Cybersecurity glossary

Explore Log360's comprehensive cybersecurity glossary—a collection of expert articles on attacks, threats,
and essential cybersecurity concepts to empower and protect your organization.

Sorry! No results found :(
Access token manipulation
Access tokens are used by Windows applications to access APIs....
Learn more...
Account manipulation
Account manipulation is a technique used by attackers to gain...
Learn more...
Attack surface expansion
Organizations with a digital presence have been contending with this...
Learn more...
Brute force attack
A brute force attack is a type of cyberattack in...
Learn more...
Credential dumping
Credential dumping refers to the act of obtaining user credentials...
Learn more...
Cross-site scripting (XSS)
XSS (cross-site scripting), is a prominent security vulnerability in web...
Learn more...
C2 attack
Command and control (C2 or C&C) is an attack tactic...
Learn more...
Data exfiltration
Data exfiltration is the unauthorized access and retrieval of sensitive...
Learn more...
DCShadow attack
This AD-targeting attack technique aims to allow attackers with privileged...
Learn more...
Digital supply chain attacks
A supply chain consists of all the stakeholders involved in...
Learn more...
DNS IoCs
Indicators of compromise (IoCs) are pieces of forensic evidence that...
Learn more...
Domain policy modification
When it comes to domain modification, adversaries may change the...
Learn more...
External IP IoCs
When attackers intrude and attempt to infect your network, malicious...
Learn more...
Initial access
Initial access is a set of techniques that exploit different...
Learn more...
Insider threats
Insider threats are security risks that originate from users having...
Learn more...
IoC threat hunting
Indicators of compromise (IoCs) are clues or digital footprints that...
Learn more...
Golden ticket attack
A Golden Ticket attack is a powerful domain persistence attack...
Learn more...
Kerberoasting
Kerberos authentication protocol uses tickets for verifying the identities and...
Learn more...
Keylogging
A keystroke is any action through which we interact with...
Learn more...
Lateral movement
Lateral movement in cybersecurity is a technique where attackers, after...
Learn more...
Log4j attack
Log4j is a widely used logging framework developed as part...
Learn more...
Malware attacks
Malware is a portmanteau of malicious and software. It refers...
Learn more...
MD5 hash IoCs
When your system falls a victim to a malware attack,...
Learn more...
Mimikatz
Mimikatz takes advantage of the weaknesses present in a Windows...
Learn more...
MITRE ATT&CK framework
The MITRE ATT&CK® framework is a globally recognized, comprehensive matrix...
Learn more...
Network security key
A network security key is a type of digital password...
Learn more...
Network sniffing
Network sniffing is a technique employed by adversaries to observe...
Learn more...
Next-gen SIEM
Next-gen SIEM represents the evolution of traditional SIEM. By incorporating...
Learn more...
Pass-the-hash attack
Pass-the-hash is an attack technique attackers use to obtain the...
Learn more...
Pass-the-ticket attack
A pass-the-ticket attack is a type of cyberattack that involves...
Learn more...
Privilege escalation attack
Privilege escalation is the act of evading established access and...
Learn more...
Privilege escalation with WinPEAS
WinPEAS, also known as Windows privilege escalation awesome scripts, is...
Learn more...
Process injection
Process injection involves inputting malicious code to a web application...
Learn more...
Red, blue, and purple teams in cybersecurity
Cybersecurity is a field where defenders and attackers continuously evolve...
Learn more...
Sharphound detection
Developed by SpecterOps, BloodHound enables security professionals to uncover potential...
Learn more...
SharpUp hacktool detection
SharpUp is a C# port of various PowerUp functionalities. It...
Learn more...
SID history injection
Windows security identifier (SID) is a unique value that identifies...
Learn more...
Social engineering
Social engineering is a form of cyberattack with techniques that...
Learn more...
Supply chain attack
Supply chain attacks are a sophisticated, increasingly common form of...
Learn more...
Secure server
Securing servers is a fundamental aspect of maintaining a robust...
Learn more...
TDIR
Threat detection, investigation, and response (TDIR) is the process of...
Learn more...
Threat hunting using command line logging
Command-line process logging entails recording the details of commands executed...
Learn more...

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Access token manipulation

Access tokens are used by Windows applications to access APIs. An access token contains information like who initiated a process, the app that generated the token and its expiry time.

