow pages, such as the shop's search page, until the web app and its database are overloaded.
ARP (Address Resolution Protocol): The LAN protocol a device uses to ask 'who has 192.168.20.1?' and learn that IP address's MAC address. ARP has no checks, so anyone on the LAN can answer, even when nobody asked.
ARP cache: A device's stored list of IP-to-MAC answers, which you can see with `ip neigh`. Two IP addresses sharing one MAC in the cache is a sign of ARP poisoning.
ARP poisoning: Sending false ARP replies again and again so the laptop links the router's IP address to the attacker's MAC. The laptop's traffic then goes through the attacker.
Authentication-Results: An email header where the receiving mail server writes its SPF, DKIM and DMARC verdict. The phish sent to Jo showed `spf=fail` and `dmarc=fail` here.

B

backdoor: A hidden way into a system that skips the normal login. A remote access trojan often opens one.
Base64: A way of writing any bytes as plain letters and digits. Attackers pack PowerShell code into it to hide it, and `base64 -d` decodes it back.
baseline: What normal activity looks like, such as backups always running at 1 a.m. You compare an indicator against the baseline to decide whether it is really unusual.
beacon: Malware contacting its controller at regular intervals to check for orders. order1 connecting to 203.0.113.140 every 60 seconds is an example.
behavior: What people actually do, such as reporting phishing or badging in. An awareness program should measure behavior, not just course completion.
behavioral indicator: An indicator that describes unusual activity, such as a 3 a.m. sign-in or a laptop sending far more data than usual. It can catch attacks that nobody has listed yet.
botnet: Thousands of infected computers, routers and cameras controlled by one attacker. Botnets typically send DDoS floods.
breached-password check: Checking passwords against lists of passwords leaked in breaches. It is one defense against credential stuffing.
brute force: Trying many passwords against one account until one works, in practice usually from a list of common passwords. It is loud: many failures for one user, then an account lockout.
buffer overflow: Writing more data into a piece of memory than it was given, so the extra overwrites whatever lies next to it. overflow.c shows this by copying 40 A's into a 16-byte buffer.
business email compromise (BEC): Email fraud aimed at a company's money, sent from a taken-over mailbox or a lookalike domain. It usually asks for a payment, a bank-detail change or gift cards, and needs no malware.

C

certificate warning: A browser warning that a site can't prove it is who it claims to be. At Kettle & Crane it was the clue that a fake shop sat on the path. Never click past one.
command injection: Injection aimed at the operating system's shell. The shop's ping page pasted `host` into a command, so `127.0.0.1; id` ran a second command of the attacker's choice.
concurrent session: A second login session that is live at the same time as the first. Jo's open Portland session plus two Frankfurt sessions could not all have been opened by one person.
cookie: A small value a website stores in the browser to remember a logged-in user. XSS can steal it, CSRF takes advantage of the browser sending it automatically, and stealing it enables token theft.
credential stuffing: Replaying real username:password pairs leaked from another site, betting that people reuse passwords. Each account sees only one or two failures, so it blends in with normal sign-ins.
cross-site request forgery (CSRF): Tricking a logged-in user's browser into sending a request the user didn't intend. An example is a hidden form that posts 'change my email' to the shop along with the user's cookie.
cross-site scripting (XSS): Injection that makes the attacker's `<script>` run in another visitor's browser. Reflected XSS bounces off one response, such as a crafted link. Stored XSS is saved on the server, such as in a review, so it runs for everyone who views the page.
cryptocurrency miner: A program that uses a computer's CPU to earn cryptocurrency for someone else. When it runs on your machine, it shows up as unusual resource consumption.

D

DDoS (distributed denial of service): A denial-of-service flood sent from many machines at once, typically a botnet. It comes in three kinds: volumetric, protocol and application.
DDoS protection service: An internet provider or cloud service that absorbs floods far from your link. Kettle & Crane's hosting company dropped the reflected DNS answers upstream.
deepfake: Audio, video or images made or altered by AI to look or sound like a real person. Rather than trying to spot one, verify by calling back on a number you already have.
denial of service (DoS): An attack that makes a service unusable, usually by sending it more than it can handle.
directory traversal: Using `../` in a file name to climb out of the folder an app meant to serve. For example, `/label?file=../../../../../../etc/passwd` reads the account list.
DKIM (DomainKeys Identified Mail): A digital signature that a sending domain adds to its email. `dkim=none` means the message carried no signature.
DMARC (Domain-based Message Authentication, Reporting and Conformance): A domain's published policy that requires its From address to match a passing SPF or DKIM check, and says what to do with mail that fails. A pass only proves the message came from that domain's real mail system, which is why BEC from a taken-over mailbox still passes.
DNS (Domain Name System): The system that turns names like shop.kettleandcrane.com into IP addresses. Attackers can fake its answers, or abuse public DNS servers for amplification.
DNS cache poisoning: Getting a false answer stored in a resolver's cache, so every client that asks gets the lie until its TTL runs out.
DNS spoofing: Answering one victim's DNS question with a lie before the real server can answer. dns-spoof.py does this by copying the question's ID.
DNSSEC (DNS Security Extensions): A system in which domains sign their DNS records, so resolvers can reject unsigned, false answers.
double extension: A file name like Invoice_Oct.pdf.exe, which Windows shows as Invoice_Oct.pdf because it hides known extensions. Despite how it looks, the file is a program.
downgrade attack: Tricking two parties into using an older, weaker protocol version or cipher than both support, so an on-path attacker can break it.
Dynamic ARP Inspection: A switch feature that drops ARP replies that don't match the addresses DHCP handed out, which blocks ARP poisoning.

