# Threats, Vulnerabilities, Malware, Social Engineering & MITRE ATT&CK

> Comprehensive coverage of CompTIA Security+ (SY0-701) and CEH threat intelligence, threat actor profiles, Cyber Kill Chain vs MITRE ATT&CK vs Diamond Model, malware classifications, social engineering techniques, supply chain/zero-day exploits, password attacks, and memory/race condition vulnerabilities.

- **Canonical URL:** https://flashcards.world/flashcards/sets/09b7e7b1-82a5-480f-ad4e-419e7389cdce/
- **Markdown URL:** https://flashcards.world/flashcards/sets/09b7e7b1-82a5-480f-ad4e-419e7389cdce.md
- **Level:** basic
- **Languages:** en → en
- **Total Cards:** 32

## Flashcards (32 Cards)

| # | Front (Term / Prompt) | Back (Definition / Answer) | Example | Multiple-Choice Options |
| :--- | :--- | :--- | :--- | :--- |
| 1 | How do Viruses, Worms, and Trojans differ in their propagation and activation mechanisms? | Virus: Attaches to a clean host file/boot sector and requires human action (executing the host program) to run and spread. Worm: Standalone self-replicating malware that propagates automatically across networks via unpatched vulnerabilities (e.g., WannaCry via SMBv1 EternalBlue) without user interaction. Trojan: Disguises itself as legitimate software to trick users into executing it; does not self-replicate. |  |  |
| 2 | What are Cialdini's core psychological principles of influence commonly exploited in social engineering? | 1. Authority (impersonating executives, law enforcement, or IT); 2. Urgency/Scarcity (creating artificial time pressure so victims skip verification); 3. Familiarity/Liking (building rapport); 4. Intimidation/Fear (threatening account suspension or legal action); 5. Consensus/Social Proof ('everyone else in your department already completed this'); 6. Reciprocity (offering a small favor/gift first). |  |  |
| 3 | Define Pretexting, Impersonation, Elicitation, and Shoulder Surfing in social engineering. | Pretexting: Creating a fabricated scenario or backstory (e.g., pretending to be an external IT auditor) to justify asking for sensitive information. Impersonation: Assuming the identity of a trusted person or authority figure. Elicitation: Subtle conversational extraction of sensitive info without asking direct questions. Shoulder Surfing: Directly observing a target's screen or keypad to steal PINs/passwords. |  |  |
| 4 | Compare User-Mode Rootkits, Kernel-Mode Rootkits, and Bootkits. | User-Mode Rootkit: Hooks API calls in ring 3 to hide files/processes from user applications. Kernel-Mode Rootkit: Runs in ring 0, modifying OS kernel data structures (Direct Kernel Object Manipulation) to conceal presence from the OS itself. Bootkit: Infects the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware to load before the OS kernel and bypass Secure Boot if unverified. |  |  |
| 5 | What is Business Email Compromise (BEC), and how does it bypass standard malware email filters? | BEC (CEO Fraud / Invoice Fraud) involves impersonating or compromising an executive's or vendor's email account to trick finance staff into wiring funds or altering ACH routing details. Because BEC emails typically contain no malicious attachments or phishing links—relying purely on urgency, authority, and social engineering—signature and sandbox filters often miss them. |  |  |
| 6 | How does the MITRE ATT&CK framework differ from the Cyber Kill Chain, and what are Tactics, Techniques, and Procedures (TTPs)? | Unlike the linear Cyber Kill Chain, MITRE ATT&CK is a non-linear matrix of post-compromise adversary behaviors across 14 enterprise tactics. Tactics represent the 'why' (adversary's technical goal, e.g., Credential Access, Lateral Movement); Techniques represent the 'how' (method used, e.g., T1003 OS Credential Dumping); Procedures are the specific real-world implementation/tools used by a threat group. |  |  |
| 7 | What is a Race Condition, and how does a Time-of-Check to Time-of-Use (TOCTOU) vulnerability occur? | A race condition occurs when system behavior depends on the relative timing/interleaving of concurrent threads or processes. A TOCTOU flaw happens when a program checks a resource's security state (e.g., verifying file permissions) and then uses the resource in a separate step; an attacker swaps the resource (e.g., via a symlink to `/etc/shadow`) in the microsecond window between the check and the use. |  |  |
