CompTIA CySA+ (CS0-003) flashcards

A tactic covering techniques adversaries use to gain higher-level permissions on a system or network, such as abusing services that run with elevated privileges.

• Includes techniques like Service Manipulation, Access Token Manipulation, Exploitation for Privilege Escalation
• Often follows Initial Access/Execution
• Enables attackers to bypass restrictions imposed by lower-privileged accounts

Memory trick: Sc.exe service hijack = climbing the SYSTEM ladder.

Examining running processes on a Linux system for anomalous behavior, resource usage, or suspicious origins.

• Look for unusual parent-child relationships.
• Check process paths, especially /tmp or user home directories.
• Monitor resource consumption for spikes.

Memory trick: Check Processes (paths!), Logs (errors!), and Network (odd ports!).

A qualitative or quantitative assessment of the potential harm to an organization's operations, assets, or reputation if a specific risk or vulnerability is exploited.

• Focuses on organizational consequences, not technical details.
• Often uses categories like 'High', 'Medium', 'Low' for clarity.
• Essential for communicating risk to non-technical stakeholders.

Memory trick: Executives care about 'Dollars and Disruption', not 'Code and Counts'.

A malware evasion technique where malicious code is injected into the memory space of a legitimate running process to hide activity and evade detection.

• Common target: svchost.exe, explorer.exe
• Hides malicious network/behavior under a trusted process name
• Detected via sandbox dynamic analysis or EDR memory scanning

Memory trick: Injection = a parasite hiding inside a trusted host body.

A CVSS v3.1 Temporal metric indicating how mature and permanent the available fix for a vulnerability is, ranging from no fix to an official vendor patch.

• Values: Official Fix(O), Temporary Fix(T), Workaround(W), Unavailable(U), Not Defined(X)
• Official Fix (O) lowers temporal score the most
• Unavailable (U) keeps the score closest to the base score

Memory trick: Official patch is the gold standard cure; Unavailable means still sick

A static analysis technique measuring randomness in a file's byte distribution; entropy near 8.0 (max) suggests compression or encryption, often used to hide malicious code from static detection.

• Entropy scale: 0 (no randomness) to 8 (maximum randomness)
• Packed/encrypted malware typically shows entropy above ~7.0
• Missing strings/imports alongside high entropy strengthens the packed-malware hypothesis

Memory trick: Near-maximum entropy means the file is wearing a disguise.

Communicating vulnerability risks to executive leadership, focusing on business impact, financial implications, and strategic risks.

• Translate technical risks into business terms.
• Emphasize potential financial loss, reputational damage, and regulatory non-compliance.
• Provide actionable recommendations at a high level.

Memory trick: Executives care about MONEY and NEWS headlines, not code.

Software or hardware products that have reached the end of their support lifecycle from the vendor, meaning they no longer receive updates, security patches, or technical support.

• No longer receive security patches, leading to unpatched vulnerabilities.
• Increased risk of exploitation by known vulnerabilities.
• Often difficult to integrate with modern security solutions.

Memory trick: EOL means 'Exploitable, Old, and Lacking support'!

The phase of incident response focused on limiting the scope and impact of a security incident to prevent further damage or spread.

• Occurs after detection and analysis, before eradication.
• Aims to isolate affected systems or networks.
• Can involve temporary or long-term measures.

Memory trick: Did Clint Eat Rotten Apples Regularly?

Evidence demonstrating that organizations record and examine information system activity, especially related to Protected Health Information (PHI) access.

• Required by HIPAA Security Rule.
• Involves logging access attempts, modifications, and security events.
• Crucial for detecting and investigating security incidents involving PHI.

Memory trick: HIPAA needs logs that show who TRIED to see patient data and got STOPPED.

A section within a 'lessons learned' or incident report that identifies and explains the specific elements, conditions, or decisions that positively or negatively influenced the incident's outcome.

