detection hardening acsc-glossary
Antivirus
Software that looks for known-bad and obvious malice, then tries to stop and clean it. Necessary. Not sufficient.
Knowledge
AllIRacsc-glossaryau-compliancecloudconceptscryptodetectiondnsframeworkshardeningidentityloggingmalwarenetworkpractitionerprivacythreat-intelvulnerability
34 entries
network detection
BGP
Border Gateway Protocol. How networks exchange routes. A hijack shows up as an unexpected origin ASN or RPKI invalid.
detection IR network
Beaconing
Regular callbacks from a host that should be quieter. Interval plus jitter, not a perfect metronome.
detection IR network
Command and control
C2. How the operator talks to a compromised host after they are in. DNS, HTTPS, and traffic that looks like SaaS are common.
network dns detection
DNS spoofing
A fake DNS answer wins. Cache poisoning is the recursive version. Logging and resolver choice matter.
dns detection network
DNS tunnelling
Data moved through DNS queries and answers. Detection is odd volume, long labels, and unusual types.
detection hardening
Data loss prevention
DLP. Stop or log sensitive data leaving through the paths you actually instrumented. Policy plus telemetry, not a magic classifier.
dns detection IR
Domain generation algorithm
Malware derives many domains so blockers lag. Hunt high NXDOMAIN and labels that look generated, not a brand.
detection IR
EDR
Endpoint detection and response. Behaviour plus the ability to isolate. An agent without an owner is inventory.
detection IR network
Exfiltration
Data leaving. Bulk, slow, or stuffed into a protocol nobody is watching. DLP is a control; logs are how you know.
network dns detection
Fast flux
A hostname whose A or NS answers keep rotating. A resilience trick used by some botnets. Short TTL plus churn.
detection acsc-glossary
Honeypot
A decoy built to attract hostile attention so you can study it. Not a substitute for patching production.
IR detection
IR playbook
A written path for a class of incident. Roles, decisions, and evidence. Not a novel, and not a blank page at 2 a.m.
detection IR threat-intel
Indicator of compromise
An artefact that suggests a compromise: a hash, a name, an address, an email. Useful. Not a strategy.
detection network acsc-glossary
Intrusion detection system (IDS)
Watches for unwanted activity and tells someone. Host or network. Alert without an owner is a screensaver.
detection network acsc-glossary
Intrusion prevention system (IPS)
IDS with a fist. Identifies unwanted traffic and can block it in the moment. Mis-tune it and you become the outage.
detection IR identity
Lateral movement
After the first box, they walk. Credentials, remote admin, and trust you already granted.
detection IR
Living off the land
Use the admin tools already on the box. PowerShell, WMI, bash, cloud CLIs. No new malware required.
logging detection IR acsc-glossary
Logging
Time-stamped records of what happened. Collect what can answer a question. If it never gets queried, it is storage spend.
identity detection
MFA fatigue
Bombard the user's phone with push prompts until they tap Allow. MFA still on. Judgement off.
detection frameworks
MITRE ATT&CK
A knowledge base of adversary tactics and techniques. Use it to find detection gaps, not to decorate a slide.
network detection
NetFlow
Who talked to whom, when, how much. Metadata, not payload. Cheap enough to keep.
detection network IR
Network detection and response
NDR. Watch the wire or the flow for threat behaviour, not just known signatures. Complements EDR. Does not replace it.
network detection IR
Packet capture
The packets, on disk. Ground truth for a window of time. Heavy, precise, and easy to collect too late.
dns detection threat-intel
Passive DNS
Historical DNS answers observed by sensors. Pivot on an IOC. Not a replacement for a live lookup.
detection IR
Persistence
Still there after reboot, password change, or the first cleanup. Scheduled tasks, tokens, and legitimate-looking remote access.
detection logging
SIEM
Security information and event management: collect, normalise, correlate, alert. Useless if nobody owns the queue.
detection IR
SOAR
Orchestration and response. Automate the boring. Keep a person on steps that isolate a host or disable an account.
hardening detection acsc-glossary
Sandbox
A paddock for untrusted code. If it explodes, the paddock takes it. Production is not a paddock.
detection IR
Security operations centre
People, detections, and a queue. A room full of screens is optional. Ownership of after-hours is not.
detection IR threat-intel
Tactics, techniques, and procedures
How they work, not just which IP they used today. ATT&CK is the common catalogue.
detection IR threat-intel
Threat hunting
Assume they are already in. Ask a question of your logs. Not a dashboard tour.
detection concepts
Threat intelligence
Context that changes a decision. IoCs expire. TTPs last. A feed you never action is a newsletter.
network hardening detection
Web application firewall
WAF. A reverse proxy that tries to stop common web attacks before the app. Rules, not a rewrite of the application.
Definitions informed by ASD's ACSC glossary. cyber.gov.au glossary