Terms

attackers searching for wireless networks with vulnerabilities while moving around an area in a moving vehicle

an interactive technique that immerses potential cyber incident responders in a simulated cyber scenario

Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications. (Citation: Cisco Synful Knock Evolution)

A shortcoming or imperfection in software code, design, architecture, or deployment that, under proper conditions, could become a vulnerability or contribute to the introduction of vulnerabilities.

a term borrowed from military doctrine that refers to the process of analyzing target vulnerabilities and matching them with specific cyber capabilities (weapons) to achieve a desired effect or objective

an attacker creates malware or malicious payloads to use against the target by designing new forms of malware. Modifying existing programs to better match the vulnerabilities they're trying to exploit

to develop an exploit against a vulnerability into an attack tool that can be deployed against a target

Adversaries may communicate using application layer protocols associated with web protocols traffic to avoid detection/network filtering by blending in with existing traffic. Commands to remote mobile devices, and often the results of those commands, will be embedded within the protocol traffic between the mobile client and server.

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media, acting as a mechanism for C2, may give a significant amount of cover. This is due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.

a form of testing that is performed with knowledge of a target system's internals

A group responsible for refereeing an engagement between a Red Team of mock attackers and a Blue Team of actual defenders of information systems.

Adversaries may search for information about Wi Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi Fi information as part of Discovery or Credential Access activity to support both ongoing and future campaigns.

a novel cybersecurity attack technique that weaponizes legitimate, public facing Windows Domain Controllers (DCs) to form a powerful, stealthy distributed denial of service (DDoS) botnet

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems.(Citation: WMI 1 3) WMI is an administration feature that provides a uniform environment to access Windows system components.

Adversaries may perform wireless compromise as a method of gaining communications and unauthorized access to a wireless network. Access to a wireless network may be gained through the compromise of a wireless device. (Citation: Alexander Bolshev, Gleb Cherbov July 2014) (Citation: Alexander Bolshev March 2014) Adversaries may also utilize radios and other wireless communication devices on the same frequency as the wireless network. Wireless compromise can be done as an initial access vector from a remote distance.

Adversaries may seek to capture radio frequency (RF) communication used for remote control and reporting in distributed environments. RF communication frequencies vary between 3 kHz to 300 GHz, although are commonly between 300 MHz to 6 GHz. (Citation: Candell, R., Hany, M., Lee, K. B., Liu,Y., Quimby, J., Remley, K. April 2018) The wavelength and frequency of the signal affect how the signal propagates through open air, obstacles (e.g. walls and trees) and the type of radio required to capture them. These characteristics are often standardized in the protocol and hardware and may have an effect on how the signal is captured. Some examples of wireless protocols that may be found in cyber physical environments are: WirelessHART, Zigbee, WIA FA, and 700 MHz Public Safety Spectrum.

An estimate of the effort or time needed by a potential adversary, with specified expertise and resources, to overcome a protective measure.

A self replicating, self propagating, self contained program that uses networking mechanisms to spread itself.