Network Attacks, Social Engineering and Indicators

Glossary

264 terms from Network Attacks, Social Engineering and Indicators, in plain words, each with the chapter that teaches it.

Search the glossary

#

%CPU: A column in ps output that shows how much of one processor core a process is using. In Alex's lab, an unknown program called syscache showed 75.7, meaning about three quarters of a core.
.bash_history: A hidden file on Linux that keeps a user's command history. If it is suddenly empty or much shorter than usual, someone may have tampered with the logs.
.env file: A file where web apps often keep settings, including passwords. Scanners ask for /.env because finding one can leak secrets.
/proc/<PID>/exe: A Linux path that shows which program file a running process came from. If it ends in "(deleted)", the process is still running but its file has been removed, which is a sign of malware hiding.
/tmp: A temporary folder on Linux where real system programs never live. A program running from /tmp or /var/tmp, like the fake kworkerd, is a red flag.
802.1X: Port authentication that stops unknown devices from joining the wired network. It is one control against rogue access points being plugged in.

A

access point (AP): A device that provides a Wi-Fi network and connects wireless devices to the wired network. Each access point's radio has its own hardware address.
AI (artificial intelligence): Software that can produce text, speech, images or video that seem human-made. Attackers use it to clone voices and make deepfakes.
amplified attack: A DDoS trick where the attacker picks requests whose answers are much bigger than the questions, so small forged requests turn into huge floods at the victim. DNS, NTP, memcached, SSDP and CLDAP are common amplifiers.
application DDoS: A DDoS that wears out the web application itself, for example with thousands of searches per second, while the link and connection counts look normal. The attack on Kettle & Crane's shop search page was one.
ARP (Address Resolution Protocol): The protocol a computer on a local network uses to find the MAC address that belongs to an IP address. It believes the first answer it gets and cannot check it, which is why it can be spoofed.
ARP cache: A short list a computer keeps of IP-to-MAC answers it has received, so it does not have to ask every time. On Linux, ip neigh shows it.
ARP poisoning: Sending false ARP replies so that victims link an IP address, usually the gateway's, to the attacker's MAC address and send their traffic to the attacker. The classic sign is two IP addresses, one of them the gateway, sharing one MAC address.
artifact: Any trace an attacker leaves behind on a system.
atime: The timestamp for when a file was last read. Many systems update it only loosely.
auth.log: A Linux log that records logins and other authentication events. If it is suddenly empty or much shorter, the logs may have been tampered with.
authentication downgrade: Pushing Windows logins from Kerberos or NTLMv2 down to the weaker NTLMv1 or LM. The sign is NTLMv1 or LM logons in the Security log.
Authorization: Basic: An HTTP header that sends a user name and password encoded in Base64. Over plain HTTP, a sniffer can capture and decode it, as Alex showed with priya:Espresso42.
authorized_keys: A file in a Linux user's account that lists the keys allowed to log in without a password. A new key added there is a persistence artifact.
awk: A small text-processing tool. Alex's lab used it to find jumps of more than one minute in a log that should write once a minute.

B

Base64: A way of writing data as plain letters. It is an encoding, not encryption, so anyone can reverse it with one command such as base64 -d.
baseline: The normal level of activity for a system at a given time, which you compare against to spot something unusual. 80 percent CPU on Black Friday is normal for the shop server; at 3 a.m. on a Tuesday it is not.
beaconing: An infected computer contacting the same outside address at regular intervals, even when nobody is using it, to check in with its controller. Priya's laptop calling 203.0.113.140 every 300 seconds was beaconing.
birth time: The timestamp for when a file was created, on file systems that record it.
bot: One infected device that an attacker controls remotely as part of a botnet. A bot taking part in a DDoS sends floods of outgoing traffic.
botnet: A network of infected computers, cameras and routers, often thousands of them, that an attacker controls remotely. Botnets are the usual source of DDoS traffic.
brute force: A password-guessing attack that tries many passwords to get in. It leaves many failed logins, unlike sniffing, where the stolen password works first time.
business email compromise (BEC): An attack where criminals take over an executive's or supplier's email account, or convincingly fake it, and ask staff to send money. The fake importer email asking Kettle & Crane to pay a new bank account is a common BEC trick.

