Cybersecurity & Forensics Glossary

Software that displays or delivers unsolicited advertising, typically bundled with free applications. Modern adware frequently crosses into spyware territory, tracking browsing habits, search queries, and geographic location without disclosure. In civil litigation, adware found on a device can raise questions about what other unauthorized software may have been installed and what data was collected from the user without their knowledge.

Prolonged targeted activity intended to maintain access, obtain information or affect systems. The label describes a threat pattern; it does not by itself identify a particular actor. Analysis maps the access, movement and transfers supported by available records, with missing systems and periods identified. It cannot presume a complete inventory of every system touched or all data accessed or removed.

NIST forensic-method guidance (opens in a new tab)

A hidden mechanism, either intentionally built into software by a developer or secretly installed by an attacker, that allows unauthorized access to a system while bypassing normal authentication. Back doors can persist across reboots and survive software updates if embedded deeply enough. Forensic examiners look for back doors during post-incident analysis by examining running processes, scheduled tasks, startup entries, and network connections to identify unauthorized persistent access channels.

A hacker who operates outside legal or ethical boundaries, typically for personal financial gain, espionage, or malicious disruption. The term derives from old Western films where villains wore black hats. Black hat actors may work independently, as part of organized crime groups, or on behalf of state sponsors, and the line between the three is increasingly blurred in modern cybercrime.

A compromised device running automated malware that accepts commands from a remote operator, often without any visible sign to the device's owner. Bots are the building blocks of botnets and are routinely recruited through drive-by downloads, phishing, or exploitation of unpatched vulnerabilities. A single bot infection can serve as the initial foothold for lateral movement throughout an enterprise network.

Networks of compromised computers (bots) controlled by a threat actor through a command-and-control (C2) server or peer-to-peer protocol. Botnets are used to conduct distributed denial-of-service attacks, send spam at massive scale, mine cryptocurrency, steal credentials, and distribute additional malware. Modern botnets may number in the millions of devices and are leased out as a commodity on underground marketplaces. Forensic analysis of a botnet infection focuses on identifying C2 communication artifacts in network logs, browser history, and system memory.

A password or key-guessing attack that systematically tests candidates. Speed depends on the algorithm, work factor, hardware and whether attempts occur online or against an offline hash. GPU acceleration can help with some offline workloads; rainbow tables are a separate precomputation technique and are less useful against properly salted hashes. Repeated authentication failures followed by a success warrant review, but do not by themselves prove a successful attack.

A vulnerability that occurs when a program writes more data to a memory buffer than it can hold, overflowing into adjacent memory regions and potentially overwriting control data such as return addresses. Attackers craft malicious input to redirect program execution to their own code (shellcode). Buffer overflow exploits have existed for decades but remain relevant in legacy software, embedded systems, and OT/ICS environments where patching is infrequent.

Infrastructure and communication paths used to direct compromised systems or receive information from them. Channels may use dedicated servers or legitimate services. Available packet captures, DNS, endpoint and provider records can help test suspected communications and compromise scope. Infrastructure alone does not establish the actor’s identity or intent; conclusions require corroboration and stated coverage limits.

NIST forensic-method guidance (opens in a new tab)

Small data files placed on a user's device by websites to retain session state, preferences, or tracking identifiers. While cookies have legitimate uses, session cookies can be stolen by cross-site scripting or man-in-the-middle attacks to hijack authenticated sessions without needing a password. In digital forensic examinations, browser cookie files are a rich source of historical data about sites visited, login times, and user identifiers, even after browsing history has been deleted.

In security parlance, an individual who breaks into systems or bypasses software protections without authorization, as distinguished from a "hacker," whose original meaning referred to creative technical problem-solving. The term is also used for tools that crack encrypted passwords or bypass software licensing. Forensic examiners may encounter cracking utilities on suspect devices as evidence of intentional unauthorized access attempts.

An automated attack that takes username and password pairs from previous data breaches and tests them against other services, exploiting the widespread habit of password reuse. Because the credentials are real and the login attempts appear legitimate, credential stuffing is difficult to detect without behavioral analytics. A successful credential stuffing attack does not require any technical exploitation of the target; the attacker simply authenticates normally using stolen data.

A web application vulnerability in which an attacker injects malicious scripts into content served to other users' browsers. The victim's browser executes the script in the context of the trusted site, enabling cookie theft, session hijacking, keylogging, and redirection to phishing pages. XSS vulnerabilities frequently appear in source code reviews and are among the most commonly documented findings in web application penetration tests.

Also called DNS cache poisoning or DNS spoofing, this attack corrupts the cache of a DNS resolver with false records, causing users who query that server to be directed to attacker-controlled IP addresses instead of legitimate ones. Victims typically see no visible warning. DNS poisoning is used to redirect banking customers to phishing sites, intercept email, and deliver malware to users who believe they are visiting trusted domains.

An attack that makes a system, service, or network unavailable by overwhelming it with traffic or requests, or by exploiting a vulnerability that causes the target to crash. A DoS attack originates from a single source, as opposed to a DDoS attack which uses many. Network traffic logs, firewall records, and server access logs are the primary forensic artifacts used to document a DoS incident and attribute responsibility.

A denial-of-service attack launched simultaneously from thousands or millions of compromised devices (a botnet), making it far more difficult to filter and block than a single-source attack. DDoS attacks are sold as a service on the dark web for as little as a few dollars per hour and are used for extortion, competitive sabotage, hacktivism, and as a distraction while attackers conduct other intrusions. Forensic documentation of a DDoS attack involves preserving packet capture data, traffic flow records, and ISP logs in a manner suitable for civil litigation or regulatory reporting.

Malware delivery that occurs automatically when a user visits a compromised or malicious web page, without any deliberate action such as clicking a download link. The attack exploits vulnerabilities in browsers, browser plugins (Flash, PDF readers, Java), or the operating system itself. Drive-by downloads are a primary delivery mechanism for exploit kits and represent a significant threat to organizations whose employees browse the web on corporate machines.

Searching discarded documents, packaging or storage media for sensitive information. Exposed material can include account details, passwords and hardware that still contains recoverable data. Secure disposal requires appropriate document destruction and media sanitization. Access rights and evidentiary use depend on the location, ownership and applicable law; discarded material is not automatically lawful to collect.

A hidden feature or message intentionally embedded in software by developers, activated by undocumented keystrokes or input sequences. Most Easter eggs are harmless and humorous, but they illustrate that production software can contain undisclosed functionality, which becomes relevant when examining software for unauthorized back doors or hidden capabilities. Source code review can identify Easter eggs and distinguish them from malicious hidden functions.

A packaged toolkit, typically deployed on compromised web servers, that automatically probes visiting browsers for known vulnerabilities and delivers the appropriate exploit. Exploit kits like Blackhole (active roughly 2010 to 2013), Angler (active roughly 2013 to 2016), and RIG automated what was once a manual attack process, enabling even low-skill actors to infect large numbers of victims. They are frequently the delivery mechanism for ransomware, banking trojans, and credential stealers.

Malicious activity that minimizes reliance on standalone executable files, often using memory, scripts or legitimate tools such as PowerShell and WMI. Fileless does not mean artifact-free: registry hives, event logs, script content and persistence records may remain on disk. Examiners correlate memory captures with those persistent sources. Collection priorities depend on volatility and operational risk.