• Goes beyond 'what happened' to 'why it happened'.
• Includes both successes and failures.
• Forms the basis for actionable recommendations.

Memory trick: A good 'lessons learned' report 'Summarizes', 'Times', 'Analyzes', and 'Recommends'.

A security model that eliminates implicit trust and requires continuous verification of identity and context for every access request, regardless of network location.

• Core tenet: 'never trust, always verify'
• Relies on micro-segmentation and least privilege
• Uses continuous authentication, not one-time perimeter login

Memory trick: Zero Trust = 'trust no one, check everyone, every time.'

A Windows system service and device driver that monitors and logs system activity to the Windows event log, providing detailed information about process creations, network connections, and file modifications.

• Part of Sysinternals suite from Microsoft.
• Provides deeper endpoint visibility than standard Windows Event Logs.
• Configurable via XML files to specify events to monitor.

Memory trick: Sysmon monitors system actions on endpoints.

Patch management is the process of identifying, acquiring, testing, and applying software updates (patches) to systems to fix bugs, improve performance, and, crucially, address security vulnerabilities.

• Crucial for reducing the attack surface by remediating known flaws.
• Involves regular scanning, prioritization, testing, and deployment of patches.
• Failure can lead to exploitation of unpatched vulnerabilities.

Memory trick: Discover, Assess, Prioritize, Remediate, Verify (DAPRV) – the cycle never ends.

Reports designed for technical teams (e.g., IT operations, development) that provide actionable details necessary to fix identified security vulnerabilities.

• Focuses on technical specifics: affected assets, CVEs, configuration details.
• Includes clear, prioritized remediation steps.
• Provides evidence of the vulnerability for verification.

Memory trick: IT Ops needs 'What, Where, and How to Fix it, with Proof'.

An attack where a malicious host sends forged ARP replies to associate its own MAC address with the IP address of another host (often the gateway), enabling man-in-the-middle interception.

• Detected by conflicting ARP entries for one IP
• Mitigated with Dynamic ARP Inspection (DAI) and static ARP entries
• Enables traffic interception, session hijacking, or DoS

Memory trick: Two MACs claiming one IP = an imposter wearing the gateway's mask.

Living-off-the-land binaries are legitimate OS tools (e.g., certutil, powershell, mshta) that attackers repurpose to perform malicious actions while evading detection.

• certutil -urlcache -split -f downloads files
• LOLBins are 'trusted' so they evade allowlisting
• Context (parent process, destination, network target) reveals malicious intent

Memory trick: Attackers borrow your own tools to break in unnoticed.

CSPM solutions continuously monitor cloud environments to identify and remediate misconfigurations, compliance violations, and security risks across various cloud services.

• Automates the detection of misconfigurations in IaaS, PaaS, and SaaS services.
• Ensures adherence to security best practices and regulatory compliance frameworks.
• Provides visibility into the security posture of cloud infrastructure.

Memory trick: CSPM: Cloud Security, Posture Management – always check your cloud's stance.

Network log patterns showing attempts to connect to or interact with ports associated with Server Message Block (SMB) and NetBIOS services.

• Target ports: 135 (RPC), 137 (NetBIOS NS), 138 (NetBIOS DS), 139 (NetBIOS SS), 445 (SMB).
• Often used for enumeration, credential dumping, or lateral movement.
• Common in Windows environments.

Memory trick: Ports tell the story: 22 is SSH, 80/443 Web, and 139/445 are SMB.

A behavior-based signal representing the sequence of actions and intent an adversary exhibits during an attack, enabling detection of malicious activity in progress rather than only after compromise has occurred.

• Focuses on process chains and behavior, not static artifacts
• Can detect novel/unknown malware based on behavior alone
• Contrasts with IOC, which is a static artifact tied to a known threat

Memory trick: 'IOC is the footprint left after the burglar leaves; IOA is watching him pick the lock.'

A secure coding practice that converts special characters in untrusted data into a safe representation (e.g., HTML entities) for the specific output context before rendering, preventing injected code from being interpreted as executable markup or script.