C

cache: A store of recent answers kept to save time, such as a resolver's DNS cache or a computer's ARP cache.
cache poisoning: Putting a false entry into a cache, such as a DNS resolver's or a computer's ARP cache, so that every later lookup gets the wrong answer. When Kettle & Crane's office resolver stored 203.0.113.66 for the shop, everyone in the office was sent to the fake site, while Sam at home was fine.
callback verification: Checking any unusual request by calling the person on a number you already have on file, never one given in the message. It defeats almost every impersonation and deepfake.
caller ID spoofing: Faking the number or name shown on the victim's phone, for example the bank's real number. It makes vishing believable, which is why caller ID proves nothing.
CDN (content delivery network): A service that delivers thousands of unrelated websites from shared addresses. Blocking a CDN address because a threat feed flagged it can take good sites offline, such as Kettle & Crane's own checkout.
central log server: A separate server that receives a copy of every log as it is written, out of reach of an attacker on one machine. It still had the order server's full log after the local log was cleared.
CEO (chief executive officer): The top executive of a company, and a typical target of whaling.
certificate: A signed digital ID card a website uses to prove who it is over HTTPS. An on-path attacker cannot produce a valid one for shop.kettleandcrane.com, so the browser shows a warning.
CFO (chief financial officer): The executive in charge of a company's money. CFOs are whaling targets, and deepfakes of them have been used to order transfers.
channel: The way a social engineering attack reaches its victim: email, text or voice. The channel decides the name: phishing, smishing or vishing.
CIA triad: The three core security goals: confidentiality, integrity and availability. DoS and DDoS attacks break availability, the "A".
cipher suite: The set of cryptographic methods a TLS connection agrees to use, such as TLS_AES_256_GCM_SHA384. Weak cipher names in logs can point to a downgrade.
CISA (Cybersecurity and Infrastructure Security Agency): A US government agency that publishes security guidance and advisories, including lists of IoCs such as malware hashes.
CLDAP (Connectionless Lightweight Directory Access Protocol): A UDP-based directory protocol that attackers abuse as an amplifier in reflected DDoS attacks.
command and control (C2): The server an attacker uses to send instructions to malware. Infected machines check in with it by beaconing.
CompTIA Security+: An entry-level, vendor-neutral cybersecurity certification from CompTIA that tests core security knowledge, including network attacks, social engineering and indicators of malicious activity. Passing its exam (currently SY0-801) shows that a person has the baseline skills needed for security roles.
connection table: The list a firewall or server keeps of open connections. Protocol DDoS attacks such as SYN floods fill it up.
cp -p: Copy commands that keep a file's original times. A copied file can look like timestomping, with an old modify time and a new change time, even though nothing bad happened.
CPU (central processing unit): The part of a computer that runs programs; its use is measured as processor time. Near-100 percent CPU on an idle machine points to cryptojacking.
cron job: A scheduled command on Linux. A new cron job nobody created, like one running a script from /tmp every 10 minutes, is a persistence artifact.
cryptojacking: Malware that uses a victim's computer to mine cryptocurrency for the attacker. Its main sign is constant high CPU use, often with loud fans, like the spare server running kthreadd2.
ctime: The timestamp for when a file's details, such as its name, permissions or timestamps, last changed. Faking the modify time updates ctime, so ctime can reveal timestomping.
curl: A command-line tool for making web requests. It is one of the packages the labs need.
CVE (Common Vulnerabilities and Exposures): A public ID number for a known vulnerability. Dan Kaminsky's 2008 DNS cache poisoning flaw is CVE-2008-1447.