A device or program that monitors and filters traffic under configured rules. Capabilities differ by product and deployment. Firewall records can support network analysis, but logging settings, traffic paths, drops and retention determine coverage; they are not a record of every possible connection or packet.

A term used for security research that operates outside explicit authorization, sometimes followed by unsolicited disclosure or a demand for payment. Good intentions do not establish permission. The legal position depends on the conduct, jurisdiction and applicable agreements. Organizations should preserve the disclosure and involve counsel before authorizing further access.

Broadly, a person with advanced technical skills who uses them to gain access to systems, networks, or data. The term originally described creative problem-solvers in the computing community. Today it is used both as a neutral descriptor and as shorthand for a malicious actor; context and the white/gray/black hat distinction clarify intent. In legal proceedings, "hacker" is often used loosely, making precise technical characterization important for forensic expert witnesses.

Observable artifacts that suggest a system or network has been compromised, including malicious IP addresses, file hashes, domain names, registry keys, and behavioral patterns associated with known threat actors. Security teams share IoCs through threat intelligence platforms to help others detect the same threats quickly. In forensic analysis, documented IoCs provide the evidentiary basis for determining when and how an intrusion occurred and which systems were affected.

Software or hardware that records keystrokes. A malicious keylogger may capture passwords, messages and business information; some tools also have authorized administrative uses. In corporate matters, examiners assess installation history, configuration, stored records and transmission destinations. The tool's presence alone does not establish who installed it or what information reached another party.

A model, originally developed by Lockheed Martin for military targeting, adapted to cybersecurity to describe the sequence of steps an attacker must complete to achieve an objective: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Defenders use the kill chain model to identify which stage an attacker is in and where controls can interrupt the attack. Forensic analysts reconstruct kill chains during post-incident review to document exactly how an attacker moved from initial access to final impact.

The techniques an attacker uses after gaining initial access to move from system to system within a network, escalating privileges and reaching high-value targets such as domain controllers, databases, or sensitive file shares. Common lateral movement methods include pass-the-hash, remote service exploitation, and abuse of legitimate administrative tools. Identifying lateral movement is a central task in network forensic examinations, since the initial point of entry is often not where the most damage was done.

An attack technique in which threat actors use legitimate, pre-installed system tools (such as PowerShell, WMI, PsExec, and certutil) to conduct malicious activities, minimizing the need to deploy custom malware. Because the tools used are trusted by the operating system and standard security products, LOTL attacks evade most signature-based detection. Forensic examination of LOTL attacks requires deep analysis of event logs, PowerShell script block logging, and process creation records to distinguish malicious use from normal administrative activity.

Malicious code deliberately inserted into software that lies dormant until a specific trigger condition is met, such as a particular date, time, or the removal of an employee account from the directory. Logic bombs have been used by disgruntled insiders to destroy data or sabotage systems after termination. Source code forensics can identify logic bombs by examining version control history, comparing binaries to source, and flagging conditional constructs tied to time-based or personnel-based triggers.

An umbrella term for any software designed to harm, disrupt, or gain unauthorized access to systems or data. The category includes viruses, worms, trojans, ransomware, spyware, adware, rootkits, and more. Modern malware is often modular, combining multiple capabilities such as credential theft, lateral movement, and data exfiltration into a single infection. Forensic malware analysis involves static examination of code, dynamic analysis in sandboxed environments, and behavioral correlation with network and endpoint logs.

An attack in which an adversary secretly positions themselves between two communicating parties, intercepting and potentially altering traffic while each party believes they are communicating directly with the other. MitM attacks are conducted through ARP spoofing, DNS poisoning, rogue Wi-Fi access points, and SSL stripping. They are particularly dangerous in financial transactions and authentication flows. TLS certificate analysis and packet captures are key forensic tools for documenting a MitM event.

In early botnet architecture, a master program was the central controller used by an attacker to issue commands to handler systems, which in turn relayed instructions to individual compromised hosts. The term is less common today as C2 infrastructure has grown more sophisticated, but the underlying concept of hierarchical botnet control remains relevant in analyzing legacy malware and attribution in older intrusion cases.

The component of a malware package that carries out the intended malicious action, distinct from the delivery or exploit mechanism. Payloads may encrypt files (ransomware), exfiltrate data, delete records, install a back door, or enlist the system in a botnet. Identifying the payload is a central goal of malware analysis, as it determines the actual harm caused and informs both remediation and the legal theory of damages in litigation.

Deceptive messages, calls or sites intended to induce actions such as revealing credentials, authorizing a payment or opening malicious content. Spear phishing targets selected recipients; whaling targets senior decision-makers. Headers, links, account records and endpoint artifacts can support analysis of delivery and subsequent access, subject to source limits. Employee reasonableness and legal consequences remain matters for counsel and the responsible decision-maker.

NIST forensic-method guidance (opens in a new tab) · MITRE phishing techniques (opens in a new tab)

A practitioner of phone phreaking, the manipulation of telephone systems to make free calls, redirect calls, or gain unauthorized access to phone company infrastructure. Phreaking culture in the 1960s-1980s directly shaped the early hacker community. While classic phreaking techniques are largely obsolete, modern variants target VoIP systems, SS7 networks, and cellular provider infrastructure to intercept calls, redirect two-factor authentication SMS codes, or conduct toll fraud.

A virus that mutates its own code with each replication, changing its signature while preserving its function, specifically to evade signature-based antivirus detection. Metamorphic viruses take this further by rewriting their entire logic, not just encrypting the payload. Detecting polymorphic malware requires behavioral analysis and heuristic scanning rather than static signature matching. Forensic analysis of polymorphic infections often involves unpacking the virus in a controlled environment to identify its underlying function.

The process by which an attacker with limited access gains higher-level permissions, moving from a standard user account to local administrator, then to domain administrator or system-level access. Privilege escalation exploits misconfigurations, unpatched vulnerabilities, weak service account credentials, and overly permissive Group Policy settings. Forensic examiners document privilege escalation by reviewing security event logs for unusual account activities, token manipulation events, and unexpected changes to group membership.

Software designed to maintain access while hiding activity from users, administrators or security tools. Kernel-mode rootkits operate within the operating system's kernel; bootkits and firmware implants act at other layers. Concealment may affect processes, files, connections or registry data. Examiners compare trusted acquisition results, memory and other independent artifacts because a compromised operating system may return misleading information.

An inexperienced attacker who uses pre-written tools, exploit scripts, and automated frameworks without understanding the underlying technical mechanisms. While script kiddies are unsophisticated, they cause real harm by deploying tools that were designed by skilled actors. Many ransomware incidents and web defacements are carried out by script kiddies using commodity exploit kits. The lack of technical sophistication can sometimes actually make attribution harder, since there are fewer distinctive techniques to identify.

The manipulation of people rather than technology to obtain unauthorized access to information, systems, or facilities. Social engineering exploits human psychology, including trust, authority, urgency, and fear, more reliably than most technical attacks. Pretexting (creating a false identity), vishing (voice phishing), baiting (leaving infected USB drives), and tailgating (following authorized personnel into secured areas) are all social engineering techniques. In legal proceedings, establishing that an organization's staff were deceived rather than negligent can be critical to liability determinations.

