Glossary
Cyber threat intelligence glossary
The terms threat intelligence analysts use every day, explained in plain English with a real example for each. The same definitions appear when you hover a term inside our lessons and missions.
180 terms
A
- Admiralty CodeA two character source grading scheme: a letter for how reliable the source is, a number for how credible this particular claim is.
- Adversary-in-the-middleAn attacker secretly sitting between a user and a real service, relaying traffic so they can read it or steal session tokens.
- Analysis of Competing HypothesesA structured method for testing several explanations against the evidence and favouring the one with the least evidence against it.
- APTAdvanced Persistent Threat: shorthand for a well resourced intruder, usually state linked, who stays in an environment rather than smashing and grabbing.
- ArtifactA concrete object recovered from an intrusion, such as a file, a filename, a registry entry or a captured screenshot.
- ASNAutonomous System Number: the identifier for a network operator's block of IP space, such as an ISP or hosting provider.
- Asset inventoryThe maintained list of systems an organisation owns, without which nobody can say what is exposed.
- Attack surfaceEverything an outsider can reach and attempt to use, which is why an inventory is the cheapest proactive work there is.
- AttributionDeciding who was behind activity. The judgement analysts most want to make and the one most often made on thin evidence.
B
- BackdoorA hidden way into a system that bypasses normal authentication, left by an attacker or built in, so access can be regained at will.
- BeaconingRegular check-ins from implanted malware to its command and control server, often at a fixed interval, asking whether there are new instructions.
- Blockchain analysisTracing cryptocurrency transactions across public blockchains to follow stolen or illicit funds and link addresses to services or people.
- BlocklistA list of addresses, domains or hashes a tool refuses automatically. Useful and cheap, and near the bottom of the Pyramid of Pain.
- BotnetA network of infected devices controlled together by one operator, used for spam, DDoS attacks, credential attacks or spreading more malware.
- Brute forceTrying huge numbers of passwords or keys until one works, either against a live login or offline against stolen password hashes.
- Bulletproof hostingHosting providers that knowingly ignore abuse complaints and takedown requests, giving criminals somewhere to keep servers online.
- Business email compromiseFraud where criminals impersonate or take over a business email account to trick staff into paying invoices or changing bank details.
C
- CampaignA set of intrusions sharing techniques and infrastructure across several victims over time, rather than one isolated incident.
- CensysAn internet scanning and search platform, similar to Shodan, with detailed data on hosts, services and certificates.
- Certificate transparencyPublic, append-only logs of every TLS certificate issued by trusted authorities, searchable to discover domains and subdomains.
- Chain of custodyThe documented record of who collected evidence, who handled it and how it was stored, showing it was not altered along the way.
- CISOThe senior leader responsible for an organisation's information security.
- ClickFixA social engineering trick where a fake error or CAPTCHA page tells the user to paste and run a command, which installs malware.
- Cobalt StrikeA commercial red team tool for simulating attackers. Cracked copies are widely abused by real criminals and state groups for command and control.
- Collection planA plan matching each intelligence requirement to the sources and methods that will answer it, and showing where the gaps are.
- CombolistA text file of email or username and password pairs, compiled from breaches and stealer logs, used for credential stuffing.
- Command and controlThe channel a compromised machine uses to reach the operator for instructions. Often shortened to C2.
- Confidence levelHow sure an analyst is in a judgement, usually stated as low, moderate or high, based on the quality and quantity of evidence.
- Confirmation biasThe tendency to notice and favour evidence that supports what you already believe and to discount evidence against it.
- CounterintelligenceActivities to detect and defeat an adversary's intelligence efforts against you, from spotting surveillance to finding insiders.
- Credential stuffingAutomatically trying username and password pairs leaked from one site against other sites, betting that people reuse passwords.
- Cryptocurrency mixerA service that pools and reshuffles cryptocurrency from many users to break the visible link between where funds came from and where they go.
