Terminology Index

Glossary

2953 terms

LINDDUN Methodology

A privacy-focused threat-modeling methodology that helps identify privacy threats in a system, structured around categories like linkability, identifiability, and non-compliance, complementing security-focused models like STRIDE.

LOLBin Detection

Detecting the malicious use of legitimate built-in binaries (living-off-the-land binaries) by spotting abnormal usage patterns, since the tools themselves are trusted and present by default, only their misuse is malicious.

LOLBin Hunting Methodology

A structured approach to hunting for living-off-the-land binary abuse, systematically examining how trusted binaries are used across the environment to find malicious misuse hiding among legitimate activity.

LOLBins

Living-off-the-land binaries: legitimate, pre-installed system tools that attackers abuse to carry out malicious actions while blending in, since using trusted built-in binaries evades many defenses.

LSASS

The Windows process (Local Security Authority Subsystem Service) that handles authentication and holds credentials in memory, making it a prime target for attackers who dump its memory to steal credentials.

LSASS Memory Dumping Detection

Detecting attempts to dump the memory of the Windows LSASS process, a strong sign of credential theft, by monitoring for suspicious processes accessing LSASS or known dumping techniques.

Because dumping LSASS memory is a primary way attackers steal Windows credentials, detecting it is high-value. Detection watches for processes opening LSASS with suspicious access rights, known dumping tools and techniques, or creation of memory-dump files of LSASS, mapped to the relevant ATT&CK technique. Built on endpoint process and handle telemetry, it catches credential theft in progress, and tuning matters because some legitimate tools also access LSASS.

Introduced in: Writing Detections with ATT&CK

Examples

Alerting when a process opens LSASS with memory-read access.
Detecting a known LSASS-dumping tool or technique.
Flagging creation of an LSASS memory-dump file.

LSASSrelates_to Credential Dumpingrelates_to MITRE ATT&CKrelates_to Detection Specificityrelates_to PowerShell Detectionrelates_to LSASSrelates_to Endpoint Telemetryprerequisite_of Mimikatzrelates_to

Lateral Movement

Movement from one system or account to others inside an environment.

Lateral Movement Correlation

Lateral movement correlation links source activity, destination authentication, remote-channel use, process or service creation, and follow-on behavior to identify movement between systems.

Lateral Movement Hunts

Threat hunts focused on finding attacker movement between systems inside a network, searching for signs of remote access, credential reuse, and pivoting that indicate an intruder spreading from an initial foothold.

Lateral Movement Indicators

Lateral movement indicators are identity and access signals suggesting an actor is using one foothold to reach additional systems or accounts.

Law Enforcement Coordination

Law enforcement coordination manages authorized contact, evidence sharing, requests, and operational deconfliction with the appropriate agency and jurisdiction.

Law Enforcement Decision Authority

Law enforcement decision authority identifies who may engage an agency and under what legal, safety, insurance, evidence, business, and jurisdictional considerations.

Layered Defense

Use of complementary preventive, detective, responsive, and recovery measures across separate failure modes so one control's failure does not determine the outcome.

Leadership Modeling

When leaders visibly practice the security behaviors they expect of others, setting the tone that security matters. It is one of the strongest influences on an organization's security culture.

Leading and Lagging Indicators

Two kinds of security-culture metrics: leading indicators predict future outcomes (like training engagement or reporting rates), while lagging indicators measure past results (like incidents that occurred), used together to gauge and steer culture.

Learning Sharing

Spreading the lessons from incidents and operations across the team and organization, so insights from one responder's experience or one incident improve everyone's practice rather than staying siloed.

Least Privilege

The principle of giving users and systems only the access they need to do their job.

Least-Privilege Role Activation

Least-privilege role activation grants the narrowest administrative role and scope for a limited period after the required approval, justification, and authentication controls are satisfied.

Leaver Process

A leaver process revokes access, sessions, authenticators, and ownership when an employment, contract, partnership, or workload relationship ends.

Legacy Resource Integration

Legacy resource integration adds gateways, proxies, jump hosts, virtual desktops, local controls, or segmented enclaves when a system cannot consume modern identity or policy.

Legal Communication

Communicating with and through legal counsel during an incident, ensuring legally sensitive matters, disclosure, evidence, liability, are handled with legal guidance and sometimes under privilege, so the response is legally sound.

Legal and HR Coordination

Working with legal and human-resources teams when writing policies, so policies are enforceable, compliant with law and employment rules, and aligned with how the organization handles people-related matters.

Legal and Privacy Handoff

A legal and privacy handoff provides authorized specialists with jurisdictions, contracts, data categories, systems, access and acquisition evidence, timeline, safeguards, containment, recipients, and uncertainty.

Legal and Regulatory Handoff

A legal and regulatory handoff provides authorized privacy or legal personnel with a time-bounded summary, evidence index, confidence states, potentially involved systems and data, mitigations, limitations, and preservation status.

Lessons Learned

A review after an incident that identifies improvements to people, process, and technology.

Lessons from Practice

Insights drawn from real-world security operations experience, what actually works, common pitfalls, and hard-won judgment, that complement theory by grounding blue-team skills in how things play out in practice.

Lessons-Learned Ownership

Lessons-learned ownership converts incident findings into prioritized actions with an accountable owner, rationale, acceptance criteria, resources, dependencies, target, status, and risk escalation.

Let's Encrypt

A free, automated certificate authority that issues TLS certificates at no cost, making HTTPS easy and ubiquitous. Its automation (via the ACME protocol) lets sites obtain and renew certificates without manual effort.

Lightweight Threat Modeling

A streamlined, practical approach to threat modeling that fits into fast development, using quick, focused techniques to identify key threats without the overhead of heavyweight formal methods, so modeling actually gets done.

Likelihood

How probable it is that a threat will affect a system or asset.

Likelihood Estimation

Judging how probable it is that a risk will occur, a core part of risk assessment that, paired with impact, determines a risk's level so it can be prioritized and treated appropriately.

Likelihood Uncertainty

Likelihood uncertainty records the evidence, assumptions, time horizon, estimate meaning, range, visibility, and limitations behind a likelihood judgment.