| 8 | What are the 7 chronological stages of the Lockheed Martin Cyber Kill Chain? | 1. Reconnaissance (harvesting emails, OSINT, scanning); 2. Weaponization (coupling exploit with backdoor payload); 3. Delivery (transmitting weapon via email, web, or USB); 4. Exploitation (triggering vulnerability on target); 5. Installation (installing persistent backdoor/RAT); 6. Command and Control (C2 channel establishment); 7. Actions on Objectives (data exfiltration, lateral movement, or destruction). |  |  |
| 9 | Explain how a Stack-Based Buffer Overflow exploits memory and how ASLR, DEP/NX, and Stack Canaries mitigate it. | When a program writes input beyond a fixed-size stack buffer without bounds checking (e.g., `strcpy`), it overwrites the adjacent saved Instruction Pointer (EIP/RIP) on the stack, redirecting execution to attacker shellcode. Stack Canaries place a random value before the return address to detect overwrites; DEP/NX marks stack/heap memory non-executable; ASLR randomizes memory locations of executables and libraries. |  |  |
| 10 | Differentiate between Integer Overflow, Use-After-Free (UAF), and Memory Leak vulnerabilities. | Integer Overflow: An arithmetic operation exceeds the maximum bit width of an integer type, wrapping around to a small or negative number (often bypassing size checks before buffer allocation). Use-After-Free (UAF): A program continues to use a heap pointer (dangling pointer) after the memory has been freed and reallocated to attacker-controlled data. Memory Leak: Failing to free allocated heap memory, leading to resource exhaustion (DoS). |  |  |
| 11 | Compare Kerberos Golden Ticket, Silver Ticket, and Kerberoasting attacks. | Golden Ticket: Forging Ticket Granting Tickets (TGTs) using the compromised domain `krbtgt` account hash, granting domain-wide persistence as any user. Silver Ticket: Forging a Service Ticket (TGS) using a compromised service account's hash to access a specific service without contacting the Domain Controller. Kerberoasting: Requesting TGS tickets for accounts with Service Principal Names (SPNs) and cracking the service account password hashes offline. |  |  |
| 12 | What is David Bianco's Pyramid of Pain, from easiest for an attacker to change (bottom) to hardest (top)? | From bottom (trivial) to top (tough): 1. Hash Values (MD5/SHA-256); 2. IP Addresses; 3. Domain Names; 4. Network/Host Artifacts (User-Agent strings, registry keys); 5. Tools (specific exploit kits/binaries); 6. TTPs (Tactics, Techniques, and Procedures). Detecting adversaries at the TTP level forces them to completely re-engineer their tradecraft. |  |  |
| 13 | Compare Pharming, Watering Hole attacks, and Typosquatting (URL Hijacking). | Pharming: Redirecting users from a legitimate domain to a fraudulent website without their knowledge by poisoning local `hosts` files or DNS caches. Watering Hole: Compromising a legitimate third-party website frequently visited by a specific target group (e.g., an industry trade portal) to infect visitors via drive-by downloads. Typosquatting: Registering lookalike domains (e.g., `micr0soft.com` or homograph IDN attacks) to capture mistyped URLs. |  |  |
| 14 | What is a Zero-Day Vulnerability, and what is the lifecycle window of exposure? | A zero-day vulnerability is a software/hardware flaw discovered and exploited before the vendor is aware of it or has released a public patch ('zero days' to prepare). The window of exposure spans from vulnerability introduction/discovery by attackers -> vendor notification -> patch release -> patch deployment across enterprise assets. |  |  |
| 15 | How does a Rainbow Table attack work, and why does cryptographic salting defeat it? | A Rainbow Table is a precomputed lookup table mapping plaintext passwords to their cryptographic hashes using time-memory tradeoff chains. When a unique, random salt is appended to each user's password prior to hashing (`H(password \|\| salt)`), identical passwords produce completely different hashes, invalidating precomputed rainbow tables and forcing per-user cracking. |  |  |