D

DDoS (distributed denial of service): An attack that makes a service unavailable by flooding it from many sources at once, usually a botnet. You cannot stop it by blocking one address.
deauthentication attack: Sending forged "disconnect" messages that knock devices off a real Wi-Fi network, so they reconnect to an evil twin.
deepfake: Fake audio, video or images made with AI to look or sound like a real person. A video call from the "owner" asking Sam for a secret $9,500 payment may be a deepfake, so verify through a known channel.
DHCP (Dynamic Host Configuration Protocol): The protocol that gives each new device an IP address, a gateway and a DNS server. In the lab, DHCPOFFER and DHCPACK lines showed which server handed out the address.
DHCP snooping: A switch feature that accepts DHCP offers only from the port where the real DHCP server is connected, which blocks rogue DHCP servers.
dig: A command-line DNS lookup tool. dig +short prints only the answer, which makes it easy to compare two resolvers and spot cache poisoning.
display name: The friendly name an email shows, such as "Kettle & Crane IT". It can sit on top of a completely different, untrusted sender address.
DKIM: One of three mail checks (with SPF and DMARC) that test whether a message really came from the domain it claims. A failed check is one more phishing indicator.
DMARC (Domain-based Message Authentication, Reporting and Conformance): A mail check, built on SPF and DKIM, that confirms a message really came from the domain it shows. It protects only the exact domain that publishes it, so a lookalike such as kettleandcrane-group.com can pass for itself, and a pass does not prove the sender is genuine.
DNS (Domain Name System): The system that turns names like shop.kettleandcrane.com into IP addresses like 198.51.100.20. Whoever controls the answer controls where you go.
DNS amplification: Small DNS questions with the victim's address forged as sender, which trigger large answers sent to the victim. The sign is floods of DNS answers nobody asked for.
DNS logs: Records of the DNS lookups each computer makes. They are a rich source of domain IoCs, because nearly every connection starts with a lookup.
DNS spoofing: A false DNS answer reaching a client and sending it to the attacker's address. The sign is a name resolving to an unexpected IP address.
DNS tunneling: Hiding data inside DNS queries to sneak it out past firewalls. Jo's laptop sending 46,000 queries for long random names under one domain was DNS tunneling.
dnsmasq: A small DNS and DHCP server program that the labs use to build test resolvers and DHCP servers.
DNSSEC (DNS Security Extensions): An extension where domain owners sign their DNS records, so a validating resolver rejects forged answers. It is the real fix for DNS cache poisoning.
domain: A name such as kettleandcrane.com. A domain becomes an IoC when it is linked to an attack, and it is harder for an attacker to replace than an IP address.
domain generation algorithm (DGA): A malware technique that creates hundreds of random domain names a day, of which the attacker registers only one, so blocking any single name does not help. The sign is many failed lookups for random-looking names.
domain hijacking: Taking over a domain's registration account and changing its name servers, so the website and email go to the attacker. Everyone everywhere is affected, which tells it apart from cache poisoning.
DoS (denial of service): An attack that tries to make a system unavailable to the people who should use it. When it comes from one source, blocking that source stops it.
double extension: A file name like invoice_scan.pdf.exe that pretends to be a document but ends in .exe, a Windows program.
Dynamic ARP Inspection: A switch feature that drops ARP replies that do not match the real address list, which defends against ARP poisoning.

E

encoding: Rewriting data in another form, as Base64 does. Unlike encryption it hides nothing, because anyone can reverse it.
encryption: Scrambling data so that only someone with the right key can read it. An attacker can still capture encrypted traffic but cannot read it, which is why encryption defeats sniffing.
endpoint security: Security software on computers that, among other things, hashes files and flags matches against known bad hashes.
evil twin: A rogue access point that copies the name of a real network, such as "KettleCrane-Guest", to trick devices into joining it. Everything victims send then passes through the attacker.
excessive resource consumption: A system using far more CPU, memory, disk, network or cloud resources than normal, with no business reason. It can point to cryptojacking, ransomware, exfiltration or a DDoS bot.
exfiltration: Copying data out of an organization without permission. The 38 GB the order server sent to an unknown address at night was exfiltration.
external sender banner: A warning the mail system adds to every message from outside the company. It exposes fake "from the owner" emails even when they pass every mail check.

F

FAT (File Allocation Table): A simple file system, common on removable drives, that stores times only to the whole second.
FBI (Federal Bureau of Investigation): The US federal law-enforcement agency. Its IC3 publishes warnings about scams such as toll smishing and BEC.
FCC (Federal Communications Commission): The US regulator that ruled in 2024 that AI-generated voices count as "artificial" voices under telephone consumer law.
file system: The part of the operating system that stores files and folders, along with details about each one, such as timestamps.
file system artifact: A file, folder or change on disk that shows an attacker was there, such as a web shell, a new cron job or a big archive. The hidden .thumbs.php in the shop's uploads folder was one.
fileless malware: Malware that never writes a program file to disk and runs in memory through trusted tools such as PowerShell or WMI. A clean disk scan proves nothing, so behavior is the clue.
find -mmin: A Linux command that lists files changed within a number of minutes. find -mmin -60 shows files modified in the last hour.
frame: The unit of data on a local network. A switch normally sends each frame only to its destination.
FTC (Federal Trade Commission): The US consumer-protection agency, which has warned about fake QR stickers on parking meters.
FTP (File Transfer Protocol): An older file-transfer protocol that sends passwords unencrypted, so sniffing can capture them.