Unsolicited bulk electronic messages, commonly delivered through email or messaging services. Some campaigns distribute phishing, malware or fraud. Available headers can describe recorded relays, but fields may be missing or forged and do not necessarily reveal an originating botnet, device or person. Correlate provider, account and delivery records before attributing a campaign.

NIST forensic-method guidance (opens in a new tab)

The falsification of identifying information in a communication, such as an email sender address, IP address, caller ID, GPS coordinates, or website URL, to deceive recipients into believing the communication comes from a trusted source. Email spoofing is foundational to business email compromise (BEC) fraud. Forensic analysis of spoofed communications focuses on examining headers, authentication records (DMARC, SPF, DKIM), and network logs to distinguish the claimed source from the actual origin.

Software used to monitor device activity and collect information without appropriate authorization. Capabilities may include keystroke capture, screenshots, location tracking or access to microphones and cameras. In corporate espionage and unauthorized-access matters, forensic analysis examines installation artifacts, permissions, captured records and possible transmission destinations. Scope and lawful access must be established before collection.

A vulnerability in which untrusted input alters a database query or command. Depending on the application and permissions, exploitation can expose or change records or affect other functions. Enabled and retained application, database and web logs may show requests and execution. Their fields, filtering, redaction and retention can limit exact-query and accessed-data conclusions; validate important findings against the available sources.

NIST forensic-method guidance (opens in a new tab) · OWASP SQL injection guidance (opens in a new tab)

An attack that targets a less-secure element in an organization's supply chain, such as a software vendor, managed service provider, or hardware manufacturer, to gain access to the ultimate target. The SolarWinds incident, in which malicious code was injected into a software update trusted by thousands of organizations, is the defining example. Supply chain attacks are particularly difficult to detect because the malicious component arrives through a trusted update or delivery channel. Forensic analysis must trace the intrusion back to its origin in the supply chain rather than assuming the organization's own perimeter was breached directly.

A variant of a logic bomb that triggers based on a specific date or time rather than another condition. Time bombs have been used by software vendors to disable unlicensed software, but are more dangerously employed by malicious insiders to cause damage at a predetermined future date, often after the perpetrator has left the organization. Forensic examination of scheduled tasks, cron jobs, and time-based conditional code is standard practice when a time bomb is suspected.

Malicious software presented as a legitimate application or component. A trojan does not need to replicate itself, and delivery can involve a user action, another malware component or a compromised software channel. Its payload may steal data, install a back door or provide remote access. Examiners use file metadata, hashes, execution records and controlled behavioral analysis to assess what it did.

Malicious code that replicates by attaching to another executable object, such as a program or boot area. Replication requires execution of infected code, which may be triggered by a user or an automated process. This differs from a standalone network worm. Examiners compare file content, execution history and behavioral evidence to assess spread and impact.

The practice of driving or walking through an area with a Wi-Fi-enabled device to identify and map wireless networks, typically for the purpose of finding unsecured access points to exploit. Data collected during wardriving can include network names, encryption types, and GPS coordinates. The term now extends to any mobile scanning of wireless networks; warwalking and warbiking are common variants. Evidence of wardriving software on a device can be forensically significant in cases involving unauthorized network access.

An attack that compromises a site or service used by an intended group to create an opportunity for malicious delivery or redirection. A visit does not alone establish infection. The result depends on the exploit, device state and interaction, and must be tested against available device, network and provider evidence. A technique similarity does not establish a shared actor.

NIST incident-response guidance (opens in a new tab) · MITRE drive-by compromise (opens in a new tab)

A security professional who uses hacking techniques with explicit authorization to identify and remediate vulnerabilities before malicious actors can exploit them. White hat activities include penetration testing, vulnerability assessments, and bug bounty research. Their findings are documented and disclosed to the organization rather than exploited. Engagement letters and scoping agreements are essential to establishing the legal authorization that distinguishes white hat work from criminal conduct.

Self-replicating malware that spreads across networks without requiring user interaction or a host file, exploiting vulnerabilities in network services to copy itself from machine to machine. Worms consume bandwidth and system resources in addition to whatever malicious payload they carry. The WannaCry and NotPetya incidents demonstrated how a single worm can propagate across hundreds of thousands of systems in hours, causing billions of dollars in damages. Network traffic logs, firewall records, and endpoint detection data are used forensically to trace worm propagation paths.

A vulnerability exploited before an effective fix or established defensive response is available, commonly before the vendor or defenders know about it. Vendor awareness, disclosure, exploitation and patch availability can occur on different dates. Analysis therefore relies on the actual timeline and observed behavior rather than assuming that every zero-day lacks all detection coverage.

A compromised computer that is remotely controlled by an attacker and used to carry out attacks or transmit spam without the knowledge of its owner. Zombies are the individual nodes that make up botnets. The owner of a zombie device is typically an innocent victim who unknowingly contributes to attacks against others. Forensic analysis of a suspected zombie device focuses on identifying the malware responsible, the C2 server it communicates with, and what actions were taken using the device's resources.

The study of attacks on machine learning systems and the defenses against them. Attacks may target training data, model parameters, inference inputs, system integrations or private information exposed through outputs. Some input perturbations are difficult for people to notice, but imperceptibility is not required. Testing should state the attacker's access, objective, capabilities and the limits of the assessment.

Systematic errors in AI model outputs caused by biased training data, flawed model design, or unrepresentative sampling. AI bias can result in discriminatory outcomes in hiring, lending, law enforcement, and medical diagnosis. In litigation, AI bias has become a significant legal issue under anti-discrimination statutes. Forensic analysis of AI systems can document the training data composition, model architecture decisions, and output patterns that give rise to biased results.

Policies, responsibilities and controls for managing an AI system through its lifecycle. Documentation, testing, monitoring and human oversight should match the system’s use and risk. Legal duties vary by jurisdiction, sector and use case; a voluntary risk framework is not a blanket legal requirement or proof of compliance.

The generation by a large language model or other generative AI system of confident, plausible-sounding but factually incorrect or entirely fabricated content. Hallucinations arise from the statistical nature of language model training and are not a sign of deliberate deception by the model. In legal and forensic contexts, AI hallucinations in submitted documents or expert analyses have led to sanctions and disciplinary actions, underscoring the need for human verification of all AI-generated content used in proceedings.

An attack targeting the development pipeline of an AI system, including training data repositories, pre-trained model weights, ML libraries, or model hosting infrastructure. By compromising an upstream component, an attacker can introduce vulnerabilities or malicious behaviors into AI systems used by many downstream organizations. The attack vector is analogous to traditional software supply chain attacks but uniquely difficult to detect because the malicious behavior may only manifest under specific input conditions.

An attack that alters a model's learned behavior through malicious training contributions, parameter changes or a compromised training process. Data poisoning targets the training data; model poisoning can target weights or updates directly. Effects can include degraded accuracy, biased outputs or trigger-dependent behavior. Review requires data provenance, model-version records and evaluation of the affected training and deployment stages.

Authorized adversarial testing of an AI system under defined access, objectives and conditions. Findings should record the system and model versions, prompts, connected tools, attempts and observed outputs. It is one component of evaluation and does not prove safety in every context. Whether testing is legally required depends on the applicable use and jurisdiction.