• Primary defense against Cross-Site Scripting (XSS)
• Must be context-aware: HTML, JavaScript, URL, and attribute contexts each need different encoding
• Complements, but does not replace, input validation

Memory trick: Encode the output so a <script> tag just becomes harmless text on the page.

A standardized 0–7 scale (RFC 5424) used to classify the urgency of log messages, from Emergency (0) to Debug (7).

• 0=Emergency, 1=Alert, 2=Critical, 3=Error
• 4=Warning, 5=Notice, 6=Informational, 7=Debug
• Lower numbers = higher severity/urgency

Memory trick: 'Every Awesome Cop Eats Warm Nachos In Diners' (Emergency,Alert,Critical,Error,Warning,Notice,Info,Debug)

Specific patterns or anomalies in network traffic, logs, or system behavior that suggest unauthorized transfer of data out of an organization's network.

• Large outbound data transfers.
• Connections to unknown or suspicious external IP addresses.
• Use of unusual protocols or ports for data transfer.
• Activity outside normal business hours.

Memory trick: Exfiltration logs: look for OUTBOUND, UNKNOWN, and BIG data.

Regular, periodic outbound communication from a compromised host to an external command-and-control server, often with consistent timing and payload size.

• Fixed time intervals regardless of user activity
• Often uses HTTPS/DNS to blend with normal traffic
• Detected via traffic analysis for periodicity/jitter patterns

Memory trick: Like a heartbeat, malware beacons keep steady rhythm.

A covert channel technique that encodes data inside ICMP echo request/reply payloads to exfiltrate data or maintain C2, bypassing filters that allow ICMP through.

• Legitimate pings use small, fixed payloads infrequently
• Tunneling shows large, variable, or repeated payloads
• Firewalls often permit ICMP, making it attractive for evasion

Memory trick: A 'ping' stuffed fat with data is smuggling secrets.

A compensating control is an alternative security measure used to meet a security requirement when the primary control cannot be fully implemented or is deemed impractical.

• It does not directly fix the underlying vulnerability but reduces its associated risk.
• Often used for legacy systems, unpatchable software, or specific environmental constraints.
• Examples include WAFs for unpatched web apps, network segmentation for vulnerable devices, or enhanced monitoring.

Memory trick: PDC-A: Prevent, Detect, Correct, Compensate – all types of controls.

A secure coding technique that separates SQL code from user-supplied data, preventing SQL injection by treating input strictly as literal values.

• Prevents classic injection like ' OR '1'='1
• Also mitigate second-order injection risks
• Should be combined with input validation and least-privilege DB accounts

Memory trick: Parameters put the input in a locked box, not the query itself.

A network segment placed between the internet and the internal LAN that hosts public-facing services while limiting direct access to internal resources.

• Reduces attack surface exposure to internal network
• Typically bounded by firewalls on both sides
• Common DMZ hosts: web, mail, DNS servers

Memory trick: DMZ = the buffer zone between enemy (internet) and home (LAN).

NetFlow records showing a highly asymmetric outbound-to-inbound byte ratio from a single host to an unfamiliar external destination often indicate data exfiltration.

• NetFlow records src/dst IP, ports, bytes, packets, duration
• High outbound:inbound ratio to unknown IP = red flag
• Volume + destination rarity both matter for triage

Memory trick: 'Out way more than in, to somewhere unfamiliar' = data leaving the building.

Incident response containment strategies that focus on isolating or blocking specific malicious activities or sources, rather than taking down entire systems or services, to minimize business disruption.

• Aims to stop the spread/impact of an incident with minimal collateral damage.
• Often involves blocking IP addresses, disabling specific accounts, or isolating segments.
• Requires accurate identification of the threat source and scope.

Memory trick: Isolate, Segment, Block, Remove

A data-driven scoring system that estimates the probability (0-1) that a vulnerability will be exploited in the wild within the next 30 days, used to complement CVSS in risk-based prioritization.