G

gateway: The router that leads off the local network. Attackers try to pose as the gateway, through rogue DHCP or ARP poisoning, to get on-path.
GET: The HTTP request that means "send me this page". It appears in web server logs.
getent hosts: A Linux command that looks up a name the same way programs do, including the hosts file. It showed that the lab computer would send shop visitors to 203.0.113.66.

H

half-open connection: A TCP connection that was started with SYN but never finished with the final ACK. A SYN flood fills a server's connection table with them.
handshake: The three messages that open a TCP connection: SYN, SYN-ACK and ACK. UDP has no handshake, so a forged sender address is never checked.
hash: A short, fixed-length fingerprint of a file. The same file always gives the same hash, and changing one character changes it completely, so a match proves an exact file but one changed byte defeats it.
header: A labeled line at the top of an email, such as From: or Reply-To:. Defenders read headers without opening any link.
hidden file: A file not shown in normal listings; on Linux, any name starting with a dot. Attackers use hidden names, like .cache.php in an images folder, to keep artifacts out of sight.
homoglyph: A character from another alphabet that looks like a Latin letter, such as a Cyrillic "е" in kettlеandcrane.com. Such domains look identical but their internet form starts with xn--.
host: In a link, the part after https:// and before the next / (or after an @ sign); it decides which server you really reach. Read it from the right: the registered domain at the end names the owner. The word also means a computer, as in clues found on a host.
host artifacts: Traces on a computer such as file names, paths and registry keys. In the Pyramid of Pain they are "annoying" for attackers to change, which is above domains but below tools and TTPs.
hosts file: A small local list of names and addresses that a computer checks before asking DNS. A line for a public site like the shop redirects only that one computer.
HSTS (HTTP Strict Transport Security): A site setting that tells browsers to use only HTTPS for that site, which defeats SSL stripping.
HTTP (Hypertext Transfer Protocol): The protocol that carries web pages. Plain HTTP is not encrypted, so sniffers can read passwords sent over it.
HTTP status codes: Three-digit numbers a web server sends back with every request to report the result, such as 200 OK or 404 Not Found, and records in its access log. Reading them in logs helps spot attacks: a burst of 404s from one IP address, all asking for common weak spots like `/wp-login.php` or `/.env`, points to an automated probe.
HTTPS (HTTP Secure): HTTP protected by TLS encryption, with the site proving its identity using a certificate. It defeats sniffing and most on-path attacks.

I

IC3 (Internet Crime Complaint Center): The FBI's center that collects internet crime reports and issues warnings, such as the 2024 toll-text smishing alert.
IETF (Internet Engineering Task Force): The group that writes internet standards as numbered RFCs. It deprecated TLS 1.0 and 1.1 in RFC 8996.
impersonation: Pretending to be a specific trusted person or role, such as a supplier, boss or technician, to get access, information or money. The fake ridgeline-imports.co bank-change email was impersonation.
incident response plan: An organization's prepared steps for handling a security incident. Alex starts it after finding malware or exfiltration.
indicator: A clue you can see, such as a log line or a slow website, that points to malicious activity. The exam gives you indicators and asks you to name the attack.
indicator of compromise (IoC): Evidence that a system has already been breached, such as a known bad file hash, a connection to a known bad address, or a strange process. Defenders search for IoCs and share them.
IP address (Internet Protocol address): The logical address that identifies a machine on a network. As an IoC it can reveal probes and beaconing, but attackers change addresses easily and addresses get reused.
ip neigh: A Linux command that shows the ARP cache, with lines that read "this IP address is at this MAC address".
IP spoofing: Writing a false sender address into packets. Replies go to the faked address, so it suits attacks like reflected DDoS. The defense is edge filtering of packets with impossible sender addresses.
iproute2: The Linux package that provides the ip command, which the labs use to build test networks and read the ARP cache.
isc-dhcp-client: A DHCP client program that the rogue DHCP lab uses to ask for an address.

K

Kerberos: The modern Windows login protocol. Attackers may try to push logins down from it to weaker NTLMv1 or LM.
kworker: Real Linux kernel threads, shown with names in square brackets and no program file. Malware imitates them with names like kworkerd.

