¡GoConqr estrena diseño! Cuéntanos qué te parece.

Regístrate gratis

Fichas

02 Handout 1

Eljin Aguilar Computer Network and Security hard Inglés 71 fichas

Fichas del conjunto (71)

  1. 1This is an efficient and effective way of illustrating how an adversary can attack the target organization. This model helps organizations understand the various possible threats at every stage of an attack and the necessary countermeasures to defend against such attacks.Cyber Kill Chain Methodology
  2. 2An adversary performs this to collect as much information about the target as possible to probe for weak points before actually attacking. They look for information such as publicly available information on the Internet, network information, system information, and organizational information of the target.Reconnaissance
  3. 3The adversary analyzes the data collected in the previous stage to identify the vulnerabilities and techniques that can be exploited and gain unauthorized access to the target organization. Based on the vulnerabilities identified during analysis, the adversary selects or creates a tailored deliverable malicious payload (remote-access malware weapon) using an exploit and a backdoor to send it to the victim.Weaponization
  4. 4The previous stage included creating a weapon. Its payload is transmitted to the intended victim(s) as an e-mail attachment, via a malicious link on websites, or through a vulnerable web application or USB drive.Delivery
  5. 5After the weapon is transmitted to the intended victim,it triggers the adversary’s malicious code to exploit a vulnerability in the operating system, application, or server on a target system. At this stage, the organization may face threats such as authentication and authorization attacks, arbitrary code execution, physical security threats, and security misconfiguration.Exploitation
  6. 6The adversary downloads and installs more malicious software on the target system to maintain access to the target network for an extended period. They may use the weapon to install a backdoor to gain remote access.Installation
  7. 7The adversary, which establishes two-way communication between the victim’s system and the adversary-controlled server to communicate and pass data back and forth. The adversaries implement techniques such as encryption to hide the presence of such channels.Command and Control
  8. 8The adversary controls the victim’s system from a remote location and finally accomplishes their intended goals. The adversary gains access to confidential data, disrupts the services or network, or destroys the operational capability of the target by gaining access to its network and compromising more systems.Actions on Objectives
  9. 9This refer to the patterns of activities and methods associated with specific threat actors or groups of threat actors. This are helpful in analyzing threats and profiling threat actors and can further be used to strengthen the security infrastructure of an organization.Tactics, Techniques, and Procedures (TTPs)
  10. 10Describe the way the threat actor operates during different phases of an attack. It consists of the various strategy used to gather information for the initial exploitation, perform privilege escalation and lateral movement, and deploy measures for persistence access to the system.Tactics
  11. 11To launch an attack successfully, threat actors use several approaches during their execution. These approached include initial exploitation, setting up and maintaining command and control channels, accessing the target infrastructure, and covering the tracks of data exfiltration.Techniques
  12. 12Involve a sequence of actions performed by the threat actors to execute different steps of an attack life cycle. The number of actions usually differs depending upon the objectives of the procedure and the APT group.Procedures
  13. 13This are the clues, artifacts, and pieces of forensic data that are found on a network or operating system of an organization that indicate a potential intrusion or malicious activity in the organization’s infrastructure. However, this are not intelligence; rather, this act as a good source of information about threats that serve as data points in the intelligence process.Indicators of Compromise (IoCs)
  14. 14Attackers usually prefer e-mail services to send malicious data to the target organization or individual. Such socially engineered e-mails are preferred due to their ease of use and comparative anonymity.E-mail Indicators
  15. 15Useful for command and control, malware delivery, and identifying details about the operating system, browser type, and other computer-specific information. Examples of network indicators include URLs, domain names, and IP addresses.Network Indicators
  16. 16Found by performing an analysis of the infected system within the organizational network. Examples of this indicators include filenames, file hashes, registry keys, DLLs, and mutex.Host-Based Indicators
  17. 17Generally, typical IoCs are useful for identifying indications of intrusion, such as malicious IP addresses, virus signatures, MD5 hash, and domain names. This IoCs are used to identify specific behavior related to malicious activities, such as code injection into the memory or running the scripts of an application.Behavioral Indicators
