Threats, Attacks & Defense Concepts

A precondition says where in an intrusion a flaw becomes usable, not how hard the attack is. Accounts are widely held and cheap to obtain, so "authenticated only" excludes almost no adversary.

Because the attack is an ordinary, well-formed request. If the server never checks who owns the record, any account holder simply asks for someone else's identifier and is served it. Nothing is malformed, so nothing needs exploiting.

A crash proves the flaw is reachable, not that anyone can control your system. Vulnerability, working exploit and packaged tooling are three separate states with three separate dates, and only the last two widen who can attack you.

Zero-day is a patch state, not a quality grade. It asserts only that no vendor fix existed at the moment the flaw was used. It says nothing about the bug's elegance, the attacker's skill, or whether the attack was unstoppable.

A CVE record says a named authority described one flaw and listed the product versions it believes affected, under a permanent identifier. It never asserts exploitability where you run it, real-world attack, vendor agreement, or that a fix exists.

Nothing authenticates the answers. A host takes its gateway and resolver from whichever lease answer arrives first, and locates that gateway from whoever replies for its address. Adjacency to the segment is the only prerequisite: no credential, no software flaw.

Nothing on its own. The source address is chosen by whoever builds the packet, and nothing along the path verifies it, because routers forward on the destination. It proves a value was written, not who wrote it.

The resolver only accepts a reply that matches its outstanding query: same server address and port, same ephemeral port it asked from, same 16-bit message ID, same question. And it must arrive before the genuine answer.

A dangling DNS record still resolves to a target that is no longer yours: a released storage bucket, app slot or cancelled vendor tenant. Whoever re-registers that target name is then served under your subdomain.

The amplification factor is the ratio of response bytes reaching the victim to request bytes the attacker spent. A 62-byte request drawing a 3,000-byte answer runs at roughly 48x, so a small uplink delivers a large flood.

Vertical movement acquires rights an identity lacks; horizontal movement takes over a peer identity holding different rights. Both describe the route, not the damage. A sideways step onto an identity that already owns production ends the intrusion.

The administrative share and WMI are built-in remote-administration channels. They authenticate with the credential and run if the account has admin rights on the target, so no vulnerability is needed — the credential itself is the key.

Active Directory is a shared authorisation database, and Authenticated Users can read most attributes by default: memberships, owners, permission entries, service principal names. Any valid account can map who controls whom without touching anything.

Stuffing replays real username-and-password pairs stolen from other sites and bets on reuse. Spraying knows no password at all: it tries one likely guess, such as Autumn2026!, against every account in a directory.

Enrolment is counted per user; enforcement is a property of each authentication path. A legacy mail protocol endpoint using basic authentication has no step in which a factor can be demanded, so the password alone succeeds there while the browser sign-in still challenges.

Because the path already exists. In a fully proxied estate an arbitrary address on an odd port has no route outward at all, while port 443 to a destination the organisation already permits needs no new opening and looks like ordinary browsing.

Fileless claims only that the code which ran was never a normal executable file launched from disk; it arrived as data and became code in memory. It does not claim that nothing was written to disk.

The operator's own process has no business reaching the internet, and its traffic carries no user identity. Running inside the user's browser borrows that person's session, proxy settings and usual destinations, so the outbound traffic looks like their ordinary browsing rather than a strange new program phoning out.

Because the binary already carries the vendor's trust and is already installed. Nothing attacker-authored arrives as an executable, no install rights are needed, and the run collides with the administration the estate performs every day.

No. A rootkit conceals activity at a level the adversary already controls. Loading a kernel driver or writing firmware needs administrative privilege first, so concealment is something an intrusion buys after it has won, never a route to winning.

A consent grant is an authorization the user gave to an application, not a credential the user holds. It is a separate record with its own refresh token, so rotating the password changes nothing the application depends on.

Only the strings the victim typed, usually an account name and a password. The genuine site never saw the attempt, so nothing confirms the password is correct, and it stops being worth anything the moment the victim changes it.

Payment diversion: the operator changes where a genuine, already-owed payment lands. No link, attachment or malware appears anywhere in the chain, so patching, attachment scanning and endpoint controls have nothing to act on.

Almost none. SPF, DKIM, DMARC and attachment detonation all live on the mail hop, and an SMS-plus-callback lure never crosses it. What survives is account-side: the identity controls, and whatever the service desk demands before it acts.

A watering hole works by poisoning a site only the target group reads, so the readership performs the selection. No message is sent, no recipient is ever chosen, and no mail path exists anywhere on the route.

Because ICS is a separate matrix, not a branch of Enterprise. It has its own tactic columns and its own technique list, so its identifiers live in their own space and never nest under an Enterprise number.

A tactic names the adversary's goal for an action, not the action. The same technique can serve several goals, so ATT&CK lists it under every tactic it achieves: T1078 Valid Accounts sits in four columns.

A T#### identifier names a technique, a class of adversary behaviour, and T####.### a sub-technique of it. The exact command line you saw is a procedure: one implementation of that class, and ATT&CK gives procedures no identifier at all.

No. ATT&CK's tactic columns are goal categories, not stages. An intrusion can re-enter one column repeatedly, never touch several of them, and hit them in any order. The Cyber Kill Chain is the model that asserts order; ATT&CK's columns do not.

That an intrusion succeeds only if it completes all seven stages in order, so removing any one stage defeats the whole attempt. It inverts the usual asymmetry: the intruder must win every link, not just one.

Non-executable memory only stops injected bytes from running. It does not stop hijacked control flow, so the attacker reuses code already mapped in the process - library functions and instruction fragments that are already executable and already legitimate jump targets.

A precondition is something the technique cannot run without. A protocol is normally one of several interchangeable routes to the same thing, so blocking it moves the operator to another route instead of ending the technique.

Two controls are two layers only if getting past them means satisfying two independent preconditions. If both are satisfied by the same fact, such as one approved job identity, whatever supplies that fact clears both at once.

Disabling writes a configuration value while the SMBv1 code stays installed, so one administrative write turns it back on. Uninstalling removes the component itself, so there is nothing to re-enable until someone installs software again.

It evaluates the identity of a file at the moment something tries to load and run it: where the file sits, who signed it, or its exact bytes. It says nothing about what an already-permitted program is later handed.