L

lladdr: Short for link-layer address, meaning the MAC address, in ip neigh output.
LM (LAN Manager): A very old, weak Windows password hash and login method. LM logons in the Security log suggest an authentication downgrade.
log manipulation: Deleting, editing, stopping or flooding logs to hide malicious activity. Signs include event 1102, logs that are suddenly empty, and gaps in logs that normally write at a steady rhythm.
log rollover: A full log quietly dropping its oldest entries to make room. Unlike clearing, it keeps recent entries and writes no event 1102.
lookalike domain: A domain that differs from the real one by a letter or its ending, such as kettleandcrane.co or kettlandcrane.com, used to impersonate a trusted sender.
lookalike domain detection: A mail control that flags sender domains resembling the company's own. It catches fakes that pass DMARC.
ls -la: A Linux command that lists files in detail, including hidden files whose names start with a dot.

M

MAC address (media access control address): The hardware address of a network card, written like 02:00:00:00:00:30.
MAC filter: A rule that lets only listed MAC addresses join a network. It is weak, because anyone can copy an address seen over the air.
MAC flooding: Flooding a switch with fake MAC addresses to fill its address table, so it falls back to sending frames out of every port and an attacker can sniff them.
MAC spoofing: Changing a network card's hardware address to copy a trusted device's, for example to get past a MAC filter. The label printer's address appearing on guest Wi-Fi at night was MAC spoofing.
macro: A small program inside an office document. A spreadsheet starting PowerShell or a fake svchost.exe is a classic sign of a malicious macro.
mailbox rules: Rules in an email account that forward or hide mail automatically. New ones the owner did not create can mean the mailbox was taken over.
malicious process: A running program doing the attacker's work. Check its name, folder, parent, whether its file still exists, and what it does.
malware: Malicious software, such as ransomware, cryptominers or bots. It was covered in the previous book.
master file table: The NTFS structure that holds each file's details, including two separate copies of its timestamps. A mismatch between the copies hints at timestomping.
MD5 (Message Digest 5): An older hash still seen in threat feeds as a file label. It is broken for security uses such as signatures.
memcached: A caching service that attackers can abuse as an amplifier in reflected DDoS attacks.
MFA (multifactor authentication): A login that needs a second check, such as a code sent to a phone, on top of the password. Vishers try to trick staff into reading out MFA codes.
mining pool: A server that shares out cryptocurrency mining work. A steady connection on a port like 3333 points to cryptojacking.
mirrored port: A switch port set up to receive a copy of all traffic. A hidden device on one let someone sniff the label-printer password.
MITRE ATT&CK: A public catalog of attack techniques, each with an ID number, such as T1557.002 for ARP poisoning and T1070.006 for timestomping.
monitor mode: A wireless card setting that captures every frame in the air, even from networks it has not joined. Finding it on a machine with no reason to use it is a sign of sniffing.
mtime: The timestamp for when a file's contents last changed. Attackers can easily set it back to hide a new file.

N

name server: The DNS server that holds the official answers for a domain. Compare your resolver's answer with it to spot cache poisoning. Domain hijackers change a domain's name servers.
network namespace: A separate, isolated network stack on one Linux machine. The labs use them to build throwaway test networks.
NSA (National Security Agency): The US agency that co-wrote a 2023 guide with the FBI and CISA on handling deepfakes.
NTFS (New Technology File System): The Windows file system. It records each file's timestamps twice in its master file table, which helps investigators catch timestomping.
NTLM (NT LAN Manager): An older family of Windows login protocols. NTLMv2 is stronger and NTLMv1 is weak, so NTLMv1 logons can point to an authentication downgrade.
NTP (Network Time Protocol): The protocol that keeps clocks in sync, on UDP port 123. Attackers can abuse it as a DDoS amplifier, and systems should all get their time from the same NTP source so their logs line up.

O

on-path attack: An attack where the attacker sits between two systems so every message passes through them, letting them read, change or insert traffic. Certificate warnings are often the only visible sign.
on-path browser attack: Malware inside the web browser that reads and changes pages after they are decrypted. HTTPS shows no warning, because the malware sits after the encryption ends.
openssl: A toolkit for TLS and cryptography, which the labs use to run test TLS servers and clients.
openssl s_client: A command-line TLS client used to test which TLS versions a server accepts.