A situation in which an AI system pursues goals or produces outputs that do not reflect the values, intentions, or constraints specified by its designers or operators. Alignment failures range from minor misinterpretations of user instructions to potentially dangerous autonomous actions. In high-stakes applications such as autonomous vehicles, medical diagnostics, and critical infrastructure control, alignment failures have direct safety implications. Documenting alignment failures is an emerging area of AI forensics.

The use of language models, voice synthesis or automation to produce deceptive messages and impersonation attempts at scale. These tools can personalize phishing and vishing, but writing style alone cannot reliably establish AI authorship. Examiners prioritize message headers, account records, delivery infrastructure, audio provenance and independent evidence of the sender's actions.

A weapon system that uses artificial intelligence to select and engage targets without human intervention. Autonomous weapon systems raise profound legal and ethical questions under international humanitarian law, including questions of accountability when the system causes unlawful harm. From a cybersecurity standpoint, these systems are attack targets: compromising the AI component of an autonomous weapon could cause it to misidentify or attack unintended targets.

The deliberate injection of corrupted, mislabeled, or manipulated data into training datasets to degrade the performance of a machine learning model or introduce specific vulnerabilities. The poisoned data corrupts the model when it is ingested during training, causing degraded accuracy or introducing hidden backdoors that an attacker can trigger later. Defenders counter data poisoning through data provenance tracking, anomaly detection during training, and outlier-resistant statistical techniques that reduce the influence of outlying data points.

Synthetic media, typically video or audio, in which a person's likeness, voice, or words are replaced or fabricated using deep learning techniques such as generative adversarial networks. Deepfakes are used for fraud (including CEO impersonation in wire transfer scams), disinformation, non-consensual intimate imagery, and evidence fabrication. GDF's forensic analysis of suspected deepfakes examines pixel-level artifacts, facial landmark inconsistencies, audio spectral anomalies, and metadata to assess authenticity. Courts are increasingly confronted with deepfake evidence challenges.

An adversarial attack that crafts inputs to fool a deployed machine learning model into misclassification, without modifying the model itself. Evasion attacks are inference-time attacks, meaning they occur when the model is being used rather than when it is being trained. Classic examples include adding imperceptible noise to images to cause image classifiers to fail, or modifying malware code to evade ML-based antivirus engines while preserving malicious functionality.

Methods intended to help people understand an AI system’s outputs or behavior. An explanation may be approximate or limited and should be checked against the actual model and decision context. Explainability does not by itself establish accuracy, fairness or compliance; any legal explanation requirement depends on the applicable jurisdiction and use.

A class of neural network architecture consisting of two models, a generator and a discriminator, that compete against each other to produce increasingly realistic synthetic content. GANs were the dominant technology behind early deepfake systems and synthetic image generators, though diffusion models have largely supplanted them in modern synthetic media tools. They are also used legitimately in drug discovery, image enhancement, and data augmentation. From a security standpoint, GANs enable creation of synthetic faces, documents, and audio that may be used to defeat biometric authentication or fabricate evidence.

A technique for bypassing the safety guidelines and content filters built into a large language model (LLM) by crafting inputs that cause the model to produce content it is designed to refuse, such as instructions for creating weapons, malware, or harmful content. Jailbreaks exploit the tension between model helpfulness and safety guardrails. They are documented through AI red team exercises, and new jailbreak techniques are continuously discovered as models evolve and safety measures are updated.

An attack that attempts to estimate whether a particular record was used to train a model. Results depend on model access, the method, the task and false-positive or false-negative risk. A positive inference is not automatically proof of membership. Testing should document the attacker’s access, comparison data and validation limits; legal and privacy consequences depend on the actual facts and applicable requirements.

NIST adversarial machine learning taxonomy (opens in a new tab)

An attack in which an adversary queries a machine learning model's API extensively to reconstruct a functional replica of the model without access to its internal parameters or training data. The extracted model can then be used to craft more effective adversarial attacks or stolen as intellectual property. Model extraction attacks raise trade secret and IP protection questions for organizations that have invested significant resources in proprietary AI model development.

An attack that attempts to infer sensitive features or representative inputs from a model’s behavior or outputs. Depending on the model and access, reconstructed material may reveal patterns or approximate characteristics. It need not reproduce an actual training record or identify a particular individual. Evaluation should state the information available to the attacker, method, validation and uncertainty.

NIST adversarial machine learning taxonomy (opens in a new tab)

A hidden vulnerability embedded in a neural network during training that causes the model to behave normally under standard inputs but produce attacker-specified outputs when a particular trigger pattern is present in the input. Neural backdoors are a form of model poisoning and are extremely difficult to detect through normal model evaluation, since the model appears to perform correctly until the trigger is activated.

An attack against large language model-based applications in which malicious instructions are embedded in user-controlled input, causing the model to override its system instructions and take unintended actions. In agentic AI systems that can execute code, browse the web, or send emails, prompt injection can lead to unauthorized data exfiltration or system compromise. Prompt injection is among the most critical vulnerabilities in LLM-integrated applications and is listed in the OWASP Top 10 for LLMs.

The use of AI tools by employees without the knowledge or approval of their organization's IT and security teams. Analogous to shadow IT, shadow AI creates risks including the exposure of confidential or regulated data to third-party AI providers, intellectual property loss, and the use of unapproved and unvetted AI outputs in business decisions. Organizations are increasingly discovering shadow AI usage through data loss prevention tools and network traffic analysis.

Fraud that combines real and fabricated personal information into a fictitious identity. It may be used to open accounts, obtain credit or defeat identity checks. Generative tools can help fabricate supporting documents or media. Real people can still be harmed when their identifiers are reused, and lenders may not initially recognize the account as synthetic. Analysis correlates application records, documents, devices and transaction history.

An attack on a pretrained model or its adaptation process that seeks to influence downstream behavior. A backdoor or other weakness in a base model may survive fine-tuning, but propagation is not inevitable and depends on the task, training and defenses. Review should cover model provenance, integrity checks, training data, updates and deployment-specific testing.

The use of AI to generate a synthetic replica of a specific person's voice from a small sample of audio, capable of saying anything the attacker specifies. Voice clones are used in vishing attacks, CEO fraud, and the generation of fake audio evidence. Audio forensic analysis can sometimes detect voice cloning through spectral analysis, prosody examination, and comparison with known authentic recordings, though detection is increasingly challenging as synthesis quality improves.

A special-use domain for Tor onion services. A version 3 onion address has a 56-character base32 label encoding a public key, checksum and version byte. Onion services conceal network locations and support both legitimate privacy-sensitive publishing and criminal activity. An onion address or Tor artifact is a lead for further analysis, not proof of unlawful conduct.

A dark web market offering in which initial access brokers sell authenticated access to compromised corporate networks, including VPN credentials, remote desktop sessions, and webshell access. Buyers typically use this access to deploy ransomware or conduct further intrusion. The existence of access-as-a-service listings for a specific organization is a critical threat intelligence indicator that warrants immediate incident response action. Prices range from a few hundred dollars to tens of thousands depending on the value and privilege level of the access sold.

