Malicious Activity Flashcards

Question

What are rootkits?

Answer 1

Class of malware that conceals its presence by modifying system files

Answer 2

Type of network-based attack where valid data transmissions are maliciously re-broadcast

Answer 3

Capturing a user's login credentials during a session and reusing them for unauthorized access

Answer 4

* Use session tokens * Implement multi-factor authentication * Use security protocols like WPA3

Answer 5

Enables web applications to uniquely identify a user across different actions

Answer 6

Text file used to store information about a user when they visit a website

Answer 7

Modifies the contents of a cookie after it has been generated

Answer 8

An attack where the attacker positions their workstation logically between two hosts

Answer 9

Manipulating Address Resolution Protocol (ARP) tables to redirect network traffic

Answer 10

An attack that tricks the encryption application into presenting an HTTP connection instead of HTTPS

Answer 11

An application attack that targets web-based applications by fabricating LDAP statements

Answer 12

Occurs when a threat actor is able to execute arbitrary commands on a system

Answer 13

Lightweight Directory Access Protocol ## Footnote LDAP is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol network.

Answer 14

An application attack that targets web-based applications by fabricating LDAP statements that are typically created by user input ## Footnote Protection against LDAP injection attacks includes input validation and input sanitization.

Answer 15

Occurs when a threat actor is able to execute arbitrary shell commands on a host via a vulnerable web application

Answer 16

Method of executing arbitrary code in the address space of a separate live process ## Footnote There are many different ways to inject code into a process, including DLLs, Thread Execution Hijacking, and Process Hollowing.

Answer 17

* Injection through DLLs * Thread Execution Hijacking * Process Hollowing * Process Doppel Ganging * Asynchronous Procedure Calls * Portable Executable Injections

Answer 18

* Endpoint security solutions configured to block common sequences of attack behavior * Security Kernel Modules * Practice of Least Privilege * Indicators of Compromise (IoC)

Answer 19

Pieces of forensic data that identify potentially malicious activity on a network or system ## Footnote IoCs serve as digital evidence that a security breach has occurred.

Answer 20

Occurs when an account is locked due to multiple failed login attempts ## Footnote It indicates a potential brute force attack to gain access.

Answer 21

Refers to multiple active sessions from a single user account ## Footnote It may indicate a possible account compromise.

Answer 22

Involves attempts to access or download content blocked by security protocols ## Footnote This suggests a user trying to access malicious content or an attacker attempting to steal data.

Answer 23

Detects logins from geographically distant locations within an unreasonably short timeframe ## Footnote It indicates a likely account compromise.

Answer 24

Unusual spikes in resource utilization ## Footnote This includes CPU, Memory, and Network bandwidth, and may indicate malware infections or DDoS attacks.

Answer 25

Inability to access resources like files, databases, or network services ## Footnote It suggests a ransomware attack, where files are encrypted, and a ransom is demanded.

Answer 26

Log entries occurring at unusual times ## Footnote It suggests an attacker trying to hide their activities during off-peak hours.

Answer 27

Sign that logs have been deleted to hide attacker activities ## Footnote This may result in gaps in the log data, making it harder to trace the attacker's actions.

Answer 28

Attackers publicly disclose their actions, boasting about their skills or causing reputational damage ## Footnote This can occur on social media, hacker forums, or the victim's own website.

Malicious Activity Flashcards

(52 cards)