• Produces a probability score, unlike CVSS's severity score
• Updated regularly using real-world threat intelligence and exploit data
• High EPSS + moderate CVSS can outrank low EPSS + high CVSS for remediation priority

Memory trick: CVSS says how bad, EPSS says how likely — likely wins the race this week.

Exfiltration is the tactic used by adversaries to steal data from an organization's network. This can involve various techniques to package, transfer, and remove data.

• Adversaries steal data by copying, packaging, and sending it out of the network.
• Common techniques include data compression, encryption, and tunneling protocols (e.g., DNS, ICMP, HTTP).
• Detection often involves monitoring network traffic for unusual data volumes, destinations, or protocols.

Memory trick: EX-FILM: The data 'exits' the 'film' (network) frame by frame.

A command-line network utility that displays network connections (both incoming and outgoing), routing tables, and a number of network interface statistics.

• Useful for diagnosing network issues.
• Can show listening ports and established connections.
• The `-a` switch shows all connections, `-n` shows numerical addresses, `-o` shows the process ID.

Memory trick: To see network conversations and who's talking, you need a 'net-stat'istic.

The process of identifying, reporting, and remediating security vulnerabilities in a controlled and responsible manner, often involving coordination with vendors.

• Prioritize immediate internal escalation for critical findings.
• Follow established procedures for vendor communication.
• Aim for coordinated remediation and public disclosure (if applicable).

Memory trick: Critical flaw? Alert IR & CISO first, then follow the disclosure path.

The Cyber Kill Chain phase where compromised systems establish a channel back to attacker infrastructure for ongoing control.

• Often identified by periodic 'beaconing' traffic
• Same destination IP/domain at regular intervals is a red flag
• Occurs after successful exploitation and installation

Memory trick: Reconnaissance, Weaponize, Deliver, Exploit, Install, Control, Act.

A legally mandated process under the General Data Protection Regulation (GDPR) for organizations to report personal data breaches to supervisory authorities and, in some cases, to affected data subjects.

• Must be reported to the supervisory authority within 72 hours of becoming aware.
• Must include nature of the breach, categories of data, approximate number of data subjects, likely consequences, and measures taken/proposed.
• Crucially, includes contact details of the DPO or other contact point.

Memory trick: GDPR breach reports need 'Who, What, How Bad, and Who to Ask'.

A TLS extension included in the plaintext ClientHello that specifies the hostname the client wants to connect to, enabling servers hosting multiple domains on one IP to serve the correct certificate.

• Visible in Wireshark even without decrypting the session
• Useful for identifying C2 domains behind CDNs
• Encrypted Client Hello (ECH) is an emerging mitigation that hides SNI

Memory trick: 'SNI is the shipping label still readable on a sealed box.'

A technique for identifying a remote host's operating system by analyzing characteristics of naturally occurring traffic (TTL, TCP window size, options) without sending any probe packets.

• Common initial TTLs: 64 (Linux/Unix), 128 (Windows), 255 (Cisco/network devices)
• No packets sent to target, reducing detection risk
• Contrasts with active fingerprinting (e.g., nmap -O) which crafts probe packets

Memory trick: 'Passive listens quietly; active knocks on the door.'

The process of creating an exact, bit-for-bit copy of a digital storage device, preserving all data including deleted files, metadata, and unallocated space, for forensic analysis.

• Ensures data integrity and admissibility in court.
• Prevents alteration of original evidence.
• Tools like dd are commonly used for disk imaging.

Memory trick: Acquisition is like taking a perfect snapshot of the digital scene.

Network microsegmentation is a security technique that divides a network into small, isolated segments, allowing for granular control over traffic flow between individual workloads or applications.

• Limits lateral movement by attackers within a network.
• Enforces a 'least privilege' network access model.
• Often implemented using software-defined networking (SDN) or host-based firewalls.

