Terminology Index

Glossary

13 terms starting with "U"

Showing 1-13 of 13 terms

UAC Bypass

Techniques that subvert Windows User Account Control to elevate privilege without prompting the user, exploiting auto-elevation paths, misconfigurations, or trust assumptions in elevated processes.

UDP

UDP is a transport protocol that sends messages without setting up a reliable connection first.

UID

User Identifier: a numeric ID Unix systems use internally to identify users. UID 0 is root, and tracking UIDs is foundational to understanding Unix permissions and audit logs.

URL

Uniform Resource Locator: the structured address identifying a resource on the web. Reading URLs precisely (scheme, host, path, query) is foundational to web defense and threat investigation.

USB Control

Restricting how USB devices can be used on endpoints, blocking unknown storage, limiting device classes, requiring approval, to defend against data exfiltration and malicious device threats.

Unencrypted Storage

Cloud storage left without encryption (or with default keys only), a common cloud-foundational issue that exposes data to anyone who gains access to the storage layer or its backups.

Unit Testing

Writing automated tests for individual detection rules to verify they fire on expected inputs and don't fire on safe ones, the smallest-grain check in a detection-as-code testing strategy.

Unmanaged Device Policy

Zero-trust policy that limits or denies access from devices the organization doesn't manage, BYO, contractor, personal, since unmanaged devices can't be trusted to enforce security baselines.

Unquoted Service Path

A Windows misconfiguration where a service's executable path isn't enclosed in quotes, letting an attacker who can write to certain directories hijack the service for privilege escalation.

User Account Control

A Windows feature that prompts users before allowing actions requiring administrative privilege, separating most user activity from elevated activity to reduce silent misuse of admin rights.

User Communication

How analysts communicate with affected users during investigations or incidents, clear, calm, appropriately scoped, that builds trust and gets accurate information without spreading panic.

Analysts often need to talk to users: confirming a suspicious activity, asking about an action, notifying that an account is locked. User communication done well, plain language, appropriate scope, neither alarmist nor dismissive, gets honest information and preserves trust in the security function. As a foundational SOC-analyst topic, user communication is one of the soft skills that turns competent investigation into effective outcomes, especially when users are part of either the cause or the solution.

Introduced in: SOC Analyst Fundamentals

Examples

Asking a user about a suspicious sign-in calmly and clearly.
Notifying a user of an account lock without sounding alarmist.
Getting honest information from users by treating them as partners.

soc intermediate user-communication

No related terms linked yet.

User Context

The set of attributes tied to a logged-in user (account, group memberships, tokens, privileges) that processes operate under on a Windows or Linux system. Defenders read user context constantly.

User Space

The portion of memory and execution where non-kernel programs run, contrasted with kernel space. Most software, including malware, lives in user space, with privilege boundaries enforced at the kernel boundary.