Acronyms
TAO
Tactical Analyst Support
forcepoint
The company that created this network management tool was breached in early 2020 resulting in one of the largest supply chain attacks in history
SolarWinds
Cat 5e cables use this many wires and pins
8
White/orange
orange
white/green
blue
white/blue
green
white/brown
brown
Translate this binary number to decimal.
1100
12
PCAP
Packet Capture
Windows Event Logs
wineventlog / windows / security
Fancy Bear or APT28 or the Sofacy Group hails from this country
Russia
This metric measures how often a display is able to draw a new image.
Refresh Rate, measured in Hertz (Hz)
This network management protocol is used on IP networks for automatically assigning IP addresses and other communication parameters to devices connected to the network using a client–server architecture.
DHCP
Hyper Text Transfer Protocol
CFG F5 VPN Logs
This malicious computer worm was first uncovered in 2010 and caused substantial damage to the nuclear program of Iran. Although neither country has openly admitted responsibility, the worm is widely understood to be a cyberweapon built jointly by the United States and Israel in a collaborative effort
Stuxnet
This file can operate as virtual memory and be used as additional RAM when space there is limited.
Page File
In the CFG network, DHCP is handled by this proprietary tool.
Infoblox DHCP
AES
CFG DHCP logs
infoblox
This commercially available red team platform was created in 2012 by Raphael Mudge and uses an agent named "Beacon". Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement.
Cobalt Strike
This firmware performs the POST (Power On Self Test) and contains instructions for loading hardware. It runs prior to the operating system on personal computers
BIOS (basic input/output system)
This protocol is used by routers to map a dynamic IP address to a permanent physical machine address in a local area network
Address Resolution Protocol (ARP)
GRC
Governance, Risk Management, and Compliance
Cloudtrail Logs
aws
The domain iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com was hardcoded into this ransomware variant and its registration stopped the spread in its tracks
WannaCry
This unit of measurement is equal to one sextillion bytes (1,000,000,000,000,000,000,000) bytes, or, one is equal to a trillion gigabytes. After Gigabyte comes Terabyte, Petabyte, Exabyte, and then this multipe-byte unit.
Zettabyte
The technique of Onion routing now popularly used by the TOR project was developed by this group to protect U.S. intelligence communications online.
United States Naval Research Laboratory is the corporate research laboratory for the United States Navy and the United States Marine Corps. It conducts basic scientific research, applied research, technological development and prototyping.