  18. 18In the field of computer security, it refers to exploiting system vulnerabilities and compromising security controls to gain unauthorized or inappropriate access to system resources. It involves modifying system or application features to achieve a goal outside its creator’s original purpose.Hacking
  19. 19A person who breaks into a system or network without authorization to destroy, steal sensitive data, or perform malicious attacks. A hacker is an intelligent individual with excellent computer skills, along with the ability to create and explore the computer’s software and hardware.Hacker
  20. 20Individuals who use their extraordinary computing skills for illegal or malicious purposes. This category of hacker is often involved in criminal activities.Black Hats
  21. 21, or penetration testers, are individuals who use their hacking skills for defensive purposes. These days, almost every organization has security analysts who are knowledgeable about hacking countermeasures, which can secure its network and information systems against malicious attacks.White Hats
  22. 22Individuals who work both offensively and defensively at various times. It might help hackers to find multiple vulnerabilities in a system or network and, at the same time, help vendors to improve products (software or hardware) by checking limitations and making them more secure.Gray Hats
  23. 23Individuals who aim to bring down critical infrastructure for a “cause” and are not worried about facing jail terms or any other kind of punishment. Suicide hackers are similar to suicide bombers who sacrifice their lives for an attack and are thus not concerned with the consequences of their actions.Suicide Hackers
  24. 24Unskilled hackers who compromise systems by running scripts, tools, and software developed by real hackers. They usually focus on the quantity, rather than the quality, of the attacks that they initiate.Script Kiddies
  25. 25Individuals with a wide range of skills who are motivated by religious or political beliefs to create the fear of large-scale disruption of computer networks.Cyber Terrorists
  26. 26Skilled individuals having expertise in hacking and are employed by the government to penetrate, gain top-secret information from, and damage the information systems of other government or military organizations. The main aim of these threat actors is to detect vulnerabilities in and exploit a nation’s infrastructure and gather intelligence or sensitive information.State-Sponsored Hackers
  27. 27This is a form of activism in which hackers break into government or corporate computer systems as an act of protest. It use hacking to increase awareness of their social or political agendas, as well as to boost their reputations in both online and offline arenas.Hacktivist
  28. 28A consortium of skilled hackers having their own resources and funding. They work together in synergy for researching state-of-the-art technologies.Hacker Teams
  29. 29Individuals who perform corporate espionage by illegally spying on competitor organizations. They focus on stealing critical information such as blueprints, formulas, product designs, and trade secrets.Industrial Spies
  30. 30Any employee (trusted person) who has access to critical assets of an organization. This threat involves the use of privileged access to violate rules or intentionally cause harm to the organization’s information or information systems.Insiders
  31. 31Groups of individuals or communities that are involved in organized, planned, and prolonged criminal activities. They exploit victims from distinct jurisdictions on the Internet, making them difficult to locate.Criminal Syndicates
  32. 32A group of hackers working together in criminal activities. Such groups are well organized in a hierarchical structure consisting of leaders and workers.Organized Hackers
  33. 33It is the preparatory phase in which an attacker gathers as much information as possible about the target prior to launching the attack. In this phase, the attacker draws on competitive intelligence to learn more about the target.Hacking Phase: Reconnaissance
  34. 34It is the phase immediately preceding the attack. Here, the attacker uses the details gathered during reconnaissance to scan the network for specific information.Hacking Phase: Scanning
  35. 35This is the phase in which real hacking occurs. Attackers use vulnerabilities identified during the reconnaissance and scanning phases to gain access to the target system and network.Hacking Phase: Gaining Access
  36. 36It is the phase when the attacker tries to retain their ownership of the system. Once an attacker gains access to the target system with admin or root-level privileges (thus owning the system), they can use both the system and its resources at will.Hacking Phase: Maintaining Access
  37. 37For obvious reasons, such as avoiding legal trouble and maintaining access, attackers will usually attempt to erase all evidence of their actions.It refers to the activities carried out by an attacker to hide malicious acts.Hacking Phase: Clearing Tracks
  38. 38The practice of employing computer and network skills to assist organizations in testing their network security for possible loopholes and vulnerabilities.Ethical Hacking
  39. 39Security experts broadly categorize computer crimes into two (2) categories: crimes facilitated by a computer and those in which the computer is the target. Ethical hacking is a structured and organized security assessment, usually as part of a penetration test or security audit, and is a crucial component of risk assessment, auditing, counter fraud, and information systems security best practices.Scope and Limitations of Ethical Hacking