E

e-skimming: Stealing payment card data by adding a malicious script to a website's checkout page, which copies each card number as it is typed while the page keeps working normally. A typical sign is a script the shop never added, such as a fake `jquery.min.js` loaded from a lookalike domain.
EICAR test file: A harmless 68-character text file that antivirus products agree to detect as if it were malware, even though it does nothing. It lets you test hash checks and antivirus detection safely, for example by disguising it as a fake trojan named `Invoice_Oct.pdf.exe`.
entropy: How random data is, measured from 0 to 8 bits per byte. Text scores about 4 to 5, while encrypted or compressed data scores near 8, which is why the ransomware .locked files scored about 7.96.

F

false negative: An attack that raised no alert at all. It is worse than a false positive because nobody looks.
false positive: An alert about something harmless. Setting MAX_MPH to 30 would flag Sam's ordinary trips, and too many such alerts teach people to ignore alerts.
fileless malware: Malware that never writes its own program to disk. It runs inside trusted tools like PowerShell, lives in memory and comes back at each login through a Run key, so file scanners find nothing.
forgery: Making a server act on a request that its user, or the server itself, never meant to make. CSRF and SSRF are the two kinds.
function: A named block of commands that you define once and run by writing its name, like case_share() in triage.sh. Inside a function, `local` creates variables that exist only while it runs.

G

grep: Finds the lines that match a pattern, in files or in piped input. It is the main search tool in every chapter's log work.

H

horizontal privilege escalation: Reaching another user's data at the same level of rights, for example by changing order=1042 to order=1043.
HSTS (HTTP Strict Transport Security): A header that tells browsers to reach a site only over HTTPS. It defeats SSL stripping.
HTTP status codes: The number a web server returns for each request: 200 OK (it worked, so an attack line with 200 succeeded), 409 Conflict (how refund-api.py refuses a replay), and 500 Internal Server Error (a crash; bursts can mean someone is probing for injection).

I

impossible travel: One account signing in from two places too far apart for anyone to travel between them in the time, meaning over about 600 mph. Jo signing in from Portland and then Frankfurt 4.48 hours later works out to about 1,163 mph.
incident response: The organized process of handling a security incident after it is found: containing it, collecting evidence, removing the threat and recovering systems. Whoever spots an attack first takes the first steps, such as isolating a host or disabling an account, then hands over to incident response for the full investigation.
indicator of compromise (IOC): Evidence that an attack may have happened or is happening, such as a log line, a new process or a strange connection. It is a clue, not proof.
injection: Input that an application runs as code. Each kind is named after what runs the code: SQL injection (the database), command injection (the shell) and XSS (the browser).

K

keylogger: Software, or a small plug on a keyboard cable, that records every key pressed, including passwords and card numbers, and sends the record to the attacker.

L

learning management system (LMS): Software that delivers and tracks training. It assigns courses, sends reminders, and records who finished and what they scored.
logic bomb: Hidden code in a normal program or script that does nothing until a condition comes true, then runs its payload. payroll-sync.sh would wipe the payroll folder once dana's account is gone.
lookalike domain: A domain made to resemble a real one by adding a word, swapping a letter or changing the ending, such as kettleandcrane-it.example or kettleandcrame.

M

MAC address (media access control address): The hardware address of a network interface, such as 02:00:00:00:00:02. ARP maps IP addresses to MAC addresses.
macro virus: A virus that lives in a Word or Excel macro and runs when someone clicks 'Enable content'.
mailbox rule: A rule in an email account that hides, moves or forwards messages. Attackers add one to hide replies from the real owner, like the rule in Jo's mailbox that hid emails containing 'invoice'.
malware: Any software written to do harm: to steal, spy, destroy or extort.
median: The middle value of a sorted list. campaign.py uses the median time to report so that one very slow reporter doesn't pull the number up.
MFA (multi-factor authentication): Signing in with a second factor, such as an app prompt or a code, in addition to the password. A stolen or watched password alone is then not enough.
MFA bypass: Any way of getting into an account without honestly passing its multi-factor authentication check. Common methods are MFA fatigue (push bombing), SIM swaps that redirect SMS codes, and theft of session tokens that were issued after MFA.
MFA fatigue: Sending MFA prompt after prompt, often at night, until a tired user taps Approve. Priya got eleven such prompts at 2 a.m.
missing logs: A log that stops or vanishes, such as one ending at 2:14 a.m. It can mean an attacker covering their tracks, but check for innocent causes like log rotation or a full disk first.

