Offensive operations
Definiciones en lenguaje claro del tema offensive operations.
Advance-fee fraud (419 scam)
Advance-fee fraud, also known as the 419 scam or the Nigerian letter, promises a large sum of money and then asks for a series of small payments to unlock it. It is pure social engineering with no technical component at all, which is why no antivirus will ever see it.
Adversary emulation
In offensive security, adversary emulation is a red team exercise that reproduces the specific techniques of a known threat actor, mapped to a framework such as MITRE ATT&CK, rather than testing for vulnerabilities in general. The goal is to measure whether detection and response hold against the way a real adversary operates.
Assumed breach
Assumed breach is a scoping decision in which an engagement starts from a position an attacker would have to earn: a standard user account, a workstation, or a foothold in a network segment. It is a way of spending the budget on what happens after entry rather than on proving that entry is possible.
Beacon
A beacon is the periodic check-in traffic sent from a compromised host to attacker infrastructure to collect commands. In red team operations the timing is the tradecraft: the interval, the random variation applied to it and the periods of silence are what decide whether the pattern is visible to a defender.
Blue team
In security operations, the blue team is the defending side: the people and tooling focused on detecting, responding to and recovering from attacks. The term only means something in relation to an attacking side, which is why it belongs to exercise vocabulary rather than to organisational charts.
Business email compromise (BEC)
In offensive security, business email compromise (BEC) is a fraud in which an attacker uses a genuine or spoofed business email account to redirect a payment or extract sensitive data, usually with no malware at all. It is the attack with the most direct financial impact, and the one a management committee understands without translation.
Bypass
In security, a bypass is a technique that gets around a control rather than breaking it: the control is still there and still working, and the attacker simply takes a route the control does not watch. It rarely comes from a flaw in the product. It comes from where the control sits and what it assumes.
Command and control (C2)
In offensive operations, command and control is the channel an attacker uses to operate inside a compromised network and issue instructions to their implants. It is the part of an intrusion that has to keep talking, which makes it the most reliable thing for a defender to look for and the thing an operator works hardest to hide.
Cyber kill chain
In offensive security, the cyber kill chain is a model that breaks an intrusion into ordered stages, from reconnaissance through to actions on the objective. Introduced by Lockheed Martin, it is a planning and defence aid, and it is routinely confused with MITRE ATT&CK, which is a different kind of model.
Dark web
The dark web is the part of the internet that is only reachable through an anonymising network such as Tor, where both the visitor and the server can stay unidentified. For a security team it matters as a marketplace: it is where stolen credentials, network access and data taken from organisations are traded and published.
Digital risk protection
In external security, digital risk protection is the monitoring of channels outside your perimeter for threats that use your name or your data: impersonation, lookalike domains, leaked credentials, exposed documents and stolen data offered for sale. Nothing it finds is on your network, which is exactly why nothing else finds it.
Fingerprinting
Fingerprinting is the technique of identifying devices, operating systems, applications and services on a network by reading what they reveal about themselves, from service banners to the small differences in how they answer.
Footprinting
An organisation’s footprint is the trail it leaves on the internet without meaning to publish it: domains, IP addresses, exposed services, documents carrying metadata and the profiles of its staff. Footprinting is the work of collecting it, and it is the first thing both an attacker and the people auditing them do.
Hacker
A hacker is someone who understands a system well enough to make it do something it was not meant to do. The word says nothing about legality: what separates the hacker you hire from the one you report is not the technique, which is the same, but written authorisation, an agreed scope and a report at the end.
Homograph attack
A homograph attack uses characters from different alphabets that look identical on screen, so that a fake domain, sender or filename passes for the real one. It is the delivery vehicle for a phishing campaign rather than a family of malware: what it fools is the eye, not the code.
Passive attack
A passive attack observes without touching: the attacker intercepts information in transit or collects it from where it is already exposed, changing nothing and provoking no response from the system. It is hard to detect precisely because it generates no activity, and it is rarely the whole attack. It is the phase that makes the next one cheap.
Penetration test
A penetration test is an authorised, time-boxed exercise in which testers use attacker techniques against an agreed scope in order to find weaknesses and prove they are exploitable. The proof is the point: it is what separates a penetration test from a scan, and what makes the resulting risk statement defensible.
Phishing
Phishing is an attack that persuades a person to hand over credentials, money or access, usually by message. What changed is the target: the phishing that succeeds against a modern organisation no longer wants the password, it wants the session, and it takes it by relaying the real login through a proxy the victim never sees.
Port and vulnerability scanning
Port scanning asks what is listening on a system; vulnerability scanning asks what is wrong with what answered. They are done one after the other, they answer different questions, and neither of them is vulnerability management.
Purple team
A purple team is an exercise, not a department: attackers and defenders work in the same room, running known techniques deliberately and checking together whether the telemetry, the detection and the response each hold. The goal is not to win, it is to leave with a list of detections that were built and verified.
Ransomware leak site
A ransomware leak site is a site, usually reachable over Tor, where an extortion group publishes the names of victims who have not paid and releases the data it claims to have stolen. It is the publication half of double extortion: encryption creates the outage, the site creates the deadline.
Reconnaissance
In offensive security, reconnaissance is the first phase of an attack: gathering information about a target to plan the intrusion. It is the first tactic in MITRE ATT&CK and the opening stage of the cyber kill chain, which both begin by describing exactly this, and it splits into a passive form and an active one.
Red team
In offensive security, a red team is a group that plays the adversary in an objective-driven exercise, testing not just what is vulnerable but whether an organisation detects and responds to a real intrusion. The name comes from military exercises where a red force plays the enemy against a defending blue force.
Rules of engagement
In offensive security, rules of engagement are the written agreement that defines exactly what a test may and may not do: the scope, the timing, the permitted techniques, the systems that are off limits, and who to call if something breaks. They are agreed before any testing starts and they authorise the whole exercise.
Smishing
Smishing is phishing delivered by text message. The channel matters more than the technique: messages arrive on a personal device outside the corporate mail gateway, sender identifiers are easy to forge, and the interface gives the recipient almost nothing with which to check a link before tapping it.
Social engineering
In offensive operations, social engineering is manipulating people, through phishing, pretexting or vishing, to bypass technical controls. It targets the decision rather than the system, and it works because the decisions it targets are ones the organisation needs people to make quickly and often.
Spear phishing
In offensive security, spear phishing is a targeted phishing attack aimed at a specific person or small group, built from research about them rather than sent in bulk. It is what a realistic simulation actually rehearses, because it is the technique that gets past the awareness training designed for generic mass email.
Threat intelligence
In security operations, threat intelligence is information about adversaries, refined into something a defender can actually act on. The refining is the whole discipline: raw data about attacks is abundant and nearly free, and the difficulty is turning it into a decision that would otherwise have been made differently.
Threat-led penetration testing (TLPT)
In offensive security, threat-led penetration testing (TLPT) is an intelligence-driven red team exercise against live production systems, run to a supervised framework. It is the form of testing DORA requires of certain financial entities, and it is built on the TIBER-EU methodology used by European central banks.