- CVEThe public catalogue number given to one specific disclosed vulnerability, so everyone can refer to the same flaw.
- CVSSCommon Vulnerability Scoring System: a 0 to 10 score of how severe a vulnerability is, based on its technical characteristics.
D
- Dark webWebsites reachable only through anonymity networks such as Tor, used for privacy and also hosting criminal markets, forums and leak sites.
- Data breachAn incident where data is accessed or taken by someone not authorised to have it, such as customer records leaked from a hacked database.
- DDoSDistributed denial of service: flooding a website or service with traffic from many sources so real users cannot reach it.
- Dead dropA hidden place to leave something for another person to collect later without meeting. In malware, a public page hiding C2 details.
- DeepfakeSynthetic audio, video or images made with AI to convincingly imitate a real person, used in fraud, scams and disinformation.
- Detection engineerThe person who writes and tunes the rules that decide which activity raises an alert.
- Diamond ModelA model giving every intrusion event four features, adversary, capability, infrastructure and victim, so knowing one gives you a route to the others.
- Digital forensicsCollecting and examining digital evidence from computers, phones and networks in a way that preserves it and can stand up to scrutiny.
- DisseminationGetting a finished product to the person who needs it, in the format and on the channel they already use, before their decision closes.
- DKIMDomainKeys Identified Mail: a cryptographic signature added to email so receivers can verify the message came from the signing domain unchanged.
- DMARCA DNS policy telling receivers what to do with email that fails SPF and DKIM checks for a domain: nothing, quarantine or reject.
- DNS resolverThe service that turns names into addresses. Its logs record which names machines on your network asked for.
- DNS tunnelingHiding data or C2 traffic inside DNS queries and responses, which are often allowed out of networks without inspection.
- Domain generation algorithmCode in malware that creates many pseudo-random domain names each day, so the operator only needs to register one for infected machines to find C2.
- Double extortionRansomware tactic of stealing data before encrypting it, then threatening to publish the data if the victim refuses to pay.
- DropperA small piece of malware that carries another malicious program inside it and installs it on the victim's machine.
- Dynamic analysisRunning a suspicious file in a controlled environment and watching what it actually does: processes, files, registry and network activity.
E
- EDREndpoint Detection and Response: security software on each computer that records process, file and network activity and can block or isolate threats.
- ElicitationDrawing information out of someone in conversation without them realising they are being questioned.
- EnrichmentAttaching known context to raw material, such as resolving a domain or tagging an address with its hosting provider.
- Estimative languageStandard words such as "likely" or "almost certainly" used in intelligence to express probability consistently.
- ExfiltrationMoving stolen data out of the victim environment to somewhere the attacker controls.
- EXIFMetadata stored inside photos: camera or phone model, date and time, settings and sometimes GPS coordinates of where it was taken.
- ExploitCode or a technique that takes advantage of a vulnerability to make software do something its owner did not intend, such as run the attacker's commands.
F
G
H
- HacktivistSomeone who hacks for political or social causes, usually through DDoS attacks, website defacements and data leaks meant to draw attention.
- HashA fixed length value computed from a file's contents. It identifies the exact file and changes completely if one byte changes.
- HoneypotA system deployed to be attacked, so the interaction it attracts becomes collection you own.
- HUMINTHuman Intelligence: information that existed in someone's head and reached you because that person chose to tell you.
- HypervisorThe software that runs whole operating systems as guests on one physical machine, such as VirtualBox or VMware.
I
- IDSIntrusion Detection System: a sensor that inspects network or host activity against rules and raises alerts on known attack patterns.
- IMINTImagery Intelligence: information carried in pictures, which in cyber usually means screenshots the poster did not read carefully.
- Incident responseThe organised process of detecting, containing, investigating and recovering from a security incident, then learning from it.
- IndicatorAn observable such as a hash, domain or address that points to a specific intrusion. The most perishable thing in any report.
