Terminology Index

Glossary

2953 terms

String Deobfuscation

String deobfuscation recovers hidden text by identifying a transformation routine, inputs, key material, length, termination, and call context.

Strings and Entropy Triage

Strings and entropy triage uses encoded text, byte-distribution measurements, location, references, and file structure to prioritize parts of a suspicious artifact for analysis.

Structured Decomposition

Breaking a broad security question into smaller assets, actors, trust boundaries, actions, evidence needs, assumptions, consequences, and decision points.

Structured Logging

Producing logs as structured data, JSON or similar with named fields, rather than free-text, so events can be parsed, queried, and correlated reliably in SIEM and analytics.

Sub-Technique

In MITRE ATT&CK, a more specific form of a parent technique that describes a distinct way adversaries may achieve the associated tactical goal.

Sub-Techniques

Finer subdivisions of MITRE ATT&CK techniques, providing more specific descriptions of how a technique is realized in practice, so coverage and detections can be more precise.

Sub-techniques refine ATT&CK techniques into more specific variants, for example, 'Phishing' has sub-techniques like Spearphishing Attachment and Spearphishing Link. They give defenders sharper language for describing exactly what was observed and for mapping detections to precise behavior. As a threat-landscape foundational concept, sub-techniques are what make ATT&CK actually usable beyond high-level categories, supporting coverage mapping, hunting, and detection engineering at the right granularity.

Introduced in: Threat Landscape and Attacker Thinking

Examples

Distinguishing Spearphishing Attachment from Spearphishing Link sub-techniques.
Mapping a detection to a specific sub-technique rather than the parent.
Using sub-techniques to communicate exactly what was observed.

MITRE ATT&CK Frameworkrelates_to ATT&CK Coverage Mappingrelates_to Tactical Intelligencerelates_to Detection Coveragerelates_to Spearphishingrelates_to Tacticrelates_to Techniquerelates_to

Subdomain

A domain that sits below another in the DNS hierarchy, like mail.example.com under example.com. Defenders inventory subdomains, since forgotten or misconfigured ones become attack paths.

Subject and Workload Identity

Subject and workload identity distinguishes human users from services, applications, containers, functions, devices, and jobs that request resource access.

Subnet

A subnet is a smaller range of IP addresses carved out of a larger network.

Sudo

A Unix command that runs another command with elevated (typically root) privileges according to policy in /etc/sudoers. Sudo is a defining administrative tool whose configuration and use defenders audit closely.

Supplementary Transfer Measures

Supplementary transfer measures are technical, contractual, or organizational safeguards added when an Article 46 tool needs support to provide essentially equivalent protection.

Supply Chain Attack

An attack that compromises a target indirectly by going through a vendor, partner, or shared component the target relies on. SolarWinds and CCleaner are notorious examples.

Supply Chain Attacks

Cloud-native supply chain attacks: compromises of container images, IaC modules, Helm charts, or CI/CD systems that flow into customer cloud workloads through trusted package and build paths.

Supply Chain Risk

The risk an organization faces from its software, vendor, and component dependencies, that they may be compromised, vulnerable, or untrustworthy in ways the organization can't fully control directly.

Supply Chain Security

The cloud-native discipline of securing the path from source code to running workload, signed images, verified dependencies, hardened pipelines, provenance, so that what runs is what was intended.

Supply Chain Visibility

Knowing what's in your supply chain, which vendors, components, libraries, and services the organization depends on, so risk can be assessed and managed rather than left invisible.

Symmetric Encryption

Encryption that uses the same shared key to encrypt and decrypt data.

Synthetic Test Data

Artificially generated data used to test detections safely, simulating attacker behavior or specific event patterns without running real attacks against production systems.

Syslog

A long-standing standard for forwarding log messages from systems and devices over the network. Defenders rely on syslog daily as a primary way Linux and networking gear ship logs to central collection.

Sysmon

Microsoft Sysinternals' Sysmon: a Windows service that emits detailed process, network, and file events, vastly richer than default Windows logging. A go-to source for endpoint detection and hunting.

Sysmon Telemetry

Sysmon telemetry is configurable Windows endpoint activity recorded by Microsoft's Sysmon service, including process, network, image-load, file, registry, and process-access events.

System Call

A request from software to the operating system kernel for a low-level service.

System Calls

The interface user-space programs use to request services from the kernel, like reading files, opening network connections, or creating processes. Defenders inspect syscalls to characterize behavior.

System Hardening

The discipline of reducing a system's attack surface and weakening its exploitability through configuration, baselines, patching, and removing unnecessary capabilities. A foundational defensive practice.

System Owner Communication

Coordination with the accountable owner of a system to validate purpose and behavior, assess impact, authorize actions, and record decisions during security work.

Systemd

The init system and service manager used by most modern Linux distributions. Systemd controls how services start, run, and are logged, and is a key target for both administration and attacker persistence.

TCP

TCP is a transport protocol that creates reliable, ordered communication between systems.

TCP/IP Model

The layered conceptual model behind internet networking, network access, internet, transport, and application layers, that organizes how data moves end to end across networks.

TEF Estimation

In FAIR, estimating Threat Event Frequency, how often a threat event of interest could occur in a year, by combining contact frequency with probability of action.

TI Analyst Role

The threat-intelligence analyst role: producing and curating intelligence about adversaries and threats to support SOC, IR, and leadership decisions. A distinct path within security analysis.

TI Community

The community of practice around threat intelligence, ISACs, vendor analyst groups, public researchers, that practitioners participate in to share intelligence, sharpen craft, and build reputation.

TI Skills

The skills threat-intelligence analysts develop, source evaluation, structured analytic techniques, writing, attribution, language and OSINT, that are distinct from general SOC analyst skills.