Learn more

Account manipulation

Account manipulation is a technique used by attackers to gain access to critical resources. In this technique, the attacker gets hold of a user account which doesn't have enough privileges to access the required resource or data, and elevates its privileges.

Learn more

Attack surface expansion

Organizations with a digital presence have been contending with this challenge for a long time. Much like software developers continually update their code to stay ahead of vulnerabilities, cyberthreats undergo constant adaptations, expanding their digital frontier.

Learn more

Brute force attack

A brute force attack is a type of cyberattack in which an attacker systematically tries all possible combinations of passwords or encryption keys until the correct one is found. The primary goal of a brute force attack is to gain unauthorized access to a system, a network, or an account.

Learn more

Credential dumping

Credential dumping refers to the act of obtaining user credentials (username and password) from an operating system or software. These are normally obtained in the form of a hash or clear text, which is then used to perform lateral movement, gain access to restricted information, or to install malware.

Learn more

Cross-site scripting (XSS)

XSS (cross-site scripting), is a prominent security vulnerability in web applications, where an adversary adds a malicious code into legitimate web pages. The malicious code can be injected in several ways, for instance it can be added to the end of a URL or posted directly onto a page that displays user-generated content.

Learn more

C2 attack

Command and control (C2 or C&C) is an attack tactic where adversaries maintain control over compromised systems or networks. Attackers utilize these communication channels to install additional malware, form botnets, or exfiltrate sensitive information.

Learn more

Data exfiltration

Data exfiltration is the unauthorized access and retrieval of sensitive data with malicious intentions. This can also lead to stolen and leaked confidential information and ransom demands.

Learn more

DCShadow attack

This AD-targeting attack technique aims to allow attackers with privileged rights and credentials to create a rogue DC and mimic it by replicating malicious objects in AD environment.

Learn more

Digital supply chain attacks

A supply chain consists of all the stakeholders involved in the journey of a product from its inception to its delivery to customers. This is mostly linear and the players involved leave the picture once their role is complete.

Learn more

DNS IoCs

Indicators of compromise (IoCs) are pieces of forensic evidence that identifies malicious activity and helps detect the presence of potential threat actors in your network.

Learn more

Domain policy modification

When it comes to domain modification, adversaries may change the domain settings to escalate privileges in domain environments. Domains provide the ability for centralized management of how various resources interact.

Learn more

External IP IoCs

When attackers intrude and attempt to infect your network, malicious external IP addresses and URLs are the one of the most obvious indicators of compromise (IoCs) in your logs. Security and threat intelligence agencies such as AbuseIPDB and RobTex compile and maintain these IoCs for the enterprises to use.

Learn more

Initial access

Initial access is a set of techniques that exploit different entry vectors to gain the initial foothold in an organization's network. There are nine initial access techniques in total (some of which that have sub-techniques) and they include various social engineering methodologies and exploitation methods of public-facing web servers.

Learn more

Insider threats

Insider threats are security risks that originate from users having legitimate access to an organization's network and databases. These users can be current or former employees or third-party vendors or partners with legitimate user credentials.

Learn more

IoC threat hunting

Indicators of compromise (IoCs) are clues or digital footprints that are used by security incident response teams to spot a network intrusion or an ongoing data breach. Some examples of IoCs include unusual outbound traffic, unauthorized privilege escalation, and suspicious resource access attempts.

Learn more

Golden ticket attack

A Golden Ticket attack is a powerful domain persistence attack carried out by abusing vulnerabilities in the Kerberos authentication protocol to forge authentication tickets and gain unlimited access to all the Kerberos-enabled services in the domain, including the domain controller services, file servers, DNSs, print servers, and more.

Learn more

Kerberoasting

Kerberos authentication protocol uses tickets for verifying the identities and thereby enabling trusted communication in a network. It facilitates mutual authentication where the user and the server verifies each other's identity.

Learn more

Keylogging

A keystroke is any action through which we interact with a computer by pressing buttons or keys. Keystroke logging, commonly known as keylogging, refers to the process of recording the details of keystrokes made on a device in the form of logs.

Learn more

Lateral movement

Lateral movement in cybersecurity is a technique where attackers, after intruding into an organization's network, escalate privileges, exploit vulnerabilities, and more, to gain further access to assets and resources.