- Indicator of attackEvidence of attacker behaviour in progress, such as a process dumping credentials, rather than a static artefact like a hash or IP.
- InfostealerMalware built to grab saved passwords, browser cookies, crypto wallets and system details from a computer and send them to the attacker.
- Initial accessThe first foothold an attacker gains in a target environment, for example through phishing, a stolen password or an exploited internet-facing system.
- Initial access brokerA criminal who breaks into organisations or collects working logins and then sells that access to other criminals, often ransomware groups.
- Intelligence cycleThe repeating process of turning questions into intelligence: direction, collection, processing, analysis, dissemination and feedback.
- Intelligence requirementA specific question the intelligence team needs to answer for its stakeholders, which decides what gets collected and analysed.
- Internet-facingReachable from the public internet rather than only from inside the organisation network.
- IOCIndicator of Compromise: an observable such as a hash, domain or IP that suggests a specific intrusion.
J
K
- KEVCISA's Known Exploited Vulnerabilities catalogue: a public list of vulnerabilities confirmed to be exploited in real attacks.
- KeyloggerMalware or hardware that records what a user types, to capture passwords, messages and other sensitive input.
- Kill chainLockheed Martin's seven stage model of an intrusion as a sequence, used to work out how far an attack got before you saw it.
L
- Lateral movementAn attacker moving from the first machine they compromised to other systems inside the same network, usually toward valuable data or admin access.
- Leak siteA site run by an extortion operator where victims who refused to pay are named and their stolen files published.
- Living off the landAttacking with tools already built into the operating system, such as PowerShell or certutil, so that no obvious malware needs to be installed.
- LoaderMalware whose main job is to get a foothold and then download and run other malware, often sold to several criminal groups.
- Log retentionHow long log data is kept before deletion, which sets how far back an investigation can look.
- Log4ShellThe 2021 vulnerability in the Log4j logging library that let an attacker run code by getting a string into a log message.
M
- MalwareSoftware written to act against the interests of the machine's owner.
- MetadataInformation a file carries about itself rather than in its contents: when it was made, on what device, and sometimes where.
- MFAMulti-factor authentication: requiring a second proof of identity, such as an app prompt or security key, in addition to a password.
- MFTManaged File Transfer: a server whose job is moving files between organisations, which makes it a rich target when it is exposed.
- MISPAn open-source threat intelligence sharing platform for storing, correlating and exchanging indicators and events between organisations.
- MITRE ATT&CKA shared vocabulary of adversary tactics and techniques, so two reports describing the same behaviour use the same name for it.
- Money muleA person, knowingly or not, who moves stolen money through their own bank or crypto accounts so the criminals behind it are harder to trace.
N
O
- ObfuscationDeliberately making code, commands or data hard to read or recognise, for example with encoding or junk code, to slow analysis and avoid detection.
- OperatorThe group or individual actually running an intrusion or extortion, used when you can see the activity but do not want to claim an identity.
- OPSECOperational security: protecting your own identity, intentions and methods from the people you are investigating or defending against.
- OSINTOpen Source Intelligence: material anyone can lawfully reach, from forums and leak sites to registration and scan data.
P
- PackerA tool that compresses or encrypts an executable and unpacks it at runtime, often used to hide malware from scanners and analysts.
- Passive DNSA historical database of DNS answers seen over time, showing which IPs a domain pointed to and which domains shared an IP.
- PatchA vendor fix for a known flaw, and the act of applying it.
- PayloadThe part of an attack that does the attacker's actual work once delivered, such as installing malware, as opposed to the mechanism that got it there.
- PCAPPacket capture: a file containing raw network traffic as it crossed the wire, which tools like Wireshark can replay and decode.
- PersistenceAnything the attacker leaves behind so their access survives a reboot or a logout.
- PhishingGetting a person to hand over a credential or run something, by sending them a message that looks legitimate.
- Phishing kitA ready-made package of fake login pages and scripts that lets criminals launch a phishing site quickly, often sold as a service.
