Terminology Index

Glossary

1801 terms

Showing 1153-1184 of 1801 terms

Pass-the-Hash

An attack that authenticates using a stolen password hash directly, without cracking it to the plaintext password, letting an attacker move laterally using captured credential hashes on Windows networks.

Pass-the-Hash Detection

Detecting pass-the-hash attacks by spotting the abnormal authentication patterns they create, such as logons using hashes in ways or from places that legitimate authentication would not, mapped to ATT&CK techniques.

Because pass-the-hash uses stolen hashes to authenticate, detection focuses on the anomalies it produces: logon types and patterns inconsistent with normal use, authentication from unexpected hosts, use of privileged accounts in unusual ways, and known tool signatures. Built on Windows authentication telemetry and mapped to the relevant ATT&CK technique, it helps catch lateral movement in progress. Tuning matters since some patterns overlap with legitimate administrative activity.

Introduced in: Writing Detections with ATT&CK

Examples

Flagging logon patterns inconsistent with normal authentication.
Detecting privileged-account use from an unexpected host.
Mapping the detection to the ATT&CK pass-the-hash technique.

soc intermediate pass-the-hash-detection

No related terms linked yet.

Pass-the-Ticket

An attack that reuses stolen Kerberos tickets to authenticate as a user without their password, letting an attacker access resources and move laterally in Active Directory using captured or forged tickets.

Passkey Adoption

The practice and challenges of rolling out passkeys to users in a consumer identity context, driving uptake of phishing-resistant passwordless credentials while supporting fallback and diverse devices.

Passkeys

Phishing-resistant, passwordless credentials based on FIDO/public-key cryptography that let users sign in with a device or biometric instead of a password, syncable across devices for a smooth, secure experience.

Password Hashing Function

A specialized, deliberately slow hash function (like bcrypt, scrypt, or Argon2) designed for storing passwords, so that even if the hash store is stolen, cracking the passwords is computationally expensive.

Password Reset

The flow that lets users regain access by setting a new password, a security-critical web feature, since weak reset flows are a common way attackers take over accounts by bypassing authentication.

Password Spraying

An attack that tries a few common passwords across many accounts to avoid lockouts.

Passwordless Authentication

Authentication that does not rely on a password at all, using factors like passkeys, biometrics, or hardware keys, removing the weakest link (passwords) and the attacks that target them.

Patch Management

The process of identifying, testing, deploying, and tracking fixes for software weaknesses.

Patch Testing

Verifying that patches work and don't break systems before deploying them broadly, balancing the security need to patch quickly against the operational risk that a patch could cause outages or incompatibilities.

Patch Windows

Scheduled periods during which patches are deployed, planned to balance prompt patching with minimizing disruption to operations, so updates roll out predictably rather than ad hoc.

Patches

Updates that fix software flaws, including security vulnerabilities. Applying patches promptly is one of the most fundamental and effective security measures, since unpatched flaws are a leading attack vector.

Path

The part of a URL that identifies a specific resource on a server, the portion after the host. Defenders read it to understand what is being requested and to recognize attacks like path traversal or forced browsing.

Penetration Testing Authorization

The formal permission and scope agreement that must be in place before any penetration test, defining what may be tested, when, and how, so testing is legal, bounded, and authorized rather than an actual attack.

Pentest Reporting Excellence

Producing penetration-test reports that are clear, accurate, prioritized, and actionable, communicating findings, risk, and remediation so the client can actually fix issues, the deliverable that gives a test its value.

Perimeter Model Failure

The recognition that the traditional 'trust the inside, defend the perimeter' security model no longer works, since cloud, mobile, and remote work erase a clear boundary and once inside, attackers move freely. It is the motivation for zero trust.

Permission Boundaries

A cloud IAM feature that sets the maximum permissions an identity can have, capping effective access even if broader permissions are granted, used to safely delegate administration without risking over-permissioning.

Permissions

The specific rights granted to an identity to perform actions on resources, read a file, modify a record, call an API. Managing permissions to the minimum needed is the essence of access control.

Permissive Security Groups

A cloud misconfiguration where security groups (instance-level firewalls) allow overly broad access, such as opening ports to the entire internet, creating exposure that attackers readily find and exploit.

Persistence

Techniques used to keep access after restarts, password changes, or defensive actions.

Persistence Audit

Systematically examining a system for persistence mechanisms, the ways attackers maintain access across reboots, to find unauthorized or suspicious ones during hardening or investigation on a host.

Persistence Hunts

Threat hunts that proactively search for attacker persistence mechanisms across the environment, looking for the autostart entries, tasks, and other footholds adversaries use to survive reboots and maintain access.

Persistence Mechanisms

The techniques attackers use to keep access to a system across reboots and logoffs, such as scheduled tasks, services, registry run keys, and startup entries. Defenders must know them to detect, hunt, and remove persistence.

Persistence Removal

Eliminating attacker persistence during incident response, finding and removing every mechanism the attacker installed to maintain access, so eradication is complete and the attacker cannot simply return.

Personal Data

Information relating to an identified or identifiable individual, the core category that privacy laws like GDPR protect. Knowing what counts as personal data is foundational to privacy and data-protection obligations.

Phased Recovery

Restoring systems and operations in planned stages during incident recovery rather than all at once, so the most critical functions return first, restoration can be verified clean, and risk of reinfection is controlled.

Phishing

A social engineering attack that tricks people into revealing information or taking unsafe actions.

Phishing Detection

Detecting phishing attempts through signals in email and user behavior, suspicious senders, links, content, and reported messages, often mapped to ATT&CK, so phishing is caught before or after a user interacts.

Phishing Simulation

Sending controlled, fake phishing emails to staff to measure susceptibility and reinforce training, a security-awareness tool used carefully to build resilience without blaming or demoralizing employees.

Phishing-Resistant MFA

Forms of multi-factor authentication that cannot be defeated by phishing or relay attacks, notably FIDO2/WebAuthn and passkeys, because the credential is cryptographically bound to the legitimate site.

Physical Controls

Security measures that protect physical assets and access, locks, badges, cameras, guards, secure facilities, recognized as one of the foundational control categories alongside technical and administrative controls.