| 16 | What is the difference between a Vulnerability, a Threat, an Exploit, and Risk? | Vulnerability: A weakness or flaw in an asset's design, implementation, or configuration. Threat: Any potential actor or event capable of exploiting a vulnerability to cause harm. Exploit: The specific code, tool, or technique used to take advantage of a vulnerability. Risk: The likelihood and impact of a threat exploiting a vulnerability (`Risk = Threat x Vulnerability x Impact`). |  |  |
| 17 | How do Software Supply Chain attacks (e.g., SolarWinds SUNBURST, dependency confusion, malicious npm/PyPI packages) operate? | Attackers compromise an upstream software vendor's build pipeline, code-signing keys, or open-source package repository. When downstream customers install trusted, digitally signed updates or pull dependencies (e.g., via dependency confusion where a public package shares an internal package name with a higher version number), the backdoor is deployed inside trusted network perimeters. |  |  |
| 18 | Compare Credential Stuffing, Password Spraying, Brute Force, and Dictionary Attacks. | Brute Force: Systematically trying every possible character combination. Dictionary Attack: Trying words/phrases from curated wordlists with common mangling rules. Credential Stuffing: Replaying leaked username/password pairs from third-party data breaches against other services (exploiting password reuse). Password Spraying: Testing a few common passwords (e.g., `Summer2026!`) across thousands of accounts simultaneously to avoid account lockout thresholds. |  |  |
| 19 | How does a Pass-the-Hash (PtH) attack work in Windows environments? | In NTLM authentication (and Kerberos RC4/AES key material), the server validates identity using a challenge-response derived from the password hash rather than the plaintext password. An attacker who dumps NTLM hashes from LSASS memory (e.g., via Mimikatz) can authenticate directly to remote SMB/WMI services using the raw hash without ever cracking it to plaintext. |  |  |
| 20 | What are the four core nodes and two primary axes of the Diamond Model of Intrusion Analysis? | The four core nodes are Adversary, Capability, Infrastructure, and Victim. The two primary axes are the Socio-Political axis (Adversary <-> Victim relationship/motivation) and the Technical axis (Capability <-> Infrastructure used to conduct the intrusion), supplemented by meta-features like timestamp, phase, and direction. |  |  |
| 21 | What is Fileless Malware (Living-off-the-Land / LotL), and why does it evade traditional signature-based antivirus? | Fileless malware operates almost entirely in volatile RAM without writing malicious executables to disk. After initial exploitation or macro execution, it abuses built-in, signed OS administrative binaries (LOLBins) such as PowerShell, WMI, `certutil`, or `mshta` to inject shellcode into legitimate processes, leaving no traditional file hash on the filesystem. |  |  |
| 22 | What are the components of the CVSS v3.x Base Score vector (Exploitability vs Impact metrics)? | Exploitability metrics measure how the vulnerability is accessed: Attack Vector (AV: Network/Adjacent/Local/Physical), Attack Complexity (AC: Low/High), Privileges Required (PR: None/Low/High), and User Interaction (UI: None/Required), plus Scope (S: Unchanged/Changed). Impact metrics measure loss of Confidentiality (C), Integrity (I), and Availability (A) as None, Low, or High. |  |  |
| 23 | Distinguish between Phishing, Spear Phishing, Whaling, Vishing, and Smishing. | Phishing: Untargeted mass email campaigns using generic lures. Spear Phishing: Highly targeted email attacks tailored to a specific individual, role, or organization using OSINT. Whaling: Spear phishing directed specifically at C-level executives (CEO, CFO) or board members. Vishing: Voice phishing via phone/VoIP (often using AI voice cloning or spoofed caller ID). Smishing: Phishing conducted via SMS/text messages. |  |  |
| 24 | Compare the motivations, resources, and stealth profiles of Advanced Persistent Threats (APTs), Hacktivists, Script Kiddies, and Insider Threats. | APTs: Nation-state/state-sponsored groups with vast funding, zero-day capabilities, and long-term stealth (espionage/sabotage). Hacktivists: Ideologically/politically motivated actors using DDoS, defacement, or data leaks for publicity. Script Kiddies: Unskilled attackers using off-the-shelf exploit scripts without deep technical understanding. Insiders: Current/former employees or contractors abusing authorized access (malicious, negligent, or coerced). |  |  |
