Cybersecurity Glossary
Plain-language definitions of the cybersecurity terms, attacks, and acronyms you keep running into. Search or jump by letter.
A
Account Manipulation
MITRE ATT&CK tracks it as T1098, across seven surfaces from cloud credentials to registered MFA devices. Because the change outlives the credential, resetting…
Agent Hijacking
It is the outcome of prompt injection against a system that can take actions, not a separate technique. Search for agent hijacking and the first two results…
AiTM Phishing
The victim signs in and completes MFA successfully. The attacker captures the session cookie the identity provider issues and replays it to enter the account…
AS-REP Roasting
Because the account is exempt, a domain controller returns an AS-REP containing material encrypted with the account's own key, which an attacker cracks…
C
C2 Server
A C2 server (command and control server, also written C&C) is the infrastructure an attacker uses to communicate with and control malware on compromised…
Callback Phishing
MITRE ATT&CK has no technique of that name, and the FBI has documented one group escalating from the call to sending a person into the building. Every page in…
Consent Phishing
No password is stolen and no MFA prompt is defeated. The user grants delegated permissions, the application receives a token, and it can read data in the…
D
Data Exfiltration
It usually follows a quiet sequence: find the data, stage it in one place, compress it, then send it out. Staging leaves the most host-side evidence, which…
Dedicated Leak Site
A dedicated leak site, or DLS, is a criminal-run website where a ransomware group lists the organisations it says it has breached and publishes their stolen…
Device Code Phishing
The attacker starts a device login, sends the victim the resulting code, and the victim enters it on the real provider sign-in page and completes MFA, handing…
DLL Sideloading
MITRE ATT&CK now covers it under T1574.001, alongside DLL search order hijacking, redirection, phantom hijacking and substitution. The identifier T1574.002 no…
DNS Tunneling
An implant encodes the data into the subdomains it looks up, and an attacker-controlled name server decodes it and answers back. Because networks rarely block…
Dwell Time
Right now the global median is 14 days, measured across 2025 in Mandiant's M-Trends 2026 report. That single number is where the confusion starts. You have…
E
G
I
M
N
P
Phishing
It is not a single technique. MITRE ATT&CK scatters it across six tactics, and the named variants differ by channel, by who is targeted, by objective, and by…
Pyramid of Pain
Some detections barely slow an attacker down. Others force them to relearn their job. The Pyramid of Pain is the model that tells you which is which: it ranks…
Q
R
S
Smishing
An attacker sends an SMS impersonating a bank, a courier, a government office or a colleague, and asks the recipient to click a link, call a number, or reply.…
Spear Phishing
MITRE ATT&CK has no technique by that name: it has a parent called Phishing whose every sub-technique is a spearphishing variant, plus a separate one filed…