Web hosting services operated in jurisdictions with weak cybercrime laws or corrupt enforcement, specifically designed to ignore takedown requests from law enforcement and abuse complaints from victims. Bulletproof hosting providers knowingly host phishing pages, malware distribution servers, C2 infrastructure, and child exploitation material. They are a foundational infrastructure element for cybercriminal operations globally. Attribution of cybercrime often requires tracing C2 infrastructure back through bulletproof hosting providers to underlying operators.

Distribution of distinguishable versions of information to help investigate a later disclosure. A match may indicate which version reached another channel, but does not alone identify the person responsible: forwarding, shared access or another copy can change that inference. Document version assignment, authorized recipients, access and capture history, and assess corroborating evidence within lawful scope.

NIST forensic-method guidance (opens in a new tab)

A service that pools cryptocurrency from multiple sources and redistributes it to make blockchain transaction tracing difficult, serving as a money laundering mechanism for ransomware proceeds, dark web market revenue, and other illicit crypto flows. Blockchain analytics firms and law enforcement have developed techniques to de-mix tumbled transactions, and several major mixing services have been seized by the FBI and Europol. Financial forensics involving cryptocurrency increasingly requires specialized blockchain analysis tools and expertise.

The portion of the internet accessible only through specialized anonymizing software such as Tor or I2P, not indexed by standard search engines and not accessible through ordinary browsers. The dark web encompasses a range of activity, from privacy-conscious communications to criminal marketplaces for stolen data, drugs, weapons, and cybercrime services. Organizations monitor the dark web for their own stolen credentials, data, and internal documents as part of threat intelligence programs. GDF assists attorneys and corporate clients in dark web monitoring and evidence collection for litigation.

An online market operating on the Tor network where buyers and sellers transact in stolen data, malware, drugs, counterfeit documents, and criminal services using cryptocurrency. Notable examples have included Silk Road, AlphaBay, and Hansa, all of which were shut down by law enforcement. Dark web marketplaces operate with feedback systems, dispute resolution, and escrow services, mirroring legitimate e-commerce. Evidence from dark web marketplace transactions has been used in numerous federal criminal prosecutions.

A method of communication in which parties exchange information without direct contact, traditionally using physical locations in espionage but adapted to digital contexts as a covert channel. Digital dead drops may use draft email folders shared between accounts, steganographically hidden messages in image files, or covert data embedded in cloud storage. Forensic identification of dead drop communications requires examining access logs, draft folders, and file modification timestamps across multiple accounts.

In the context of dark web marketplaces, a system in which a trusted third party holds cryptocurrency payment until the buyer confirms receipt of purchased goods or services, reducing fraud between criminal actors. Legitimate digital escrow exists in legal e-commerce and software licensing contexts. Forensic examination of dark web escrow transaction records can establish the financial relationship between criminal actors and the timing of illicit transactions.

The public disclosure of an individual's private personal information, including home address, employer, family members, and financial details, without consent and typically with intent to harass, intimidate, or facilitate physical harm. Doxing is used as a harassment tool, a coercion mechanism against whistleblowers and journalists, and as precursor to "swatting" (calling in false emergency reports to a victim's address). Doxing activity leaves digital traces including forum posts, search queries, and data broker account records that are amenable to forensic analysis.

A fraud scheme common in dark web marketplaces in which the marketplace operators or vendors accumulate funds in escrow or customer deposits, then disappear with the funds without delivering purchased goods or services. Exit scams have resulted in losses of tens of millions of dollars from dark web marketplace users. They illustrate the fundamental trust problem in criminal ecosystems: the same anonymity that protects criminals from law enforcement also prevents them from reliably enforcing agreements with each other.

An anonymizing network overlay that routes traffic through a series of encrypted tunnels to provide privacy and resist traffic analysis. Unlike Tor, which is primarily used to access the public internet anonymously, I2P is optimized for internal network services (hidden services, messaging, file sharing). I2P is used by some threat actors as an alternative to Tor for C2 communications and dark web services, making it relevant in network forensic analysis of advanced threat actors.

A threat actor who specializes in breaching organizations and selling the resulting network access to other criminal groups rather than exploiting it directly. IABs have become a distinct and important role in the ransomware supply chain, enabling ransomware operators to focus on deployment and extortion while outsourcing the technical work of gaining initial access. Identifying whether an IAB was involved in a breach changes the scope of the forensic examination and may affect attribution.

An individual who transfers illegally obtained funds on behalf of a criminal organization, typically retaining a percentage as payment. Money mules are often recruited through work-from-home scams and may not initially understand they are participating in fraud. They serve a critical role in laundering proceeds from phishing, romance fraud, business email compromise, and ransomware attacks. Bank transaction records, email communications, and wire transfer logs are the primary forensic artifacts in money mule examinations.

A service for sharing text, often through public or restricted links. Such services have legitimate uses and can also host stolen material, malicious code or extortion messages. A preserved post can support when material was publicly available, subject to the reliability of its timestamps and capture. Publication does not establish when or how it was exfiltrated, and a copied post does not identify the person who obtained the underlying data.

NIST forensic-method guidance (opens in a new tab)

A criminal business model in which ransomware developers license their malware and supporting infrastructure to affiliates who conduct attacks and share a percentage of ransom payments with the developers. RaaS has transformed ransomware from a niche attack into an industrialized criminal enterprise, enabling even technically unsophisticated actors to deploy sophisticated ransomware. Major RaaS groups include LockBit, BlackCat/ALPHV, and Clop. Forensic examination of a RaaS attack must distinguish affiliate activity from developer activity to properly attribute the intrusion.

Databases of credentials, cookies, browser history, and financial data harvested by information-stealing malware such as Redline, Raccoon, and Vidar, and sold or distributed on dark web forums and Telegram channels. Stealer logs have become one of the primary sources of initial access for threat actors, supplying credentials for credential stuffing attacks and initial access broker listings. A corporate device appearing in publicly circulating stealer logs is a significant indicator of compromise requiring immediate forensic response.

A privacy network that routes internet traffic through a series of volunteer-operated relay nodes, wrapping the traffic in multiple layers of encryption before transmission so that each relay decrypts only one layer and learns only the previous and next hop, meaning no single node knows both the origin and destination. Tor is used by journalists, activists, law enforcement, and privacy-conscious individuals for legitimate purposes, as well as by criminals to obscure their location and identity. The presence of Tor browser artifacts on a device is forensically significant and may indicate dark web activity, though it does not by itself prove criminal conduct.

An online community, typically operating on the dark web or in encrypted channels, where cybercriminals share techniques, tools, and services, buy and sell stolen data, and recruit collaborators. Major Russian-language underground forums such as XSS, Exploit.in, and RaidForums (now defunct) have served as hubs for sophisticated criminal activity for decades. Law enforcement agencies monitor underground forums for threat intelligence, and posts from specific forums are frequently presented as evidence in criminal prosecutions.

A periodically published statement about whether a provider has received a specified category of government demand. A missing or changed statement can have multiple explanations and is not reliable proof that a demand was received. Disclosure restrictions and the legal treatment of canaries vary. Counsel should assess a particular notice and its legal context.

