Skip to content
The Incident Ledger

Reference

Glossary

Plain-English definitions of the security terms SOC analysts meet every day, with examples and why each one matters.

A

  • Advanced persistent threat

    noun · also APT · NIST CSRC Glossary

    A well-resourced, often state-backed group that targets specific organizations and works to stay hidden in their networks for months or years.

  • Adversary-in-the-middle phishing

    noun · also AiTM, AiTM phishing · MITRE ATT&CK T1557

    Phishing that relays the victim's sign-in to the real site through an attacker's proxy, stealing the session cookie after MFA succeeds.

B

  • Botnet

    noun · NIST CSRC Glossary

    A network of compromised devices controlled remotely by an attacker and used together for spam, DDoS attacks, credential attacks or proxying traffic.

  • Brute force

    noun · also Brute-force attack, Password guessing · MITRE ATT&CK T1110

    Gaining access by systematically trying passwords or keys until one works, either online against a login or offline against stolen hashes.

  • Business email compromise

    noun · also BEC, CEO fraud · FBI Internet Crime Complaint Center (IC3)

    Fraud in which an attacker impersonates or takes over a trusted business email account to redirect payments or obtain sensitive data.

C

  • Command and control

    noun · also C2, C&C · MITRE ATT&CK TA0011

    The channel attackers use to communicate with compromised systems: sending commands, receiving stolen data and delivering new tools.

  • Conditional Access

    noun · also CA policy, Conditional Access policy

    Microsoft Entra ID's policy engine that decides, at each sign-in, whether to allow access, require MFA or another control, or block.

  • Credential stuffing

    noun · MITRE ATT&CK T1110.004

    Automated sign-in attempts using username and password pairs leaked from other breaches, betting that people reuse the same password.

  • Cyber kill chain

    noun · also Kill chain, Lockheed Martin Cyber Kill Chain · Lockheed Martin

    Lockheed Martin's seven-stage model of an intrusion, from reconnaissance to actions on objectives, used to find where an attack can be stopped.

D

  • Domain controller

    noun · also DC · Microsoft Learn: AD DS overview

    A Windows server running Active Directory Domain Services: it stores accounts and password hashes and authenticates every sign-in in the domain.

E

  • EDR

    noun · also Endpoint detection and response

    Security software on laptops and servers that records process, file and network activity, detects malicious behavior and lets analysts respond.

F

  • False positive

    noun · also FP

    An alert that fires on activity that is not actually malicious, because the detection logic matched something legitimate.

  • Fileless malware

    noun

    Malicious code that runs in memory or through legitimate tools like PowerShell, leaving few or no malicious files on disk to scan.

G

  • Golden ticket

    noun · MITRE ATT&CK T1558.001

    A forged Kerberos ticket-granting ticket, made with the krbtgt account's key, that lets an attacker impersonate any user in the domain.

I

  • Identity and access management

    noun · also IAM · NIST CSRC Glossary

    The processes and tools that manage digital identities and decide what each one can access, from account creation to removal.

  • Incident response

    noun · also IR · NIST SP 800-61 Rev. 3

    The organized process of detecting, analyzing, containing, eradicating and recovering from a security incident, then learning from it.

  • Indicator of compromise

    noun · also IOC, IoC

    An observable artifact, such as a file hash, IP address, domain or registry key, that suggests a system may have been compromised.

  • Insider threat

    noun · NIST CSRC Glossary

    Risk that comes from people with legitimate access, such as employees or contractors, whether they act maliciously, carelessly or under an attacker's control.

K

  • Kerberoasting

    noun · MITRE ATT&CK T1558.003

    Requesting Kerberos service tickets for service accounts and cracking them offline to recover those accounts' passwords.

  • Kerberos

    noun · RFC 4120

    The ticket-based authentication protocol used by Active Directory, in which a domain controller issues tickets that prove a user's identity to services.

  • KQL

    noun · also Kusto Query Language

    The read-only query language used by Microsoft Sentinel, Defender XDR advanced hunting, Azure Monitor and Azure Data Explorer.

L

  • Lateral movement

    noun · MITRE ATT&CK TA0008

    The techniques attackers use to move from the first compromised system to other systems and accounts inside a network.

  • Least privilege

    noun · also Principle of least privilege, PoLP · NIST CSRC Glossary

    Giving every user, service and application only the access it needs to do its job, and only for as long as it needs it.

  • Living off the land

    noun · also LOTL, LOLBins, LOLBAS · CISA: Identifying and Mitigating LOTL Techniques

    Attacking with tools already present on the victim's systems, such as PowerShell or WMI, so the activity blends in with normal administration.

M

  • Malware

    noun · also Malicious software · NIST CSRC Glossary

    Any software designed to harm a system or its users, such as viruses, worms, trojans, ransomware, spyware and infostealers.