- Pig butcheringA long-running investment scam where criminals build a relationship with a victim over weeks, then lure them into a fake crypto trading platform.
- PIRPriority Intelligence Requirement: a question the intelligence team is expected to answer because it supports a specific decision.
- PivotingUsing one piece of data to find related data, for example from a domain to its IP, then to other domains on that IP.
- PrefetchWindows files that speed up program launches and, as a side effect, record which programs ran, how often and when.
- Privilege escalationGaining higher permissions than an attacker started with, for example going from a normal user account to administrator or root.
- Proof of conceptWorking code that demonstrates a vulnerability is real, usually without doing the damage a real attack would.
- ProvenanceThe record of where a piece of evidence came from and when you collected it. What makes a claim defensible six months later.
- Proxy logA record of the web requests users made through a proxy server, and often the only place outbound traffic is visible.
- Pyramid of PainDavid Bianco's ranking of indicator types by what each one costs the adversary to replace, from a trivial hash change to relearning how they operate.
R
- RansomwareMalware that encrypts data for extortion. Increasingly the encryption stage is dropped and the threat is publication instead.
- Ransomware-as-a-ServiceA business model where ransomware developers rent their malware and leak site to affiliates who carry out attacks, splitting the ransom.
- Recovery addressThe address or number a platform uses to restore access to an account. Invisible in normal use and a permanent link between identities.
- Red teamA team that plays the attacker against its own organisation to test defences, while the blue team defends and learns.
- RegistrarThe company through which a domain name is registered. Registration records and dates are collection material.
- Remote access trojanMalware that gives an attacker remote control of an infected computer: running commands, moving files, watching the screen and capturing keystrokes.
- Reverse DNSLooking up the hostname registered for an IP address, the opposite of normal DNS, which can reveal the provider or purpose of a server.
- RootkitMalware that hides itself and other malicious activity by tampering with the operating system, so normal tools cannot see the infection.
S
- SandboxA controlled environment that runs a suspect file and reports what it did. A public one is publication: other people can retrieve what you upload.
- Scheduled taskA job the operating system runs on a timer or at logon. A common and quiet way to establish persistence.
- Service accountA login used by software rather than a person, which is why it is rarely watched and often over-privileged.
- Session hijackingTaking over a logged-in session by stealing its session cookie or token, which lets the attacker skip the password and multi-factor login.
- ShodanA search engine for internet-connected devices and services, showing open ports, banners, software versions and certificates by IP.
- SIEMSecurity Information and Event Management: the system that collects logs from everywhere and raises alerts on them.
- SIGINTSignals Intelligence: information taken from signals. For a private organisation this narrows to traffic it owns or lawfully operates.
- Sigma ruleA vendor-neutral format for writing log-based detection rules once and converting them to different SIEM query languages.
- SinkholePointing a formerly malicious domain at a controlled server, which turns the infected machines still calling home into a list.
- SmishingPhishing by text message: an SMS or chat message with a link or number, often posing as a delivery company, bank or toll service.
- SnapshotA saved state of a virtual machine you can return to in seconds. The property that makes a research machine safe to dirty.
- SOCSecurity Operations Centre: the team that watches alerts around the clock and responds to them.
- Social engineeringManipulating people into giving up information, access or money by exploiting trust, urgency, fear or helpfulness rather than technical flaws.
- Sock puppetA fake online persona an investigator uses for research, so that viewing or joining sites cannot be traced back to them or their employer.
- Source reliabilityHow trustworthy a source has proven over time, judged separately from whether a particular piece of information is credible.
- Spear phishingPhishing aimed at a specific person or small group, written using research about them so it is far more convincing than mass phishing.
- SPFSender Policy Framework: a DNS record listing which servers may send email for a domain, so receivers can spot forged senders.
- SpoofingFaking an identity such as an email sender, caller ID, IP address or website so a message or connection appears to come from someone trusted.