Techniques that destroy, obscure or alter potential digital evidence, including log clearing, timestamp manipulation, secure deletion and concealment. Encryption and deletion also have legitimate uses. Examiners document the mechanism, timeline and available context without treating the presence of a tool as proof of intent, spoliation or guilt. Legal conclusions depend on the facts and applicable standards.

Examination of retained digital records such as registry entries, file-system metadata, browser history and event logs to test events or explanations. Each source has its own meaning, version dependencies and retention limits. Correlation can support a chronology, while missing records, source changes and alternative explanations must remain visible. The available artifacts do not necessarily provide a complete account of every action.

NIST forensic-method guidance (opens in a new tab)

A copy of the readable, addressable data within a defined acquisition scope, commonly a sector-level disk image. It can preserve allocated data, metadata and readable unallocated space, but does not guarantee recovery of every deleted file, inaccessible area or data already removed by TRIM. Examiners document source protection, read errors, acquisition scope and hash verification. A forensic image file and a directly usable disk clone are distinct outputs.

The documented, unbroken sequence of possession, control, transfer, and analysis of evidence from the moment of collection to its presentation in a legal proceeding. A gap or irregularity in chain of custody documentation gives opposing counsel grounds to challenge the admissibility and integrity of evidence. GDF maintains meticulous chain of custody documentation for every piece of evidence it handles, including signed receipts, transfer logs, storage location records, and access controls.

Lockheed Martin's adaptation of the military kill chain concept to cybersecurity, describing seven phases of a cyberattack: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. The model provides a structured framework for understanding how attacks progress and where defenders can interrupt them. Post-incident forensic analysis frequently maps observed attacker activity to kill chain phases to communicate the attack narrative to executives, attorneys, and insurers.

Examination of a powered-off device using data retained on non-volatile storage. This avoids changes from a running operating system but does not preserve RAM, live connections or in-memory keys. Powering off can make encrypted data inaccessible. The choice between live and powered-off acquisition depends on evidence priorities, safety, encryption, authority and the specific device.

A threat intelligence framework that models every intrusion event as having four core features: adversary, infrastructure, capability, and victim, connected at the vertices of a diamond. The model enables analysts to pivot from any known feature to discover related information about the others, facilitating threat actor attribution and pattern recognition across multiple incidents. The Diamond Model is particularly useful for structured analytic products used in intelligence sharing and litigation support.

Creating a documented forensic copy of a defined data source. Acquisitions may be physical, logical, targeted or live, depending on the device, authority and available access. Raw images and containers such as E01 or AFF4 have different structures. Write protection is used where appropriate; unavoidable changes and read errors are recorded. Hashes and acquisition logs support integrity checks but do not alone determine admissibility.

The intentional or negligent destruction, alteration, concealment, or failure to preserve evidence that is known to be relevant to anticipated or ongoing litigation. Courts have broad authority to sanction spoliation, ranging from adverse inference instructions to default judgment. In digital matters, common acts of spoliation include reformatting drives, running file shredders, deleting emails after a litigation hold should have been in place, and allowing automated deletion policies to continue running after a preservation obligation arose. Forensic analysis can often detect that spoliation occurred even when the underlying data is gone.

A forensic technique that recovers files from unallocated disk space by identifying known file headers and footers within raw data, without relying on file system metadata. When files are deleted, the file system entry is removed but the underlying data often remains until overwritten. File carving can recover images, documents, video fragments, and database records even from formatted or partially overwritten drives. Tools such as Foremost, Scalpel, and Magnet AXIOM perform file carving as part of full forensic examinations.

The initial procedures for documenting a digital incident, protecting evidence and recording custody. Actions depend on safety, authority, encryption and the operating environment. A qualified responder may capture volatile information before shutdown, but doing so changes the running system and must be documented. There is no universal instruction to power off, leave running or execute collection tools on every device.

The process of correlating timestamps from multiple sources, including file system metadata, event logs, registry hives, browser history, and network logs, to construct a chronological narrative of events on a system or across a network. Timeline analysis is essential for establishing when an intrusion began, when specific actions were taken, and how events relate to each other across multiple devices and accounts. In litigation, a well-constructed forensic timeline is one of the most persuasive forms of digital evidence because it tells a coherent story supported by multiple independent data sources.

A fixed-length digest computed from data, often displayed in hexadecimal. Suitable cryptographic hashes, such as SHA-256, support integrity comparisons and known-file matching; collisions are mathematically possible, so a hash is not a complete chain of custody. MD5 and SHA-1 have known cryptographic weaknesses. NIST's NSRL catalogs known software files, not illicit imagery. Specialized authorized databases serve other identification purposes.

A documented set of procedures that specifies how an organization will detect, contain, eradicate, recover from, and learn from security incidents. An effective incident response plan defines roles and responsibilities, communication trees, evidence preservation procedures, regulatory notification timelines, and criteria for engaging outside forensic and legal counsel. Organizations without a tested incident response plan routinely make evidence-destroying mistakes in the chaotic early hours of a breach.

Evidence collection from a running system, including memory, processes, connections and accessible decrypted data. Collection changes some system state, so the method, tools and timing must be documented. A running device may expose keys or decrypted volumes that become unavailable after shutdown; recovery keys or other authorized access may also exist. Operational safety and evidence priorities determine the approach.

A principle from physical forensics that contact can produce trace evidence. Its digital analogy encourages examiners to look for related artifacts across devices and services. It is not a guarantee that every action leaves a recoverable record: logging may be disabled, records may expire, and activity may occur outside the acquired scope. Conclusions must reflect the evidence actually available.

Examination of acquired volatile memory to identify processes, connections, code and other artifacts present at acquisition. Memory may hold evidence of activity that uses few executable files, but such activity can also leave logs, registry or other persistent traces. Capture changes state and may be incomplete; findings need acquisition context and corroboration.

MITRE's knowledge base of observed adversary tactics, techniques and procedures. It provides a shared vocabulary for incident analysis and selected attack simulations. Mapping supported findings to ATT&CK can explain observed behavior, but the mapping alone does not establish the actor's identity, intent or sophistication. ATT&CK is not a required sequence of testing steps.

The capture, recording, and analysis of network traffic and related logs to detect intrusions, reconstruct communications, identify data exfiltration, and attribute attacks. Network forensics tools include full packet capture systems, NetFlow analyzers, DNS query logs, proxy logs, and SIEM platforms. Unlike endpoint forensics, network forensics provides a record of communication between systems, including when attackers are operating on devices they have not physically touched. Network forensic evidence is particularly important in cases involving remote access, data theft, and communication between co-conspirators.

A recording of packets observed at a capture point, commonly stored as PCAP or PCAPNG. Coverage depends on sensor placement, filters, capture length, dropped packets and retention. Encryption can hide application content even when headers and timing remain visible. Examiners document these limits before reconstructing communications, file transfers or suspected data movement.

Examination of Windows Registry configuration and activity artifacts, including user settings, device history and persistence mechanisms. Interpretation depends on the Windows version and artifact semantics. AppCompatCache and Amcache records, for example, are not universal proof that a program executed. Examiners correlate registry findings with event logs, file metadata and other independent evidence.

The area between a file's logical end and the end of its allocated storage unit. It may contain padding or residual bytes, depending on the file system and write behavior. Recovery is not guaranteed. SSD TRIM primarily concerns deallocated ranges and should not be equated with automatic clearing of every live file's slack. Acquisition scope and storage-controller behavior affect what can be examined.

