The Threat Domain Model

Security Information and Event Management — the aggregation and correlation engine (Splunk, Sentinel, Elastic, Chronicle). It ingests logs from every domain and fires alerts when patterns cross a threshold or match a rule.

Security Orchestration, Automation and Response. Turns repetitive analyst steps — enrich an IP, disable a user, isolate a host — into codified playbooks that run in seconds instead of hours.

The plumbing (agents, forwarders, brokers like Kafka, parsers) that reliably ships events from source to store. If the pipeline drops data silently, every downstream detection is quietly blind.

Raw logs are messy; a schema (OCSF, ECS, ASIM) maps every source into common fields so a query for 'user' or 'src_ip' works across dozens of vendors at once.

Treating detections as code: written, version-controlled, tested against real telemetry, and mapped to MITRE ATT&CK. Sigma is the vendor-neutral rule language of the discipline.

The disciplined recovery and analysis of evidence — disk, memory, and log timelines — under chain-of-custody, answering what happened, when, and how far it spread.

Context on adversaries: their infrastructure, tooling, and TTPs. Feeds enrich alerts (is this IP known-bad?) and, at the strategic level, tell you which threats to prioritize.

The ticketing spine of the SOC — where alerts become investigations, evidence is attached, and MTTD/MTTR are measured. The system of record for 'who did what, when.'

Pre-authored decision trees for recurring scenarios (ransomware, BEC, credential theft) so responders act on a rehearsed plan under pressure instead of improvising.

User and Entity Behavior Analytics — statistical/ML baselining that flags the anomalous ('this admin never logs in from Lagos at 3am') where static rules miss novel attacks.

The heartbeat of a compromise: implanted malware 'phones home' to a command-and-control server at regular (often jittered) intervals. Detecting the rhythmic, low-volume callback is a classic network win.

An evasion trick that hides C2 traffic behind a trusted CDN domain in the TLS SNI while the real destination sits in an encrypted header — making malicious traffic look like it's going to a reputable service.

A high-performance open-source IDS/IPS that matches traffic against signatures (including the Emerging Threats ruleset) and emits rich protocol logs. The workhorse of signature-based network detection.

A network analysis framework (formerly Bro) that produces structured, protocol-aware logs — conn, dns, http, ssl, files — rather than alerts. The backbone of network forensics and threat hunting.

Terminating and re-encrypting TLS at a proxy so its contents can be inspected. Powerful for detection, but a privacy and performance tradeoff — and increasingly defeated by certificate pinning and ECH.

Even encrypted sessions leak metadata: the certificate presented and the client's TLS handshake fingerprint (JA3/JA4) can identify specific malware families without decrypting a byte.

Intrusion Prevention Systems and Next-Gen Firewalls sit inline and can block, not just alert. They combine signatures, reputation, and app-awareness to drop known-bad traffic in real time.

Two evidence tiers: NetFlow is cheap metadata (who/when/how much) kept long-term; full packet capture (PCAP) is the expensive ground truth kept briefly for deep analysis.

DNS is the internet's phonebook and a favorite covert channel. Watching for DGA domains, DNS tunneling, and newly-registered domains catches C2 and exfiltration early.

Indicators of Compromise — malicious IPs, domains, and hashes. The lowest tier of the Pyramid of Pain: trivial for attackers to change, but cheap and fast for defenders to block at scale.

Endpoint Detection and Response — the sensor that records process, file, registry, and network events on every host and enables remote investigation and containment. The single highest-value control most orgs deploy.

Reaching into a running machine remotely to collect volatile evidence, pull files, or run containment commands — without pulling the plug and destroying memory-resident artifacts.

RAM holds secrets disk never sees: injected code, decrypted payloads, network connections, and credentials. Volatility is the framework for carving process lists and malware out of a memory image.

A family of techniques for running malicious code inside a legitimate process's address space (to hide and to inherit trust). Detecting anomalous module loads and hollowed processes is core endpoint work.