Learn more

Log4j attack

Log4j is a widely used logging framework developed as part of the Apache Logging Services, a project under the Apache Software Foundation. It is written in Java and enables software developers to log various levels of system or application behavior.

Learn more

Malware attacks

Malware is a portmanteau of malicious and software. It refers to a variety of harmful programs designed to infiltrate, damage, or disable computers and computer systems. It includes a variety of harmful programs—like viruses, worms, Trojan horses, spyware, ransomware, and adware—which perform unauthorized actions on affected systems.

Learn more

MD5 hash IoCs

When your system falls a victim to a malware attack, multiple malicious files can be installed on your system. These files masquerade their existence and execute undesirable procedures in your systems until they are discovered.

Learn more

Mimikatz

Mimikatz takes advantage of the weaknesses present in a Windows system and uses many techniques to extract sensitive information, like passwords from AD domain controllers, the LSASS process memory, the SAM database, and other credential storage areas.

Learn more

MITRE ATT&CK framework

The MITRE ATT&CK® framework is a globally recognized, comprehensive matrix used by cybersecurity professionals to categorize and understand adversary tactics, techniques, and procedures (TTPs). It helps organizations detect and mitigate cyberattacks by modeling real-world adversarial behaviors.

Learn more

Network security key

A network security key is a type of digital password that grants access to Wi-Fi networks and protects data transmission between connected devices. Often referred to as a Wi-Fi password, the network security key ensures only authorized users and devices can connect to a network

Learn more

Network sniffing

Network sniffing is a technique employed by adversaries to observe and capture data as it travels through a network to steal the target's data. Specific tools or software are used to intercept and analyze the data that is being transmitted, like emails, website visits, or login details.

Learn more

Next-gen SIEM

Next-gen SIEM represents the evolution of traditional SIEM. By incorporating advanced technologies like artificial intelligence, machine learning (ML), and behavioral analytics, next-gen SIEM platforms can dynamically analyze vast datasets in real time, enabling the identification of subtle, evolving threats that traditional systems might overlook.

Learn more

Pass-the-hash attack

Pass-the-hash is an attack technique attackers use to obtain the NTLM or LANMAN hash of a user's password instead of the plain text password so they can use it to dupe an authentication system. This strategy, highly prevalent on Windows systems, is one of the successful lateral movement techniques.

Learn more

Pass-the-ticket attack

A pass-the-ticket attack is a type of cyberattack that involves the theft and reuse of authentication credentials called tickets in a Windows Active Directory environment.

Learn more

Privilege escalation attack

Privilege escalation is the act of evading established access and authorization controls in an enterprise network to gain elevated privileges and access critical network assets.

Learn more

Privilege escalation with WinPEAS

WinPEAS, also known as Windows privilege escalation awesome scripts, is an open source tool created by CarlosPolop. It is used to search for all possible paths to escalate privileges on Windows hosts and uses a color-coded system that shows which areas require attention.

Learn more

Process injection

Process injection involves inputting malicious code to a web application with which the user interacts. The injected code runs in the target process and manipulates its behavior. It can give access to sensitive data or exploit the system's resources.

Learn more

Red, blue, and purple teams in cybersecurity

Cybersecurity is a field where defenders and attackers continuously evolve their tactics to outsmart each other. This dynamic is especially evident in the roles played by various specialized teams within cybersecurity, namely the red, blue, and purple teams.

Learn more

Sharphound detection

Developed by SpecterOps, BloodHound enables security professionals to uncover potential attack paths and identify high-risk users by using a graph database and calculating the shortest path between objects by using its links.

Learn more

SharpUp hacktool detection

SharpUp is a C# port of various PowerUp functionalities. It is essentially a tool created for security professionals, specifically those working in the area of cybersecurity and penetration testing.

Learn more

SID history injection

Windows security identifier (SID) is a unique value that identifies a user, computer account or group. When creating an account, the domain controller (DC) issues a unique SID to each account, which is stored in the database.

Learn more

Social engineering

Social engineering is a form of cyberattack with techniques that manipulate users into making security mistakes or giving away sensitive information.

Learn more

Supply chain attack

Supply chain attacks are a sophisticated, increasingly common form of cyberthreat that exploit the interconnected nature of modern business relationships, targeting less secure elements in the network, such as third-party vendors, software suppliers, or hardware manufacturers.

