Glossary

Kerberoasting

An Active Directory attack where an attacker requests service tickets for accounts and cracks them offline to recover the service accounts' passwords, exploiting weak passwords on service accounts to gain access.

Kerberoasting Detection

Detecting kerberoasting by watching for its telltale signs in Active Directory, such as unusual volumes of service-ticket requests or requests using weak encryption, so the stealthy credential attack can be caught.

Kerberos

A network authentication protocol that uses tickets issued by a trusted authority to let users and services prove their identity without sending passwords over the network. It is central to Active Directory authentication.

Kerberos Ticket Forgery Detection

Detecting forged Kerberos tickets, such as golden and silver tickets, that attackers create after compromising key material to impersonate users or services, by spotting anomalies the forgeries reveal.

Kernel

The core part of an operating system that controls hardware, memory, processes, and system calls.

Kernel Exploit

Exploitation of a kernel vulnerability to violate privilege, isolation, memory, or integrity boundaries, with outcome dependent on the flaw and active mitigations.

Kernel Exploits

Attacks that exploit vulnerabilities in the operating-system kernel to gain the highest level of privilege, since kernel code runs with full control, a successful kernel exploit can completely compromise a system.

Key

In cryptography, the secret (or paired secret/public) value that controls an algorithm's operation, determining how data is encrypted, decrypted, signed, or verified. The security of cryptography rests on protecting keys, not on hiding the algorithm.

Key Compromise

Loss of justified confidence that a cryptographic key remains secret, authentic, controlled, or unmodified, triggering scoped revocation, replacement, investigation, and recovery.

Key Distribution Problem

The fundamental challenge of securely sharing a secret key between parties who want to communicate, since the key itself must somehow be exchanged without an eavesdropper obtaining it. It is what asymmetric cryptography helps solve.

Key Exchange

A protocol that lets parties establish shared keying material, with security depending on authentication, parameter validation, freshness, algorithm choice, and endpoint protection.

Key Management Services

Cloud services that securely generate, store, rotate, and control access to cryptographic keys, so applications can use encryption without handling raw keys themselves, centralizing key protection and governance.

Key Pair

In asymmetric cryptography, the linked pair of a public key (shared openly) and a private key (kept secret), where what one key does the other reverses, enabling encryption, digital signatures, and secure key exchange.

Key Risk Indicators

Metrics that signal changes in an organization's risk exposure, giving early warning when risk is rising so leadership can act before a risk materializes. They complement key performance indicators in risk management.

Key Rotation

Replacing keys on a planned schedule or after a risk event.

Knowledge Capture

Recording what analysts learn, investigation steps, findings, decisions, and tradecraft, so knowledge is preserved and shared across the team rather than lost, strengthening consistency and onboarding in the SOC.

Knowledge Factor

An authentication factor based on something you know, such as a password, PIN, or answer to a security question, used to verify identity. It is one of the three classic factor categories alongside possession and inherence.

Knowledge Operationalization

Turning what threat hunts and analysis reveal into operational defenses, detections, enrichment, playbooks, and process changes, so hard-won knowledge actively improves the SOC rather than staying as findings on a page.

Kubernetes Control Plane Boundary

A Kubernetes control plane boundary records responsibility and access for the API server, state store, controllers, nodes, network plugin, admission, audit, keys, upgrades, backups, and recovery.

Kubernetes Detection

Detecting threats and malicious activity in Kubernetes environments, by monitoring audit logs, runtime behavior, and configuration for signs of attacks like privilege escalation, container escapes, or abuse of the cluster API.

Kubernetes Network Isolation

Kubernetes network isolation defines allowed pod ingress and egress and verifies that the installed network implementation enforces the required policy semantics and destinations.

Kubernetes Privilege Path Review

A Kubernetes privilege path review evaluates combinations of RBAC, workload creation, service accounts, secrets, certificate approval, node proxying, storage, admission, impersonation, and cloud identity that can increase effective access.

Kubernetes RBAC

Kubernetes' role-based access control system, which governs what users and service accounts can do in a cluster. Properly scoped RBAC is essential, since over-permissive roles are a leading Kubernetes security risk.

Kubernetes Secret Exposure Path

A Kubernetes secret exposure path traces sensitive material through creation, storage, encryption, API rights, admission, mounting, node access, logs, backups, external synchronization, rotation, and revocation.

Kubernetes Security

The overall practice of securing Kubernetes clusters and the workloads they run, spanning the cluster control plane, RBAC, network policy, workload configuration, secrets, and runtime, since Kubernetes' power and complexity create broad attack surface.

Kubernetes Security Domains

The distinct areas that make up Kubernetes security, such as cluster/control-plane, workloads and pods, network, identity and RBAC, secrets, and supply chain, used to organize a comprehensive approach to securing clusters.

Kubernetes-Specific Attacks

Attack techniques unique to or characteristic of Kubernetes environments, such as container escapes, abusing the API server or service accounts, RBAC privilege escalation, and pivoting through the cluster, that defenders must anticipate.

Kusto Query Language

KQL, the query language used to search and analyze data in Microsoft's security and log platforms (such as Sentinel and Defender), letting analysts write detections and investigate by filtering, correlating, and aggregating telemetry.

LAPS

Local Administrator Password Solution refers to Microsoft's approach for giving managed Windows devices unique, automatically rotated local administrator passwords backed up to an authorized directory.

LDAP

Lightweight Directory Access Protocol: the protocol used to query and modify directory services like Active Directory, central to authentication and identity lookups, and a frequent target for reconnaissance and attack.

LD_PRELOAD

A Linux environment variable that forces a program to load a specified shared library first, which attackers abuse to inject malicious code into processes or hook functions, a stealthy technique defenders should recognize.