  • MFA fatigue

    noun · also Push bombing, MFA spamming, MFA bombing · MITRE ATT&CK T1621

    An attack that floods a user with MFA push prompts, using a stolen password, until the user approves one out of confusion or annoyance.

  • MITRE ATT&CK

    noun · also ATT&CK, ATTACK framework · attack.mitre.org

    A free, public knowledge base of adversary tactics and techniques based on real-world observations, used as a common language for attack and defense.

  • Multi-factor authentication

    noun · also MFA · NIST CSRC Glossary

    Signing in with two or more different kinds of proof, such as a password plus a phone or security key, so a stolen password alone is not enough.

N

  • NTLM

    noun · also NT LAN Manager · Microsoft Learn: NTLM overview

    An older Windows challenge-response authentication protocol, still used as a fallback to Kerberos and a frequent target of relay and pass-the-hash attacks.

P

  • Pass-the-hash

    noun · also PtH · MITRE ATT&CK T1550.002

    Authenticating as a user with their stolen password hash instead of the password itself, abusing how NTLM works to move between Windows systems.

  • Password spray

    noun · also Password spraying · MITRE ATT&CK T1110.003

    An attack that tries a few common passwords against many accounts, staying under lockout limits that per-account guessing would trigger.

  • Phishing

    noun · MITRE ATT&CK T1566

    A message that impersonates someone trustworthy to trick the recipient into clicking a link, opening a file, sharing credentials or sending money.

  • Phishing-resistant MFA

    noun · also Phishing-resistant authentication · NIST SP 800-63B

    Authentication methods, such as passkeys, FIDO2 keys and Windows Hello for Business, that cannot be relayed or approved by a phished user.

  • Privilege escalation

    noun · MITRE ATT&CK TA0004

    Gaining higher permissions than an account was given, such as moving from a standard user to local administrator, domain admin or cloud global admin.

R

  • Ransomware

    noun · MITRE ATT&CK T1486

    Malware that encrypts an organization's data and demands payment for the key, often after stealing the data to threaten its release.

  • Role-based access control

    noun · also RBAC · NIST RBAC project

    Granting permissions to roles, such as Help Desk or Billing Reader, and then assigning people to roles, instead of granting rights person by person.

  • Rootkit

    noun · MITRE ATT&CK T1014

    Malware that hides itself and other malicious activity by modifying the operating system, often at the kernel or boot level.

S

  • Security operations center

    noun · also SOC

    The team, processes and tools that monitor an organization around the clock, investigate alerts and coordinate the response to incidents.

  • SIEM

    noun · also Security information and event management

    A platform that collects logs from across an organization, correlates them and raises alerts, giving the SOC one place to investigate.

  • SOAR

    noun · also Security orchestration, automation and response

    Tools that connect security products and run automated playbooks, so routine response steps happen in seconds instead of being done by hand.

  • Social engineering

    noun · NIST CSRC Glossary

    Manipulating people, rather than systems, into giving up information, access or money by exploiting trust, urgency, authority or helpfulness.

  • Spear phishing

    noun · also Spearphishing · MITRE ATT&CK T1566

    Phishing aimed at a specific person or small group, using details about them to make the message credible enough to bypass suspicion.

  • Supply chain attack

    noun · MITRE ATT&CK T1195

    Compromising a trusted supplier, software update or library to reach its customers, who install the malicious code believing it is legitimate.

T

  • Tactics, techniques and procedures

    noun · also TTP, TTPs · MITRE ATT&CK

    How an attacker operates: the goal of each step (tactic), the method used to reach it (technique) and the specific way it is carried out (procedure).

  • Threat hunting

    noun · also Hunting, Cyber threat hunting

    The proactive search for attackers who are already inside the environment but have not triggered any alert, usually starting from a hypothesis.

  • Threat intelligence

    noun · also CTI, Cyber threat intelligence · NIST SP 800-150

    Information about threats and threat actors, collected and analyzed so that an organization can make better security decisions.

  • Trojan

    noun · also Trojan horse · NIST CSRC Glossary

    Malware disguised as legitimate software, such as a cracked app, a fake update or an invoice, that the victim installs themselves.

W

  • Worm

    noun · NIST CSRC Glossary

    Malware that copies itself from system to system on its own, usually by exploiting a vulnerability, without any user action.

X

  • XDR

    noun · also Extended detection and response

    A security platform that correlates detections from endpoints, identities, email, cloud apps and more into single incidents with a shared response console.

Z

  • Zero-day

    noun · also 0-day, Zero-day vulnerability · NIST CSRC Glossary

    A vulnerability that attackers exploit before the vendor has released a fix, so defenders have had zero days to patch it.