  40. 40It is the use of advanced Google search operators for creating complex search queries to extract sensitive or hidden information. Attackers then use the accessed data to find vulnerable targets.Reconnaissance using Advanced Google Hacking Techniques
  41. 41the art of creating complex search engine queries. Queries can retrieve valuable data about a target company from Google search results.Advanced Google hacking
  42. 42This operator restricts search results to the specified site or domain.site:
  43. 43This operator restricts results to only the pages containing all the query terms specified in the URL.allinurl:
  44. 44This operator restricts the results to only the pages containing the specified word in the URL.inurl:
  45. 45This operator restricts results to only the pages containing all the query terms specified in the title.allintitle:
  46. 46This operator restricts results to only the pages containing the specified term in the title.intitle:
  47. 47This operator restricts results to only the pages containing the query terms specified in the anchor text on links to the page.inanchor:
  48. 48This operator restricts results to only the pages containing all query terms specified in the anchor text on links to the pages.allinanchor:
  49. 49This operator displays Google's cached version of a web page instead of the current version of the web page.cache:
  50. 50This operator searches websites or pages that contain links to the specified website or page.link:
  51. 51This operator displays websites that are similar or related to the URL specified.related:
  52. 52This operator finds information for the specified web page.info:
  53. 53This operator finds information for a specific location.location:
  54. 54This operator allows you to search for results based on a file extension.Filetype
  55. 55It automatically extracts specific information from web pages. It extracts targeted contact data (e-mail, phone, and fax) from the website, extracts the URL and meta tags (title, description, keyword) for website promotion, searches directory creation, performs web research, and so on.Web Data Extractor
  56. 56It services such as https://www.tamos.com can help to perform it. The services perform by entering the target's domain or IP address.Whois Lookup
  57. 57The Windows operating system, by default, uses this traceroute. Go to the command prompt and type the tracert command along with the destination IP address or domain name as follows: tracert 216.239.36.10ICMP Traceroute
  58. 58Many devices in any network are generally configured to block ICMP traceroute messages. In this scenario, an attacker uses this traceroute, which is also known as Layer 4 traceroute.TCP Traceroute
  59. 59Like Windows, Linux also has a built-in traceroute utility, but it uses the this protocol for tracing the route to the destination. Go to the terminal in the Linux operating system and type the traceroute command along with the destination IP address or domain name as follows: traceroute www.google.comUDP Traceroute
  60. 60is a security scanner for network exploration and hacking. It allows you to discover hosts, ports, and services on a computer network, thus creating a 'map' of the network.Nmap Or Network Mapper
  61. 61This includes scanners such as the Comprehensive Security Scanner, Port scanner (TCP and UDP ports), IP scanner, NetBIOS scanner, and Share Scanner. All Scanners can scan individual computers, any range of IP addresses, domains, and a selected type of computers inside domains.MegaPing
  62. 62the OS of the target machine can be identified by observing the TTL values in the acquired scan result.Unicornscan
  63. 63A Windows utility that helps in troubleshooting NETBIOS name resolution problems. This command removes and corrects preloaded entries using several case-sensitive switches.Nbtstat Utility
  64. 64An enumeration tool that shows how to use remote network support and deal with some other web protocols, such as SMB. Attackers use thisto enumerate details such as this names, usernames, domain names, and media access control (MAC) addresses for a given range of IP addresses.NetBIOS Enumerator
  65. 65works together to perform a full-scale test covering all aspects of the network, as well as physical and system intrusion.tiger team
  66. 66refer to persons who employ their hacking skills for offensive purposes“cracker” and “attacker”
  67. 67is the process of hiding data in other data, for instance, in image and sound files.Steganography
  68. 68takes advantage of the transmission protocol by carrying one protocol over anotherTunneling
  69. 69refers to the activities carried out by an attacker to hide malicious actsClearing tracks
  70. 70to exploit the system by pretending to be a legitimate user or a different system, attackers can send a data packet containing a bug to the target system to exploit a vulnerability.spoofing
  71. 71is looking through an organization’s trash for any discarded sensitive information.Dumpster diving

Información

Descripción
hard Computer Network and Security Fichas sobre 02 Handout 1, creado por Eljin Aguilar el 08/08/2025.
Creado por
Eljin Aguilar
Visitas
18
Valoración

Escríbenos

¿Sobre qué es tu mensaje?

¿Qué te parece el nuevo diseño?

¿Te gusta?