P

packet sniffer: A tool, such as tcpdump or Wireshark, that captures network traffic so it can be read.
parent process: The process that started another process. A svchost.exe whose parent is EXCEL.EXE, as on Jo's laptop, is a red flag.
PDF (Portable Document Format): A common document format. Malware often pretends to be a PDF with names like invoice_scan.pdf.exe.
persistence: An attacker's ability to stay in, or get back in, after a restart or a password change, using things like scheduled tasks, Run keys, cron jobs or authorized_keys entries.
pharming: Corrupting name resolution so users type the right name but land on a fake site. It can be local (a hosts file or router setting) or on a DNS server (cache poisoning).
phishing: A fake message, pretending to come from someone trusted, that tries to make the victim act. In the narrow sense it means the email version, such as the fake "Microsoft 365" storage alert sent to Jo and eleven others.
PHP: A language for web pages. A hidden .php file in an images or uploads folder is a classic web shell.
PID (process ID): The number the system gives each running process. The PPID is the PID of its parent.
POODLE: A downgrade attack that forced connections down to SSL 3.0 and then broke it. The sign is SSL 3.0 sessions in logs.
PowerShell: A Windows command shell and scripting tool. Fileless malware often runs through it, for example with a long -EncodedCommand.
pressure tricks: The tactics social engineering uses to rush or scare people: urgency, authority, fear, scarcity, familiarity or liking, and social proof. They are usually the first warning sign.
pretext: An invented situation that gives an attacker's request a reason, such as "I'm from the internet provider, here to check the router."
pretexting: Creating a pretext to make a social engineering request believable. Most impersonations need one.
probe: An automated scan that looks for common weaknesses, such as asking for /wp-login.php, /.env and /backup.zip within one second.
process: A running program. Every computer runs dozens of them at once.
Process Explorer: A free Microsoft tool that shows each Windows process's parent, file path and whether its file is signed by a known publisher.
promiscuous mode: A network card setting that keeps every frame it sees, not just frames addressed to it. Finding it on an unexpected machine is a sign of sniffing.
protocol DDoS: A DDoS that fills firewall or server connection tables, for example with half-open connections, while the link still has room.
protocol downgrade: Tricking two systems into agreeing on an older, weaker protocol version that the attacker can break. The clue is a change, like guest-Wi-Fi laptops suddenly using TLS 1.0; the fix is to switch old versions off.
ps: A Linux command that lists running processes with details such as PID, parent, user, CPU use and command.
Punycode: The special encoding that stores domain names containing non-Latin characters. Such a name's internet form starts with xn--, which exposes homoglyph lookalikes.
Pyramid of Pain: David Bianco's six-level ranking of IoCs by how much it hurts attackers when defenders block them: hashes, IP addresses, domains, host artifacts, tools, and TTPs at the top.

Q

QR code (quick response code): A square pattern of black and white blocks that a phone camera turns into text, usually a web link. People cannot read the link with their eyes.
qrencode: A command-line tool that makes QR code images. The quishing lab uses it to create a test code.
quarantine: Moving a flagged file to a safe place so it cannot run.
quishing: Phishing with a QR code, either in a message or as a sticker placed over a real code. The fake sticker at Kettle & Crane's market table led to kettleandcrane-pay.example.

R

random subdomain flood: Floods of queries for names that do not exist, which overwhelm a DNS server. The sign is huge numbers of "no such name" errors.
ransomware: Malware that encrypts files and leaves a note demanding money. Its signs include files renamed with a new extension such as .locked, and heavy disk activity.
rate limit: A cap on how many requests a source can make in a period of time. Alex added one to the shop's search page during the application DDoS.
RCS (Rich Communication Services): A newer phone messaging system. Phishing sent through it still counts as smishing.
reconnaissance: An attacker studying a target through websites, social media, job posts and press releases before attacking. Spear phishing starts with it.
reflected attack: A DDoS where the attacker sends requests to public servers with the victim's address forged, so the servers' replies bounce to the victim. The sign is floods of replies nobody asked for.
registered domain: The part at the right end of a host name, such as order-check.example, that names who owns it. Anything in front is just a label the owner chose.
registrar: The company where you register a domain name. Stealing the registrar login allows domain hijacking.
registry: The Windows settings database. Registry keys are host artifacts, and the Run keys inside it are a common persistence spot.
registry lock: A domain setting that blocks changes unless they are confirmed by hand, which defends against domain hijacking.
Reply-To: An email header that says where replies go. If it differs from the sender, such as a free mailbox, it is a phishing indicator.
reputation service: An online service where you look up a hash, address or domain to see whether it is known to be bad, without opening the file.
resolver: A DNS server that looks up answers for your computer and remembers them for a while. If its cache is poisoned, every user who relies on it is misdirected.
RFC (Request for Comments): A numbered internet standards document from the IETF. RFC 8996 (March 2021) deprecated TLS 1.0 and 1.1.
rogue: A network device that is not authorized and should not be there. On the exam it usually means a rogue access point, an evil twin or a rogue DHCP server.
rogue access point: A Wi-Fi access point plugged into the company network without permission, which creates an unprotected door into it.
rogue DHCP server: An unauthorized DHCP server that answers first and hands out its own gateway or DNS server, so some victims send traffic wherever it chooses.
root: The all-powerful administrator account on Linux. The labs need root access through sudo.
Run keys: Lists of programs in the Windows registry that start at login. New entries there are persistence artifacts.

