Glossary

Kerberos Ticket Forgery Detection

Detecting forged Kerberos tickets, such as golden and silver tickets, that attackers create after compromising key material to impersonate users or services, by spotting anomalies the forgeries reveal.

Kernel

The core part of an operating system that controls hardware, memory, processes, and system calls.

Kernel Exploits

Attacks that exploit vulnerabilities in the operating-system kernel to gain the highest level of privilege, since kernel code runs with full control, a successful kernel exploit can completely compromise a system.

Key

In cryptography, the secret (or paired secret/public) value that controls an algorithm's operation, determining how data is encrypted, decrypted, signed, or verified. The security of cryptography rests on protecting keys, not on hiding the algorithm.

Key Distribution Problem

The fundamental challenge of securely sharing a secret key between parties who want to communicate, since the key itself must somehow be exchanged without an eavesdropper obtaining it. It is what asymmetric cryptography helps solve.

Key Management

Creating, storing, rotating, using, and retiring cryptographic keys safely.

Key Management Services

Cloud services that securely generate, store, rotate, and control access to cryptographic keys, so applications can use encryption without handling raw keys themselves, centralizing key protection and governance.

Key Pair

In asymmetric cryptography, the linked pair of a public key (shared openly) and a private key (kept secret), where what one key does the other reverses, enabling encryption, digital signatures, and secure key exchange.

Key Risk Indicators

Metrics that signal changes in an organization's risk exposure, giving early warning when risk is rising so leadership can act before a risk materializes. They complement key performance indicators in risk management.

Knowledge Capture

Recording what analysts learn, investigation steps, findings, decisions, and tradecraft, so knowledge is preserved and shared across the team rather than lost, strengthening consistency and onboarding in the SOC.

Knowledge Factor

An authentication factor based on something you know, such as a password, PIN, or answer to a security question, used to verify identity. It is one of the three classic factor categories alongside possession and inherence.

Knowledge Operationalization

Turning what threat hunts and analysis reveal into operational defenses, detections, enrichment, playbooks, and process changes, so hard-won knowledge actively improves the SOC rather than staying as findings on a page.

Kubernetes Detection

Detecting threats and malicious activity in Kubernetes environments, by monitoring audit logs, runtime behavior, and configuration for signs of attacks like privilege escalation, container escapes, or abuse of the cluster API.

Kubernetes RBAC

Kubernetes' role-based access control system, which governs what users and service accounts can do in a cluster. Properly scoped RBAC is essential, since over-permissive roles are a leading Kubernetes security risk.

Kubernetes Security

The overall practice of securing Kubernetes clusters and the workloads they run, spanning the cluster control plane, RBAC, network policy, workload configuration, secrets, and runtime, since Kubernetes' power and complexity create broad attack surface.

Kubernetes Security Domains

The distinct areas that make up Kubernetes security, such as cluster/control-plane, workloads and pods, network, identity and RBAC, secrets, and supply chain, used to organize a comprehensive approach to securing clusters.

Kubernetes-Specific Attacks

Attack techniques unique to or characteristic of Kubernetes environments, such as container escapes, abusing the API server or service accounts, RBAC privilege escalation, and pivoting through the cluster, that defenders must anticipate.

Kusto Query Language

KQL, the query language used to search and analyze data in Microsoft's security and log platforms (such as Sentinel and Defender), letting analysts write detections and investigate by filtering, correlating, and aggregating telemetry.

LDAP

Lightweight Directory Access Protocol: the protocol used to query and modify directory services like Active Directory, central to authentication and identity lookups, and a frequent target for reconnaissance and attack.

LD_PRELOAD

A Linux environment variable that forces a program to load a specified shared library first, which attackers abuse to inject malicious code into processes or hook functions, a stealthy technique defenders should recognize.

LOLBin Detection

Detecting the malicious use of legitimate built-in binaries (living-off-the-land binaries) by spotting abnormal usage patterns, since the tools themselves are trusted and present by default, only their misuse is malicious.

LOLBin Hunting Methodology

A structured approach to hunting for living-off-the-land binary abuse, systematically examining how trusted binaries are used across the environment to find malicious misuse hiding among legitimate activity.

LOLBins

Living-off-the-land binaries: legitimate, pre-installed system tools that attackers abuse to carry out malicious actions while blending in, since using trusted built-in binaries evades many defenses.

LSASS

The Windows process (Local Security Authority Subsystem Service) that handles authentication and holds credentials in memory, making it a prime target for attackers who dump its memory to steal credentials.

LSASS Memory Dumping Detection

Detecting attempts to dump the memory of the Windows LSASS process, a strong sign of credential theft, by monitoring for suspicious processes accessing LSASS or known dumping techniques.

Lateral Movement

Movement from one system or account to others inside an environment.

Lateral Movement Hunts

Threat hunts focused on finding attacker movement between systems inside a network, searching for signs of remote access, credential reuse, and pivoting that indicate an intruder spreading from an initial foothold.

Leadership Modeling

When leaders visibly practice the security behaviors they expect of others, setting the tone that security matters. It is one of the strongest influences on an organization's security culture.

Leading and Lagging Indicators

Two kinds of security-culture metrics: leading indicators predict future outcomes (like training engagement or reporting rates), while lagging indicators measure past results (like incidents that occurred), used together to gauge and steer culture.

Learning Sharing

Spreading the lessons from incidents and operations across the team and organization, so insights from one responder's experience or one incident improve everyone's practice rather than staying siloed.

Least Privilege

The principle of giving users and systems only the access they need to do their job.