Learn more

Secure server

Securing servers is a fundamental aspect of maintaining a robust and reliable IT infrastructure. Understanding the various server types, their uses, potential threats, and best security practices helps safeguard sensitive information and ensure seamless operations.

Learn more

TDIR

Threat detection, investigation, and response (TDIR) is the process of identifying, understanding, and responding to security threats faced by organizations. This risk-based approach can be divided into three parts: Threat detection, investigation, and response.

Learn more

Threat hunting using command line logging

Command-line process logging entails recording the details of commands executed on a command-line user interface in the form of logs. This technique is mainly used for system administration and monitoring.

Learn more

Identity and access management

Unified service management

Unified endpoint management and security

IT operations management and observability

Security information and event management

Advanced IT analytics

Low-code app development

Cloud solutions for enterprise IT

IT management for MSPs

Active Directory management Manage, track, and secure Active Directory

Identity governance and administrationOrchestrate user identity management and access controls for Zero Trust

Privileged access managementControl and secure privileged access to critical enterprise systems

Enterprise and IT service managementDeliver a consistent employee experience across business functions

Customer service managementBuild a one-stop portal for customers with efficient account management

IT asset managementCentralize and automate the complete IT asset life cycle

SIEM Spot, investigate, and neutralize security threats

Log and compliance managementGain deeper visibility into security events and ensure compliance

Security auditingAudit Active Directory, cloud platforms and files to enhance your security posture

Endpoint management and protection platform (UEM and EPP)Secure and manage endpoints to protect your IT assets effectively

Endpoint managementAchieve intelligent IT device management with zero user intervention

Endpoint securityDefend against threat actors with proactive and reactive measures

Full-stack observability and digital experience monitoringAchieve end-to-end visibility, proactive issue resolution, and enhanced security

Network and server performance monitoringEnsure network, server, and storage reliability with AI-powered insights

IT incident managementEfficiently manage and resolve IT incidents while ensuring transparency

DNS and DHCP managementOptimize IP address and domain management

Cloud cost managementRight-size and take control of your cloud costs

IT analyticsConnect to your IT applications and visualize all facets of your IT

Cloud-native solutions for IT managementMonitor, manage, audit, and secure your multi-cloudand hybrid infrastructure

Business applications for ITBoost productivity and improve team collaboration

Custom solution builderBuild tailor-made apps to automate operations at your organization

Solutions for MSPsGrow your MSP business with scalable and secure IT management solutions

Cybersecurity glossary

Access token manipulation

Account manipulation

Attack surface expansion

Brute force attack

Credential dumping

Cross-site scripting (XSS)

C2 attack

Data exfiltration

DCShadow attack

Digital supply chain attacks

DNS IoCs

Domain policy modification

External IP IoCs

Initial access

Insider threats

IoC threat hunting

Golden ticket attack

Kerberoasting

Keylogging

Lateral movement

Log4j attack

Malware attacks

MD5 hash IoCs

Mimikatz

MITRE ATT&CK framework

Network security key

Network sniffing

Next-gen SIEM

Pass-the-hash attack

Pass-the-ticket attack

Privilege escalation attack

Privilege escalation with WinPEAS

Process injection

Red, blue, and purple teams in cybersecurity

Sharphound detection

SharpUp hacktool detection

SID history injection

Social engineering

Supply chain attack

Secure server

TDIR

Threat hunting using command line logging

Access token manipulation

Account manipulation

Attack surface expansion

Brute force attack

Credential dumping

Cross-site scripting (XSS)

Active Directory
management Manage, track, and secure Active Directory

Identity governance
and administrationOrchestrate user identity management and access controls for Zero Trust

Privileged access
managementControl and secure privileged access to critical enterprise systems

Enterprise and IT service
managementDeliver a consistent employee experience across business functions

Customer service
managementBuild a one-stop portal for customers with efficient account management

IT asset
managementCentralize and automate the complete IT asset life cycle

Network and server
performance monitoringEnsure network, server, and storage reliability with AI-powered insights

IT incident
managementEfficiently manage and resolve IT incidents while ensuring transparency

Cloud-native solutions for IT managementMonitor, manage, audit, and secure your multi-cloud
and hybrid infrastructure