The practice of hiding data within other, innocuous-appearing data, such as concealing a text file within the pixel data of an image, an audio file, or a video. Unlike encryption, which makes data unreadable, steganography conceals the very existence of the hidden data. Attackers use steganography to exfiltrate data covertly, embed malware instructions in benign-looking files, and conduct covert C2 communications. Steganalysis, the forensic detection of steganographic content, requires specialized tools and statistical analysis of carrier files.

A proactive security practice in which skilled analysts actively search for indicators of threat actor presence within an environment, rather than waiting for automated alerts. Threat hunters develop hypotheses based on threat intelligence and knowledge of attacker behavior, then test them by querying endpoint detection, network logs, and SIEM data. Threat hunting finds threats that evade automated detection and is particularly effective against APTs and living-off-the-land attacks. The findings of a threat hunt often initiate formal forensic examinations and incident response actions.

Evidence-based knowledge about existing or emerging threats, including attacker TTPs, indicators of compromise, targeting patterns, and actor motivations, used to inform defensive decisions. Threat intelligence is categorized as strategic (high-level trends for executives), operational (specific campaigns and actors for security teams), and tactical (IoCs for security tools). In litigation, threat intelligence reports can establish whether a threat was known and whether the victim organization's defenses were appropriate relative to the known threat environment.

A collection-planning principle that prioritizes evidence likely to change or disappear quickly, such as memory and running processes. NIST SP 800-86 and RFC 3227 discuss volatility alongside collection value and practical constraints. The plan must account for safety, authority, source condition and the effect of each collection step. Document why evidence was collected in a particular sequence and any sources that could not be preserved.

Hardware or software used to prevent host-issued writes to a source medium during supported acquisitions. Compatibility and validation matter, and some devices or live acquisitions do not permit conventional write blocking. Examiners document the method, tool state and any limitations. Write protection supports preservation but does not by itself establish admissibility or prevent all internal storage-controller activity.

Separation intended to prevent direct network connectivity between environments. Removable media, maintenance devices, temporary connections and other transfer paths can weaken the separation. Identify the actual paths and operating procedures rather than assume USB transfer is always the most common route or that a claimed air gap guarantees isolation.

The U.S. federal agency, established in 2018 under the Department of Homeland Security, responsible for protecting critical infrastructure from physical and cyber threats. CISA issues binding operational directives for federal agencies, publishes advisories about threats to critical infrastructure sectors, and coordinates with private sector owners of critical infrastructure on incident response and resilience. CISA's ICS-CERT (now merged into CISA) has been the primary government resource for OT/ICS vulnerability disclosures and incident response support.

Instructions used by PLCs, RTUs and related devices to control physical processes, including outputs, setpoints and interlocks. Languages include Ladder Diagram and Structured Text. Forensic review distinguishes application logic, firmware, configuration and operator changes, comparing each with an appropriate baseline. Collection must be coordinated with plant personnel so evidence work does not create a process or safety hazard.

A process control system in which control elements are distributed throughout the plant rather than centralized in a single location, connected by a high-speed communications network. DCS platforms are common in chemical plants, refineries, and power generation facilities where tight, continuous process control is required. Unlike SCADA systems, which gather data from remote field sites, a DCS is typically confined to a single facility. DCS cybersecurity is a specialized discipline due to the real-time constraints, proprietary protocols, and catastrophic consequences of failure in process industries.

Distributed Network Protocol 3 is used in utility and other control-system communications. Legacy implementations and secure-authentication capabilities differ. Assess the deployed version, configured controls and permitted command paths with the operator. Do not infer a measured adoption rate, usable attack path or safe testing permission from the protocol name.

A human-machine interface displays process information and may let an operator issue commands. The exposure created by compromise depends on its configured role, permissions, connections and process safeguards. It does not automatically give every attacker all operator control. Examination or testing must respect the operator’s safety and authorization limits.

An industrial time-series source that retains selected process measurements, states and events under the deployed configuration. Recording intervals, aggregation, clock settings and retention affect coverage. Available records may help compare a process deviation, alarm or operator action with other evidence, but do not describe every condition at every moment or establish that a cyber event caused the deviation.

NIST forensic-method guidance (opens in a new tab) · NIST OT security and logging guidance (opens in a new tab)

A broad category of control systems used to monitor and control industrial processes, encompassing SCADA systems, DCS, PLCs, RTUs, and other automation technologies deployed in energy, water, manufacturing, transportation, and other critical sectors. ICS security has become a national security priority as these systems, originally designed for isolation, are increasingly networked and exposed to cyber threats. A cyberattack on ICS can cause physical damage, environmental harm, and loss of life, making ICS forensics a specialized and high-stakes discipline.

Communication protocols designed for use in industrial control environments, including Modbus, DNP3, PROFIBUS, EtherNet/IP, IEC 61850, and OPC-UA. Most traditional industrial protocols were designed for reliability and determinism rather than security, lacking authentication, encryption, or integrity verification. Network forensics in OT environments requires knowledge of these protocols to distinguish normal operational traffic from attacker-generated commands, since the same protocol used by operators is used by attackers who have gained access to the OT network.

A graphical programming language used to program PLCs, based on relay logic diagrams used in early factory automation. Ladder logic remains the most widely used PLC programming language in North American manufacturing and utility industries. Forensic analysis of ladder logic programs requires OT-specific expertise: examiners compare the current PLC program against a known-good baseline to identify unauthorized modifications that could alter physical process behavior, open or close valves, or disable safety interlocks.

An industrial communications protocol family originally developed by Modicon. Traditional Modbus serial and TCP deployments do not inherently authenticate commands or encrypt traffic. Modbus Security adds TLS-based protections, but actual protection depends on the devices and configuration deployed. Analysts examine commands, register changes and network access controls in the process context, with operations approval before active testing.

Hardware and software that detects or causes changes in physical processes through direct monitoring and control of physical devices, processes, events, and infrastructure, as distinguished from information technology (IT) which processes and stores information. OT includes PLCs, DCS, SCADA systems, RTUs, and safety instrumented systems deployed in utilities, manufacturing, oil and gas, and transportation. The convergence of OT and IT networks has created new attack surfaces and requires security approaches that account for OT's unique real-time, availability-first operational requirements.

A ruggedized industrial computer designed for real-time control of machinery and processes in manufacturing, utility, and infrastructure environments. PLCs execute control logic programs continuously, reading inputs from sensors and issuing outputs to actuators based on programmed logic. Stuxnet's targeting of Siemens S7-series PLCs demonstrated that PLC firmware and programs are realistic attack targets with potentially catastrophic physical consequences. Forensic examination of PLCs requires specialized hardware connections and vendor-specific software tools to read and analyze programs and execution logs.

A hierarchical reference architecture for industrial control systems, originating from the Purdue Enterprise Reference Architecture, that defines six levels of an industrial enterprise from physical processes (Level 0) through intelligent devices (Level 1), control systems (Level 2), site operations (Level 3), business logistics (Level 4), and enterprise networks (Level 5). The Purdue Model is widely used to define network segmentation requirements in ICS environments and guides the placement of security controls at boundaries between levels. Understanding the Purdue Model is essential for forensic examiners analyzing how attackers moved from IT networks into OT environments.