S

scheduled task: A program set to run automatically at set times. A new scheduled task nobody created is a persistence artifact and can launch fileless malware.
SHA-1: An older hash still seen in threat feeds as a file label. It is broken for security uses such as signatures.
SHA-256 (Secure Hash Algorithm, 256-bit): The hash used in most IoC lists today. CISA's ransomware advisory listed the loader file's SHA-256.
sha256sum: A Linux command that prints a file's SHA-256 hash.
short code: A 5- or 6-digit sender number used for texts. A strange one can be a smishing indicator.
signed file: A program file carrying a digital signature that proves which publisher made it and that it has not been changed. An unsigned file pretending to be a system program is a malicious-process indicator.
skimming: Stealing card data from a tampered card reader. It is different from quishing, which uses a fake link in a QR code.
smishing: Phishing by text message (SMS, or newer systems such as RCS), such as the fake UPS redelivery-fee text Alex received.
SMS (Short Message Service): The standard text message system on phones.
SMTP (Simple Mail Transfer Protocol): The protocol mail servers use to send email. Unencrypted SMTP to a partner that normally uses TLS suggests STARTTLS stripping.
sniffing: Capturing network traffic and reading it. It is passive and reads anything unencrypted, so encryption is the defense.
social engineering: Tricking a person into doing something that helps the attacker, such as clicking, paying, giving a password or opening a door. It attacks people, not computers.
source port: The port number a message is sent from. Floods from services' source ports reveal reflection, and randomizing DNS query source ports makes cache poisoning harder.
spear phishing: Phishing aimed at one chosen person or a small group, using researched details. The fake "Carlos" invoice sent only to Jo during her farm trip was spear phishing.
SPF: One of three mail checks (with DKIM and DMARC) that test whether a message really came from the domain it claims.
spoofing: Faking an identity, such as an IP address, MAC address, ARP reply, email sender or caller ID, so that a system or person trusts you.
SSDP (Simple Service Discovery Protocol): A device-discovery protocol that attackers abuse as an amplifier in reflected DDoS attacks.
SSL (Secure Sockets Layer): The old protocol that TLS grew out of. Its versions are broken and should be switched off.
SSL stripping: Turning a web connection from HTTPS into plain HTTP so nothing is encrypted. HSTS defends against it.
STARTTLS stripping: Removing the offer to encrypt email so mail servers talk in plaintext. The sign is unencrypted SMTP sessions to a partner that normally uses TLS.
stat: A Linux command that shows a file's timestamps (Modify, Change, Access and Birth).
sudo: A Linux command that runs another command as root. Most labs start with sudo bash.
svchost.exe: A real Windows process that runs from C:\Windows\System32. A copy running from a temp folder, or a misspelling like svch0st.exe, is malicious.
switch: A network device that sends each frame only to its destination port, which is why sniffing a wired network needs extra tricks.
SY0-801: The exam code for the current version of the CompTIA Security+ certification. Its objective 2.5, "Given a scenario, analyze indicators of malicious activity," covers network attacks, social engineering, indicators of compromise, application attacks and credential attacks.
SYN flood: A protocol DDoS that sends huge numbers of SYN messages and never sends the final ACK, filling the server with half-open connections.