- Static analysisExamining a file without running it, by reading its structure, strings, imports and code, to learn what it is and what it might do.
- Stealer logThe bundle of passwords, cookies and machine details taken off one infected computer and sold or traded in batches.
- STIXStructured Threat Information Expression: a standard JSON format for describing threat intelligence such as indicators, malware and actors.
- Strategic intelligenceHigh-level intelligence on threats, trends and risks for leaders, as opposed to operational (campaign) or tactical (indicator) intelligence.
- Supply chain attackCompromising a trusted supplier, software update or library so the attack reaches all of that supplier's customers through a channel they already trust.
- SuricataAn open-source network intrusion detection and prevention engine that inspects traffic against signature rules.
T
- TAXIITrusted Automated Exchange of Intelligence Information: a protocol for sharing STIX threat intelligence between systems over HTTPS.
- TelemetryThe logs and signals an organisation collects from its own systems, which is the only source that answers whether something reached you.
- Threat actorThe person or group behind an intrusion, tracked as one entity even when their tools change.
- Threat actor profileA structured summary of a threat actor: aliases, motivation, targets, TTPs, tools, infrastructure habits and history.
- Threat feedA subscription stream of indicators and reports about current attacker activity.
- Threat huntingProactively searching your own data for signs of attackers that existing alerts have missed, usually starting from a hypothesis.
- Threat intelligence platformSoftware that collects threat data from many sources, removes duplicates, scores it and pushes it to security tools.
- Threat landscapeThe narrowed set of adversaries and techniques that actually apply to one organisation, rather than everything happening globally.
- Timeline analysisPutting events from many evidence sources into a single time-ordered sequence to reconstruct what happened during an incident.
- TorA free network that hides a user's location by routing traffic through three volunteer relays, and that hosts .onion sites.
- Tor exit relayThe last hop of the Tor network, where anonymised traffic re-enters the normal internet and appears to come from.
- Traffic Light ProtocolA simple label set (TLP:RED, AMBER, GREEN, CLEAR) that tells recipients how widely they may share a piece of information.
- TriageThe fast first pass that decides which of many items deserve real attention, before any of them get analysed properly.
- TTPTactics, Techniques and Procedures: how an attacker operates, as opposed to the specific artefacts they leave behind.
- TyposquattingRegistering domains that look like a real brand's, through typos, swapped letters or extra words, to fool people into trusting them.
V
- VictimologyStudying who an attacker targets (sectors, regions, sizes, roles) to understand their intent and predict who they will hit next.
- Virtual machineA full operating system running as software on your existing computer, isolated from it and disposable.
- VirusTotalA Google-owned service that scans files, URLs, domains and IPs with dozens of security engines and shows the results and relationships.
- VishingPhishing by phone call, where an attacker poses as IT support, a bank or a colleague to talk the victim into giving access or money.
- VPNVirtual private network: an encrypted tunnel between a device and a VPN server, used for remote work access or to hide the user's IP address.
- VulnerabilityA weakness in software, hardware or configuration that an attacker could use to do something they should not be able to do.
- Vulnerability managerThe person or team accountable for tracking known weaknesses and getting them fixed.
W
- Wayback MachineThe Internet Archive's service that stores historical snapshots of websites, used to see how a page looked before it changed or vanished.
- Web shellA malicious server-side file that lets an attacker send commands through a web server.
- WHOISThe lookup service that returns a domain's registration record: registrar, creation and expiry dates, name servers and any public contact details.
- Windows RegistryWindows' central configuration database, which also records traces of user and program activity that forensic analysts rely on.
- WiperMalware that destroys data or makes systems unbootable, with no way to recover, often disguised as ransomware.
- WiresharkA free tool for capturing and inspecting network packets in detail, used to analyse traffic protocol by protocol.
Y
Z
Learn these terms by using them
Free learning paths and hands-on missions where every one of these terms comes up in a real investigation.