Memory trick: Microsegmentation: Tiny segments, tiny paths – no easy lateral movement.

The forensic approach for collecting evidence from a system that is found in a powered-off state.

• Volatile data is already lost.
• Priority is preserving persistent storage (disk).
• Avoid powering on to prevent alteration.

Memory trick: Live is RAM, Dead is Disk: Don't 'Wake the Dead' if you want disk integrity.

A CVSS v3.1 Temporal metric describing the likelihood a vulnerability will be exploited, based on the availability and reliability of exploit code.

• Values: Not Defined, Unproven(U), Proof-of-Concept(P), Functional(F), High(H)
• High = autonomous, widely available exploit tool code
• Temporal metrics adjust score as exploit landscape changes over time

Memory trick: Exploit maturity grows: Unproven baby steps → PoC crawl → Functional walk → High sprint

Documentation and logs that demonstrate an organization's adherence to the Payment Card Industry Data Security Standard requirements, particularly for vulnerability management.

• Requires regular vulnerability scanning (external and internal).
• Mandates timely remediation of identified vulnerabilities.
• Evidence includes scan reports, remediation tickets, and policy documents.

Memory trick: PCI needs proof of scans, not just daily logs.

The third phase of the Lockheed Martin Cyber Kill Chain, in which the attacker transmits the weaponized payload to the target via a vector such as email, USB, or a compromised website.

• Follows Weaponization (payload creation) and precedes Exploitation (payload execution)
• Common delivery vectors: phishing email, watering-hole sites, removable media
• Blocking delivery (e.g., email filtering) breaks the chain before exploitation can occur

Memory trick: Recon-Weapon-Deliver-Exploit-Install-C2-Act: the mailman drops the bomb at Delivery.

Forensic investigation in Industrial Control Systems (ICS) and Operational Technology (OT) environments, prioritizing operational continuity and safety due to the potential for physical impact.

• Minimizing disruption is paramount.
• Passive data collection methods are preferred.
• Live analysis is often avoided or done cautiously.
• Specialized tools and expertise are required.

Memory trick: In sensitive zones, 'Observe Quietly, Don't Touch, Don't Stop'.

An attack where an authenticated user requests TGS tickets for service accounts with SPNs, then attempts to crack the ticket's encrypted portion offline to recover the service account password.

• Logged as Event ID 4769 (Kerberos Service Ticket Request)
• Attackers often force RC4 (etype 0x17) since it's weaker/faster to crack
• Mitigated by using AES-only accounts and strong service account passwords

Memory trick: Kerberoasting = 'roasting' many service tickets over an RC4 fire to crack passwords later.

A tactic covering techniques adversaries use to move through a network from an initial foothold to additional systems, often using legitimate administrative tools and stolen credentials, such as PsExec, WMI, or RDP.

• T1021.002: Remote Services (SMB/Windows Admin Shares) commonly implemented via PsExec
• Relies on valid or stolen credentials to blend in with normal admin activity
• Detected via monitoring unusual admin-share/service creation across hosts

Memory trick: PsExec is the attacker's stolen master key, unlocking one office door after another.

Techniques adversaries use to run malicious code on a local or remote system, such as PowerShell, scripting, or command-line interpreters.

• T1059 covers command and scripting interpreters
• Encoded/obfuscated PowerShell is a common evasion technique
• Execution often precedes persistence and lateral movement

Memory trick: Encoded PowerShell = the attacker's remote control button being pressed.

A tactic covering techniques adversaries use to avoid detection throughout an intrusion, such as clearing logs, disabling security tools, or masquerading files.

• Includes Indicator Removal on Host (clearing event logs)
• Includes Impair Defenses (disabling AV/EDR)
• One of the largest tactic categories in ATT&CK Enterprise

Memory trick: Wiping logs and killing AV = sweeping footprints, Defense Evasion.

The phase where the attacker leverages a vulnerability to execute code on a target system or gain unauthorized access.