N

nonce: A value that may appear in only one request. In nonce mode, refund-api.py remembers every X-Request-Id it has seen and refuses a repeat with 409.
number matching: An MFA prompt that makes the user type a number shown on the login screen, so a blind Approve fails. It stops MFA fatigue.

O

on-path attack: An attacker placed between two parties who think they are talking directly, so the attacker can read, change or quietly pass on their traffic.
onboarding: A new employee's first days, when training starts. At Kettle & Crane, week one means the acceptable use policy, MFA setup and a 30-minute session on the likeliest attacks and how to report them.
online attack: Guessing passwords against a live service, where every guess is a real login that gets logged. Cracking stolen hashes offline leaves no such traces.
operational security (OPSEC): Not giving attackers information they can use, such as photos that show badges or whiteboards, or an out-of-office reply that names who approves payments.
out-of-band verification: Checking a request through a separate channel you already trust, such as calling a number already on file rather than one in the email. It defeats BEC and deepfakes.

P

parameterized query: Sending the SQL command and the user's input to the database separately, so the input can only ever be data. It is the fix for the shop's search page.
passkey: A phishing-resistant way to sign in that uses a cryptographic key pair, with the private key kept on your device, instead of a password or a code someone could relay. Because a passkey only works with the real site, it defends against phishing and most MFA bypasses.
password manager: Software that keeps a unique password for every site. Unique passwords are the defense against credential stuffing.
password spraying: Trying one common password, such as Autumn2026!, against many accounts and then waiting before trying the next one. Each account sees only one failure, so nothing locks.
patching: Installing software updates that close security holes. It is the first defense against worms.
payload: The harmful part of malware, which runs when its trigger comes true. The payload of payroll-sync.sh would wipe the payroll folder.
persistence: A way for malware to start again after a restart or logout, such as a command stored in a Run key. Looking for it is a key step when checking a suspect machine.
phishing: A fraudulent message sent to many people that pretends to come from someone trusted, in order to steal passwords or money or to deliver malware.
phishing simulation: Realistic but harmless phishing emails sent to staff for practice and measurement. Results are scored by report rate, time to report, password entry and clicks.
piggybacking: Like tailgating, except the authorized person knowingly lets the follower in.
pivot: In an investigation, taking a clue found in one log, such as an IP address, username or file hash, and searching for it in every other log. It links events across systems, for example tying a break-in in an auth log to a beacon in a firewall log.
privacy screen: A filter that makes a laptop screen look dark from the side. It is a defense against shoulder surfing.
privilege escalation: Gaining more rights than you were given, either vertically (up to root) or horizontally (sideways into another user's data). On order1, the shipping account trying sudo to root was an attempt.
protocol attack: A DDoS that uses up connection tables in firewalls, load balancers or servers, for example with a flood of TCP SYNs that never finish the handshake.

Q

QR code: A square barcode that a phone camera reads to open a link. It hides the link from filters and readers, which quishing takes advantage of.
quishing: Phishing through a QR code, such as a sticker placed over a parking meter's code.

R

ransom note: The file ransomware leaves demanding payment, often a capitalized name like HOW_TO_DECRYPT.txt. Finding one beside many renamed files is a clear sign of ransomware.
ransomware: Malware that encrypts files and demands payment, often after stealing a copy. Its traces include one new extension on many files, a ransom note and high entropy.
rate limit: A cap on how many requests or packets are accepted in a given time. It is one of the first defenses against DDoS.
reflection: Sending questions to public servers such as DNS or NTP with the victim's address forged as the sender, so those innocent servers send their answers to the victim.
remote access trojan (RAT): A trojan that opens a backdoor and lets the attacker control the computer from outside.
removable media: USB drives, memory cards and external disks. A found drive can run malware or pretend to be a keyboard, so hand it to IT instead of plugging it in.
replay attack: Capturing a valid message and sending it again later, word for word, like replaying the refund request for order 1042.
report rate: The share of staff who report a phishing email, with the median time they take to report it. These are the most important scores in a phishing simulation, ahead of credential entry and clicks.
resource consumption: CPU, memory, disk or bandwidth used up unusually, for example by a cryptocurrency miner, by ransomware or by a flood.
rootkit: Malware that changes the operating system's commands or kernel to hide itself. You can't trust an infected system to report on itself, so check from outside and reinstall.
Run key: A Windows Registry location, such as HKCU\...\CurrentVersion\Run, whose commands start at every login. Fileless malware uses it to come back after a restart.