T

tailgating: Following someone through a secured door. It is different from impersonation, where the attacker asks to be let in by pretending to be someone.
Task Manager: The built-in Windows tool that shows running processes, their users and resource use, and can sort by CPU.
TCP (Transmission Control Protocol): A connection-based network protocol that opens each connection with a three-message handshake (SYN, SYN-ACK, ACK).
tcpdump: A command-line packet sniffer. Defenders use it to fix problems, but finding it installed without approval can be a sign of sniffing.
Telnet: An older remote-login protocol that sends passwords unencrypted.
threat actor: A person or group that carries out attacks. This is assumed knowledge from earlier books.
threat intelligence feed: A regularly updated list of known bad hashes, addresses and domains, shared by agencies, vendors and industry groups.
threat vector: A path an attacker uses to reach a target. This is assumed knowledge from earlier books.
timeline: The order in which events happened, built from timestamps during an investigation.
timestamp: A recorded date and time on a file or a log entry. Investigators use timestamps to build timelines, which makes them a target for attackers.
timestomping: Changing a file's timestamps to hide when it was really created or changed, as with netsvc on the order server. An old modify time with a recent change time is a clue, but only when other evidence backs it up.
TLS (Transport Layer Security): The protocol that encrypts web traffic. As of November 2026, only TLS 1.2 and 1.3 should be allowed, and older versions are targets for downgrade.
TLS alert (protocol version): The TLS error, alert number 70, that a server sends when it refuses the protocol version a client offered. In Alex's lab it showed the server would not accept TLS 1.0, so a downgrade had nothing to land on.
TLS_FALLBACK_SCSV (signaling cipher suite value): A signal a client sends when it retries with a lower TLS version, so the server can refuse the retry. It protects only modern clients.
top-level domain: The last part of a domain name, such as .com or .co. Swapping it creates a lookalike domain.
touch -d: A Linux command that can set a file's modify time to any date. The lab used it to fake a date in March 2024.
TTPs (tactics, techniques and procedures): An attacker's behavior, at the top of the Pyramid of Pain. It is the hardest IoC for an attacker to change.
two-person approval: A rule that payments above a set amount need two people to approve them. It is a control against deepfake and impersonation fraud.
TXT record: A DNS record that holds text. Large TXT replies can be a sign of DNS tunneling.
typosquatting: Registering a misspelled domain, such as kettlandcrane.com, to catch people who mistype the name. It is used in phishing.

U

UDP (User Datagram Protocol): A connectionless network protocol with no handshake, so a forged sender address is never checked. That is why reflection and amplification attacks use it.
UTC (Coordinated Universal Time): The world's standard reference time, which many logs use. Convert local Portland times (UTC minus 7 or 8 hours) and UTC to one zone before comparing events.

V

vishing: Phishing by voice: a call, voicemail or internet call. The fake "bank" call asking Priya to read out a code was vishing.
voice cloning: Using AI to copy a person's voice from short recordings, for deepfake calls or voicemails such as the fake one from the owner.
volumetric DDoS: A DDoS that fills the internet link's bandwidth with junk traffic, so everything on the link is slow.
VPN (virtual private network): An encrypted connection into a network. VPN logs record who connected and from which IP address.
vulnerability: A weakness that an attacker can exploit. Known ones get CVE numbers.

W

web shell: A small script planted in a website's folders that lets an attacker control the web server, such as the hidden .thumbs.php in the shop's uploads folder.
wevtutil cl: A Windows command that clears an event log. Using it on non-Security logs writes event ID 104.
whaling: Phishing aimed at a senior executive, such as the CEO, CFO or owner, using carefully researched details. The fake law-firm email to Kettle & Crane's owner was whaling.
WHOIS: A lookup that shows who owns an address or domain today. Use it before blocking an address flagged by a feed.
Windows event IDs (1102, 104, 1100): Windows event numbers that reveal log manipulation: 1102 means the Security log was cleared (and names the account that did it), 104 means another log was cleared, and 1100 means the event logging service shut down. Event 1100 is also written at normal shutdowns, so it matters only when no shutdown matches it.
WIPS (wireless intrusion prevention system): A system that scans the air and alerts on unknown access points.
Wireshark: A popular graphical packet sniffer, also called a protocol analyzer.
WMI (Windows Management Instrumentation): A built-in Windows management tool that fileless malware can use to run code in memory.
WPA2 (Wi-Fi Protected Access 2): The older Wi-Fi security standard. It encrypts each client's traffic, but devices pushed down to it from WPA3 suggest a downgrade.
WPA3 (Wi-Fi Protected Access 3): The current Wi-Fi security standard.
WPA3 transition mode: A Wi-Fi setting that allows both WPA3 and WPA2, so an attacker can try to push devices down to WPA2.

Z

zbarimg: A tool that decodes barcodes and QR codes from an image, so you can read the link inside without opening it.