Abusing built-in, signed binaries (LOLBins like certutil, rundll32, mshta) so activity blends into normal admin behavior and never drops a flagged file. Detection shifts from files to behavior.

An admin's dream and an attacker's too. Script Block Logging and AMSI turn it from a blind spot into one of the richest endpoint telemetry sources — obfuscated one-liners light up like a flare.

A free Windows sensor that logs process creation with hashes and command lines, network connections, and image loads — the poor man's EDR and a hunting staple.

Cryptographic fingerprints (SHA-256) of files. Used to identify known malware, verify integrity, and deduplicate — though a single byte change yields a new hash, hence higher-order indicators.

Centralized Windows configuration. A hardening lever (disable macros, enforce logging) — and, if compromised at the domain level, a devastating mass-deployment vector for the attacker.

Windows leaves execution breadcrumbs — Prefetch, Amcache, ShimCache, MFT, event logs — that reconstruct what ran even after the file is gone. The forensic timeline's raw material.

Deceptive messages that harvest credentials or deliver malware. The umbrella term spans mass campaigns to laser-targeted spear phishing; still the initial-access technique behind the majority of breaches.

Sender Policy Framework — a DNS record listing which servers may send mail for a domain. The first of the three email-authentication pillars; blocks the crudest sender spoofing.

DomainKeys Identified Mail cryptographically signs message headers so the recipient can verify the mail wasn't forged or altered in transit. Proves integrity and origin.

Ties SPF and DKIM together with a published policy (none/quarantine/reject) and reporting. Properly enforced, it stops attackers from spoofing your exact domain — the fix most orgs half-implement.

Business Email Compromise — no malware, just a convincing email (often from a real, hijacked account) instructing a wire transfer or gift-card purchase. Among the costliest cybercrimes by dollar loss.

After taking over an account, attackers create hidden inbox rules that auto-delete or forward security warnings and replies — so the real owner never sees the fraud unfolding in their name.

Hacking the human: exploiting authority, urgency, and trust to bypass technical controls. The inbox is its primary delivery channel, but it spans voice (vishing) and text (smishing) too.

The filtering layer that scores reputation, detonates attachments in a sandbox, rewrites URLs for click-time analysis, and quarantines the obvious. The inbox's front door.

The full received-header chain, authentication-results, and return-path of a message — the forensic DNA that reveals the true sending path behind a friendly display name.

Sandboxing suspicious files and following links in an isolated environment to observe malicious behavior before a human ever clicks — catching payloads that static scanning misses.

The heart of cloud security: who (principal) can do what (action) to which resource, under what conditions. Over-broad policies and assumable roles are the most exploited cloud weakness.

Short-lived Security Token Service credentials from assuming a role. Great for least privilege — but stolen tokens grant an attacker exactly the role's power until they expire, and they're hard to revoke.

The control-plane audit trail recording every API call. The single most important cloud log source — turn it on in every region or you're investigating blind.

Network metadata for cloud traffic — the cloud's NetFlow. Reveals lateral movement and data exfiltration between instances, subnets, and the internet.

AWS's managed threat-detection service that mines CloudTrail, DNS, and flow logs for known-bad behavior (crypto-mining, credential exfil, recon) without you writing rules.

Object storage buckets are the classic accidental data leak — public ACLs, misconfigured policies, and predictable names have exposed billions of records. Public-access-block is the guardrail.

Virtual machines and their metadata service (IMDS) — a prized target, since a SSRF that reaches IMDSv1 can steal the instance's role credentials (the Capital One breach playbook).

Cloud Security Posture Management — continuously scans your accounts for misconfigurations and drift against benchmarks (CIS), catching the public bucket before an attacker does.

Logical organization of cloud assets. Good tagging is a security control: it makes ownership, blast radius, and cost attributable when an incident hits a sprawling account.

The provider secures the cloud (hardware, hypervisor); you secure what's in it (data, IAM, config). Most cloud breaches happen squarely on the customer's side of that line.

Security Assertion Markup Language — the XML-based SSO standard that lets an identity provider vouch for you to an application. 'Golden SAML' attacks forge these assertions to impersonate anyone.