S

scanning: One host trying the same port on many addresses within seconds to find machines to attack. It is a key indicator of a spreading worm.
security awareness: The ongoing program that gives staff the habits to stop and report attacks: onboarding, short monthly modules, phishing simulations and measuring behavior.
server-side request forgery (SSRF): Tricking a server into making requests for the attacker. An example is a 'fetch this image' feature that is given http://127.0.0.1:8080/admin and fetches its own internal page.
SHA-256 hash: A fixed-length fingerprint of a file's contents. Threat feeds list the SHA-256 hashes of known malware, but changing even one byte changes the hash completely.
shoulder surfing: Watching someone's screen or keyboard to steal what they type or read, like a man in the café filming Sam typing at the counter.
SIEM (security information and event management): Systems that gather and search all logs in one place. They are taught in Security Monitoring and Automation in 50 Pages.
SIM swap: Talking a phone company into moving the victim's number to the attacker's SIM, so SMS codes go to the attacker.
situational awareness: Noticing what's happening around you and what is out of place, such as a 'courier' heading for the storeroom, and pausing before acting.
skimming: Stealing payment card data with a hidden device or code at the place where the card is used. A skimmer is a thin overlay on a card slot or a fake keypad.
SMB (Server Message Block): Windows file sharing, which runs on port 445. WannaCry spread through a hole in it.
smishing: Phishing by SMS text message, such as 'UPS: pay $1.99 to release your parcel' with a link.
sniffing: Capturing and reading traffic meant for someone else, as when the attacker read `pass=Roast2026` from a plain HTTP login.
social engineering: Tricking people into helping the attacker by playing on urgency, authority, fear, helpfulness and trust.
spear phishing: Phishing researched for one person or team, like an email to Jo that names a real supplier and order.
specific indicator: An indicator that names one exact value, such as a file's SHA-256 hash, an IP address or a domain.
SPF (Sender Policy Framework): A domain's list of servers allowed to send its email. `spf=fail` means the sending server is not on that list.
spoofing: Faking an identity, such as a sender address, a MAC address, a source IP, an ARP reply or a DNS answer.
spyware: Malware that secretly collects information, such as browsing history, saved passwords, files or screenshots, and sends it to someone else.
SQL injection: Injection into a database command. A quote ends the app's text and attacker SQL follows, as in `x' UNION SELECT name, password FROM users--`.
SSL stripping: Keeping the victim on plain http:// while the attacker talks HTTPS to the real site. HSTS defeats it.

T

tailgating: Following an authorized person through a secured door without using your own badge, as happened when someone walked in behind Jo. Its traces are door-held-open alarms and activity from people with no badge entry.
threat feed: A shared list of known-bad indicators, such as malware hashes and attacker addresses.
timeline: A list of events from all relevant logs, put in time order. Building one shows how an attack unfolded, for example from spraying, to a successful login, to a privilege escalation attempt, to a malware beacon.
TLS (Transport Layer Security): The encryption under HTTPS. A server that allows only TLS 1.3 refuses an older version with 'tlsv1 alert protocol version', and each TLS record's sequence number stops replays.
token theft: Stealing a session cookie or token and replaying it to skip login and MFA. It is now the most common way around MFA.
trojan: Malware that pretends to be something useful, such as a fake invoice or a free converter, so the user opens or installs it willingly.

U

UNION SELECT: SQL that joins a second query's results onto the first. In the shop's search it pulled every username and password from the users table.
user enumeration: Finding out which usernames exist from how a system answers, like 'no such user' for bob but 'wrong password' for jo.

V

vertical privilege escalation: Moving up from a normal account to administrator or root, as the shipping account tried with sudo on order1.
virus: Malicious code that attaches itself to a program, a document or a disk's boot area. It runs when a person opens its host and spreads when the host is copied or shared.
vishing: Phishing by voice call, such as a 'bank fraud team' asking you to read out the code they just sent.
volumetric attack: A DDoS that sends more traffic than the victim's internet link can carry.
VPN (virtual private network): A service that carries your traffic, encrypted, out through another location. It can make a sign-in appear in another city, which is an innocent explanation for apparent impossible travel.

W

WannaCry: A 2017 worm that used a hole in Windows SMB (port 445) to reach about 200,000 computers in a few days.
whaling: Phishing aimed at a senior leader, such as a fake 'legal notice' sent to the owner, Morgan.
Windows Security event log: Windows' numbered log of security events: 4624 is a successful logon, 4625 a failed logon, 4688 a new process with its command line (where hidden encoded PowerShell shows up), and 4732 a user added to a privileged group.
worm: Malware that spreads by itself, breaking into other computers through a hole in a network service with no click needed. Patching is the defense.