• Occurs after Weaponization and Delivery.
• Involves triggering a vulnerability (e.g., SQL injection, buffer overflow).
• Aims to gain initial access or control.

Memory trick: Recon, Weapon, Deliver, Exploit, Install, Command, Objectives – Remember the sequence to catch the bad guys!

The process of adjusting SIEM rules (via thresholds, allow lists, or suppression) to reduce false positives while preserving true positive detection.

• Reduces analyst alert fatigue
• Should target the specific noisy condition, not disable detection broadly
• Common techniques: allow lists, threshold adjustment, correlation logic refinement

Memory trick: Tune out the noise, not the alarm.

A documented, unbroken record of the chronological sequence of possession, transfer, analysis, and disposition of physical or electronic evidence.

• Crucial for legal admissibility of evidence.
• Tracks who handled the evidence, when, and for what purpose.
• Ensures evidence integrity and prevents tampering claims.

Memory trick: Admissibility is about proving the evidence is 'Truly Untouched'.

Identifying attacks by comparing observed authentication failure rates against an established baseline; large deviations indicate credential attacks.

• Windows Event ID 4625 = failed logon
• Windows Event ID 4624 = successful logon
• Compare current rate to historical baseline to detect anomalies

Memory trick: 600 failures in 5 minutes = a battering ram, not a knock.

A port scan is an attack or reconnaissance technique used to identify open ports and services on a network host or range of hosts. Attackers use this to map out the network's attack surface.

• Involves sending connection requests to a range of ports or hosts.
• Used for reconnaissance to find vulnerabilities.
• Can be detected by firewalls or intrusion detection systems.

Memory trick: Scanning ports is like peering through many windows to find an open door.

An algorithm malware uses to generate a large number of pseudo-random domain names, one or a few of which the attacker has registered as active C2 infrastructure, making blocklisting difficult.

• High volume of NXDOMAIN responses is a key indicator
• Domains often have random-looking, unpronounceable strings
• Seeded by date/time so both malware and attacker can compute matching domains

Memory trick: 'DGA rolls dice on domains' - most rolls miss (NXDOMAIN), one hits the C2 jackpot.

Network traffic patterns and behaviors that suggest a system is part of a botnet and communicating with its command and control server.

• Unusual outbound connections to known C2 ports (e.g., 6667, 8080, custom ports).
• Connections to suspicious domains/IPs.
• Periodic, small data transfers.

Memory trick: Unusual ports are 'Malware's' secret channels, especially IRC for bots.

In Wireshark, repeated 'TCP Retransmission' flags for the same segment with increasing time intervals indicate the sender never received an ACK, typically due to packet loss, congestion, or an unresponsive destination.

• TCP uses exponential backoff between retransmission attempts
• Wireshark explicitly tags retransmitted segments in the packet list
• Persistent retransmissions with no ACK suggest network path or host issues, not necessarily an attack

Memory trick: Retransmission with growing gaps = knocking louder and waiting longer each time no one answers the door.

A vulnerability scanning model where lightweight software agents installed on each host perform local assessment and report findings back to a central console, independent of network location.

• Works well for remote, mobile, or intermittently connected devices
• Provides continuous local visibility without needing network reachability
• Consumes host resources but avoids network scan traffic and firewall issues

Memory trick: Agent goes wherever the laptop goes.

Quantitative measures used to assess an organization's adherence to internal policies, industry standards, and regulatory requirements.

• Demonstrate accountability to stakeholders.
• Help identify gaps in security controls.
• Often required for audits and certifications.

Memory trick: CISO's report needs compliance, not just incidents.

Communicating vulnerability details to development teams, emphasizing technical specifics and the direct impact on their application's functionality, data, and compliance.

• Provide actionable technical details for remediation.
• Explain the exploitability and potential consequences.
• Highlight impact on data, user experience, and regulatory compliance.

Memory trick: Developers need to know how their CODE affects customers and COMPLIANCE.