OAuth 2.0 delegates authorization (access without sharing a password); OpenID Connect adds an identity layer on top. The token-based backbone of modern web and mobile auth — and a rich target for consent-phishing.

The bearer credentials of modern auth — JWTs, access/refresh tokens, SAML assertions. Whoever holds a valid token is trusted, which is why token theft (pass-the-cookie) bypasses even MFA.

Managing the accounts that can do the most damage — admins, service accounts, break-glass. Vaulting, session recording, and just-in-time elevation shrink the window a stolen admin credential is useful.

Requiring more than a password, and gating access on device, location, and risk signals. Phishing-resistant MFA (FIDO2/passkeys) defeats the MFA-fatigue and proxy attacks that beat push/OTP.

Trusting another organization's or provider's identities (B2B, social login). Powerful for UX, but a trust relationship is also an attack path — compromise the IdP and you compromise every relying party.

Adversary-in-the-Middle phishing kits (Evilginx) proxy the real login page to capture credentials AND the post-MFA session cookie in real time — the modern way MFA gets bypassed.

Active Directory / Entra ID — the source of truth for who exists and what they can access. Owning the directory (DCSync, Golden Ticket) is checkmate; its logs are prime hunting ground.

Non-human identities for apps and automation. They vastly outnumber humans, rarely have MFA, and their long-lived secrets are a booming attack surface (the machine-identity problem).

Windows authentication protocols whose ticket abuse — Kerberoasting, pass-the-hash, pass-the-ticket — is the bread and butter of on-prem lateral movement.

The industry's consensus list of the most critical web app risks — broken access control, injection, cryptographic failures, SSRF, and more. The baseline curriculum for anyone shipping software.

Web Application Firewall — inspects HTTP requests and blocks common attack patterns (injection, XSS, bad bots). A useful shield and virtual-patch layer, but never a substitute for fixing the code.

Untrusted input interpreted as a command — SQLi, command injection, LDAP injection. The defense is universal: parameterize queries and never concatenate user input into an interpreter.

Where the crown jewels sit. Defense spans least-privilege DB accounts, encryption at rest, query parameterization, and monitoring for mass-export patterns that signal exfiltration.

The connective tissue of modern apps and the fastest-growing attack surface. Broken object-level authorization (BOLA/IDOR) — asking for record 124 instead of 123 — is the signature API flaw.

Packaging apps with their dependencies for portability. Security concerns: vulnerable base images, secrets baked into layers, over-privileged containers, and exposed daemon sockets.

Static analysis reads source for flaws before deploy; dynamic analysis attacks the running app from outside. Together they shift security 'left' into the development pipeline.

Keeping API keys, DB passwords, and certificates out of source code and images — in a vault with rotation and audit. Hardcoded secrets are one of the most common and damaging leaks.

The inventory of what apps and components exist, their versions and owners. You cannot patch or defend what you don't know you run — asset truth underpins every other control.

Forgotten marketing sites and unofficial apps that no one patches. Low business value, high risk — they're the unlocked side door attackers love, and the reason inventory matters.

Supervisory Control and Data Acquisition — the systems that monitor and control industrial processes across sites. The operator's window into (and hands on) physical infrastructure.

Programmable Logic Controllers and Remote Terminal Units — the ruggedized computers that actually open valves and spin motors. Stuxnet's target; often unauthenticated by design.

A 1979 serial/TCP industrial protocol with no authentication or encryption — any device on the network can read or command it. Emblematic of OT's 'insecure by design' legacy.

The reference architecture that layers OT into levels (0 field devices → 5 enterprise) with an IT/OT DMZ between. The blueprint for segmentation that keeps corporate compromises off the plant floor.

Human-Machine Interface — the screens operators use to run the process. A compromised HMI can feed false readings (Stuxnet again) so operators trust a lie while equipment self-destructs.

The time-series database recording every sensor value and setpoint. The forensic record of the physical process — and a bridge system that often straddles the IT/OT boundary.

