Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
2.4
Analyze indicators of malicious activity
| Term | Definition |
|---|---|
| Brute force attack | access to a system is gained by trying all of the possibilities until breaking through |
| Forcible entry (which attack) | brute force |
| Tampering with security devices (which attack) | brute force |
| Confronting security personnel (which attack) | brute force |
| Blinding a surveillance system | overwhelming the sensor/camera with a sudden burst of light to disable it for a period of time |
| Electromagnetic interference to a surveillance system | jamming the signals that surveillance systems rely on |
| Access badge technology - contactless | radio frequency identification (RFID) and near field communication (NFC) |
| Access badge cloning steps | scanning, data extraction, writing to a new card, using the badge |
| Attack vector | the way an attacker might get into a system AND how they are going to infect that system |
| Virus | malicious code that is run on a machine without the user's knowledge and infects the computer when it is run |
| Boot sector virus | stored in the first sector of a hard drive and it is then loaded into memory when the computer boots up |
| Macro virus | form of code that allows a virus to be embedded inside another document so that when the doc is opened, the virus is executed |
| Program virus | tries to find executables/application files to infect |
| Multipartite virus | boot sector and program virus combination |
| Encrypted virus | designed to hide itself from being detected by encrypting its malicious code to avoid detection |
| Polymorphic virus | advanced version of encrypted that also changes the virus' code each time it's executed by altering the decryption module to avoid detection |
| Metamorphic virus | able to rewrite itself entirely before it attempts to infect a file |
| Stealth virus technique | prevents the virus from being detected by anti-virus software |
| Armored virus | has a layer of protection to confuse someone/thing trying to analyze it |
| Worms | malicious software that can replicate itself without any user interaction |
| Trojans | malicious software disguised as a piece of harmless software |
| Remote access trojan (RAT) | provides the attacker with remote access control of a victim machine |
| Ransomware | designed to block access to a computer system or its data by encrypting it until a ransom is paid to the attacker |
| Botnet | network of compromised computers/devices controlled remotely by malicious actors |
| Zombie | a compromised device part of a botnet and is used to perform tasks using remote commands |
| Command and control node (C2 node) | responsible for managing and coordinating the activities of other nodes/devices in a network - |
| The most common use of botnets | DDoS attacks |
| Rootkits | type of software designed to gain administrative level control over a given computer system without being detected |
| Rootkits allow attackers to | install and delete programs & open and shut ports |
| Kernal mode | allows a system to control access to things like device drivers, sound card, monitor |
| DDL injection | technique used to run arbitrary code in the address space of another process by forcing it to load a dynamic-link library |
| Shim | software code that is placed between two components to intercept or redirect normal execution flow |
| Backdoor | used to bypass the normal security and authentication functions |
| Logic bomb | malicious code that is inserted into a program and will only execute when certain conditions have been met |
| Keylogger | piece of soft/hardware that records every single keystroke made on a device |
| Spyware | malicious software designed to gather and send info about a user or organization |
| Bloatware | any software that comes preinstalled on a new device that the user did not request, want, or need |
| Exploit technique | the specific method by which malware code infects a target host |
| Fileless malware | creates a process in the system memory without relying on the local file system of the infected host |
| Dropper | initiates or runs other malware forms within a payload or host |
| Downloader | retrieves additional tools post the initial infection facilitated by a dropper |
| Shellcode | encompasses lightweight code meant to execute an exploit on a given target |
| Indicators of malware attacks | account lockouts, concurrent session utilization, blocked content, impossible travel, resource consumption, resource inaccessibility, irregular or missing logs |
Created by:
crly