| 25 | Compare CVE, CVSS, and CWE in vulnerability management. | CVE (Common Vulnerabilities and Exposures): A standardized dictionary of publicly disclosed specific product vulnerabilities (e.g., CVE-2021-44228 Log4Shell). CVSS (Common Vulnerability Scoring System): A numerical framework (0.0 to 10.0) assessing vulnerability severity across Base, Temporal, and Environmental metric groups. CWE (Common Weakness Enumeration): A taxonomy of root-cause software/hardware weakness categories (e.g., CWE-89 SQL Injection, CWE-79 XSS). |  |  |
| 26 | How do Logic Bombs, Remote Access Trojans (RATs), and Keyloggers operate? | Logic Bomb: Dormant malicious code (often planted by an insider) that executes a destructive payload only when a specific condition is met (e.g., a date or termination of an employee's AD account). RAT: Provides covert interactive C2 control over a victim system (screen capture, shell, webcam). Keylogger: Hardware dongle or software hook (API/kernel) that records keystrokes to steal credentials. |  |  |
| 27 | What is the difference between Polymorphic Malware and Metamorphic Malware? | Polymorphic malware uses a variable encryption/packing routine with a different key on each iteration to change its file signature on disk, but decrypts to the same original payload in memory (leaving a detectable decryption stub). Metamorphic malware completely rewrites its own assembly instructions (instruction substitution, register swapping, dead-code insertion) on each iteration so neither disk nor memory code matches prior versions. |  |  |
| 28 | What is the exact distinction between Tailgating and Piggybacking in physical security? | Tailgating occurs when an unauthorized person follows an authorized employee through a secure door without the employee's knowledge or consent (e.g., slipping in before the door latches). Piggybacking occurs when the authorized employee knowingly consents or holds the door open for the unauthorized person (often tricked via courtesy or carrying fake boxes). |  |  |
| 29 | What is modern double-extortion Ransomware, and why should victims avoid immediately powering off an infected host before triage? | Double-extortion ransomware exfiltrates sensitive data to attacker C2 servers before encrypting local files (via hybrid symmetric AES/ChaCha20 + asymmetric RSA/ECC encryption), threatening public leaks alongside operational downtime. Powering off destroys volatile RAM, which may contain ephemeral encryption keys, active C2 connections, or unencrypted file handles. |  |  |
| 30 | Compare Indicators of Compromise (IoCs) and Indicators of Attack (IoAs). | IoCs are reactive, forensic artifacts showing a breach has already occurred (e.g., malicious file hashes, known C2 IP addresses, domain names, registry keys—at the bottom of David Bianco's Pyramid of Pain). IoAs are proactive, real-time behavioral patterns indicating an ongoing attack regardless of specific tools (e.g., PowerShell spawning from `winword.exe` and dumping `lsass.exe`). |  |  |
| 31 | What are Threat Intelligence sharing standards STIX, TAXII, and OpenIOC? | STIX (Structured Threat Information Expression) is a standardized JSON-based serialization language describing cyber threat intelligence (observables, indicators, TTPs, threat actors, campaigns). TAXII (Trusted Automated Exchange of Intelligence Information) is the HTTPS transport protocol used to exchange STIX data across organizations and ISACs. OpenIOC is an XML schema for sharing technical indicators of compromise. |  |  |
| 32 | What is Return-Oriented Programming (ROP), and which memory mitigation is it designed to bypass? | ROP is an advanced exploitation technique designed to bypass Data Execution Prevention (DEP / No-Execute bit). Instead of injecting executable shellcode onto the non-executable stack, the attacker chains together short sequences of existing, legitimate machine instructions already present in executable code segments (called 'gadgets', each ending in a `RET` instruction) to perform arbitrary actions. |  |  |

---
Study this deck interactively with FSRS-6 spaced repetition, audio review, and multiple-choice mode at [Flashcards World](https://flashcards.world/flashcards/sets/09b7e7b1-82a5-480f-ad4e-419e7389cdce/).