The last-resort systems (SIS) that trip a process to a safe state. The 2017 TRITON/TRISIS malware targeted these specifically — an attack aimed at causing physical harm, not data theft.

Beyond Modbus: DNP3, EtherNet/IP, PROFINET, OPC-UA. Passive monitoring appliances that speak these protocols provide detection without risking fragile devices with active scans.

Isolating OT from IT — ideally physically, realistically via a tightly controlled DMZ with data diodes. The primary defense, undermined by USB drives, vendor laptops, and remote-access creep.

OT gear runs for 20+ years on unpatchable OSes with vendor-locked warranties. Compensating controls (segmentation, monitoring) matter more here than anywhere, because you often simply cannot patch.

Mobile Device / Enterprise Mobility Management (Intune, Jamf, MobileIron) — the control plane that enrolls devices, enforces policy, and can remotely wipe corporate data. The foundation of mobile defense.

Splitting a device into managed 'work' and untouched 'personal' profiles so corporate data can be controlled and wiped without touching the user's photos. The key to BYOD that people accept.

Two security models: iOS is a locked-down walled garden; Android is open and more configurable but historically more fragmented. Threat models and controls differ sharply between them.

Installing apps outside official stores (APK files on Android) bypasses store vetting — a major malware vector. Blocking unknown sources and side-loading is a baseline mobile control.

The Android reality: thousands of device models on wildly different OS versions and patch levels, many never updated. A patched vulnerability can remain exploitable on millions of devices for years.

Baseline requirements pushed to devices — encryption, screen lock, minimum OS, no jailbreak — and conditional access that blocks non-compliant devices from corporate resources.

Cryptographic proof (Play Integrity, App Attest) that an app is genuine and running on an untampered device — the defense against repackaged apps and emulator-based fraud.

Spotting devices whose security model has been dismantled — where containerization and encryption guarantees no longer hold. A signal to block access, not just log it.

Smishing (SMS), quishing (QR), and malicious deep links exploit the small screen where full URLs hide. Mobile users click faster and see less — a potent social-engineering surface.

Mercenary spyware (Pegasus) exploits parsing bugs in messaging apps to compromise a phone with no user interaction. The high end of the mobile threat model — rare, targeted, devastating.

Large language (and multimodal) models are now core infrastructure. Each one you deploy is an asset to inventory, an endpoint to monitor, and a new class of thing that can be attacked and misused.

The signature LLM attack: untrusted content (a web page, an email, a document) carries hidden instructions the model obeys — turning a helpful assistant into the attacker's proxy. OWASP's #1 LLM risk.

Corrupting training or fine-tuning data so the model learns a hidden backdoor or bias. Because provenance is hard to verify at web scale, a few malicious samples can compromise a model invisibly.

Stealing a model's weights or behavior through its API (extraction), or reconstructing its private training data from outputs (inversion). Attacks against the confidentiality of the model itself.

Inputs perturbed just enough to fool a model while looking normal to humans — the stop sign a vision model reads as 'speed limit.' Evasion of the model's core prediction.

Retrieval-Augmented Generation grounds a model in your documents via embeddings in a vector store. A powerful pattern — and a new exfiltration and indirect-injection surface if the corpus is poisoned or over-shared.

When a model can call tools — send email, run code, hit APIs — a prompt injection becomes a confused-deputy attack with real-world permissions. Agent autonomy multiplies both value and blast radius.

Input/output filtering, system-prompt hardening, allow-listed tools, and human-in-the-loop for high-impact actions. The defensive layer around a model — necessary, imperfect, and never a full boundary.

The reference taxonomy of LLM-application risks — prompt injection, insecure output handling, excessive agency, sensitive-info disclosure, and more. The AI domain's OWASP Top 10.

Inventorying models, their training data lineage, and dependencies (an AI Bill of Materials) in a governed registry. You can't secure or audit models you can't enumerate — supply-chain thinking for AI.

The other side: adversaries use AI to write flawless phishing at scale, clone voices, generate deepfakes, and accelerate recon and exploit development. AI is a force-multiplier for attacker and defender alike.