A field device used in SCADA systems to collect data from sensors and instruments at remote locations and transmit it to the central SCADA master station, while also relaying control commands from the master to local actuators. RTUs are deployed at geographically distributed sites such as substations, pump stations, and wellheads. Because RTUs often operate in remote, physically unmonitored locations, physical security and secure communications protocols are both important considerations for protecting them from tampering.

Supervisory systems that monitor and control distributed processes using telemetry from devices such as PLCs and RTUs. Operators use SCADA displays and commands to supervise field operations. A compromise can affect availability, process integrity or safety. Analysis correlates network traffic, operator actions, alarms and control changes without assuming that a cyber event caused every observed process deviation.

An independent system designed to bring an industrial process to a safe state when predetermined conditions are exceeded, preventing catastrophic outcomes such as explosions, toxic releases, or equipment failure. The TRITON/TRISIS malware, discovered in 2017, specifically targeted Schneider Electric Triconex safety systems at a Middle Eastern petrochemical facility, with the apparent goal of disabling safety systems to enable a catastrophic incident. Attacks against SIS are considered among the most dangerous categories of ICS cyberattack.

A method for allocating IP addresses and routing internet traffic that replaced the older class-based addressing system, using a prefix notation (e.g., 192.168.1.0/24) to specify both the network address and the number of bits in the subnet mask. Understanding CIDR notation is necessary for interpreting firewall rules, access control lists, and network forensic evidence, since IP address ranges are frequently specified using CIDR in configuration files, threat intelligence feeds, and incident reports.

A network segment that sits between an organization's internal network and the internet, hosting publicly accessible services such as web servers, email servers, and DNS resolvers while isolating them from the more sensitive internal network. If a server in the DMZ is compromised, the attacker should face additional barriers before reaching internal systems. Forensic analysis of incidents involving internet-facing infrastructure frequently begins with an examination of DMZ systems, since they are the most exposed point of entry.

The distributed system that maps domain names to records such as IP addresses and mail-routing destinations. Resolver and endpoint logs can help identify malicious domains, suspicious lookups or possible DNS tunneling. Caching, encrypted DNS, alternate resolvers and retention gaps mean a log may not contain every lookup. A DNS query alone does not prove that an application successfully connected or transferred data.

The application of firewall rules or network controls to outbound traffic leaving an organization's network, blocking unauthorized connections from internal systems to external destinations. Egress filtering limits the ability of malware to communicate with C2 servers and reduces data exfiltration. Organizations that rely exclusively on perimeter ingress filtering while ignoring egress controls provide attackers who gain internal access with a wide-open path for data theft and C2 communication. Firewall logs showing unexpected outbound connections are often the first indicator of a compromise.

The process of transforming data into an unreadable format using a cryptographic algorithm and key, making it accessible only to parties who possess the correct decryption key. Encryption protects data in transit (using TLS/SSL) and at rest (using full-disk encryption or file-level encryption). In digital forensics, encryption presents both a challenge and an opportunity: encrypted devices may require legal process to compel decryption key disclosure, while the presence of encryption software on a suspect device may be forensically significant.

A decoy resource used to observe unexpected access or study behavior. Its configuration and placement determine what an interaction means. Administrative work, monitoring, authorized tests and automated scanning must be distinguished from malicious activity. Preserve the configuration, relevant events and handling record; interaction alone does not prove an attack or the identity or intent of a visitor.

NIST incident-response guidance (opens in a new tab) · NIST glossary: honeypot (opens in a new tab)

Network or host-based systems that monitor traffic or system activity for signatures of known attacks or anomalous behavior. An IDS generates alerts; an IPS additionally blocks malicious traffic automatically. IDS/IPS logs are critical forensic artifacts: they record detection events, timestamps, source and destination IP addresses, and the specific rule or signature that fired, providing a contemporaneous record of attack activity. The absence of IDS/IPS alerts does not mean no attack occurred, since sophisticated attacks are frequently designed to evade signature-based detection.

A method in which a router maps multiple private IP addresses to a single public IP address, conserving public IP space and obscuring the internal network topology from external observers. NAT complicates forensic attribution because many devices sharing a single external IP address cannot be individually identified without internal NAT log records correlating the external connection to a specific internal device and time. Preserving NAT logs is a critical step in incident response and legal holds for network-related incidents.

The division of a network into smaller subnetworks with controlled access between them, limiting the spread of an intrusion and reducing the blast radius of a breach. Segmentation is implemented using firewalls, VLANs, and access control lists. Proper segmentation means that an attacker who compromises a workstation in accounting cannot directly reach OT systems or the finance server without passing through a security control that can detect and block lateral movement. Network topology documentation is essential both for security design and for forensic reconstruction of how an attacker moved through an environment.

The capture and analysis of network packets passing over a network, using tools such as Wireshark, tcpdump, or commercial network taps. Packet sniffing is used legitimately for network troubleshooting, performance monitoring, and forensic examination, and maliciously for credential theft, session hijacking, and reconnaissance. On switched networks, packet sniffing requires either access to a switch port mirror, a network tap, or the use of ARP poisoning to redirect traffic. Encrypted protocols limit the intelligence an attacker (or forensic examiner) can extract from captured packets.

A framework of policies, procedures, hardware, software, and digital certificates that enables secure electronic communications through public-key cryptography. PKI is the foundation of TLS/SSL, email signing (S/MIME), code signing, and document digital signatures. Certificate authority (CA) compromise, certificate mis-issuance, and improper certificate validation are significant security vulnerabilities in PKI. Forensic analysis of PKI involves examining certificate chains, certificate revocation status, and CA logs to authenticate digital signatures and detect certificate-based fraud.

An intermediary that forwards requests or connections and may provide caching, filtering or access controls. Forward and reverse proxies serve different positions in the communication path. Depending on configuration and protocol, retained logs may include addresses, destinations, times or volume. They need not contain every request, full encrypted content or a reliable human identity; analysis should state the actual fields and gaps.

NIST forensic-method guidance (opens in a new tab) · RFC 9110: HTTP intermediaries (opens in a new tab)

A platform that collects and correlates selected logs and generates alerts. It can be an important incident source, but coverage depends on connected systems, filtering, clock accuracy, retention and export capabilities. Compare its records with source-system inventories; it is not necessarily the most complete record available.

Transport Layer Security (TLS) and its predecessor Secure Sockets Layer (SSL) are cryptographic protocols that provide authentication, confidentiality, and integrity for network communications. TLS is the foundation of HTTPS and secures email, VPN, and many other protocols. Weaknesses in TLS configuration (outdated protocol versions, weak cipher suites, certificate validation failures) are common penetration testing findings. In forensics, TLS interception by a network security device, where permitted by policy, can provide visibility into otherwise encrypted traffic. All TLS versions below 1.2 are considered insecure.

A logical subdivision of a physical network, configured at the switch level, that separates broadcast domains and controls which devices can communicate directly without passing through a router or firewall. VLANs are a primary tool for network segmentation, separating user workstations, servers, guest Wi-Fi, and OT devices from each other. VLAN hopping attacks exploit misconfigured switch ports to gain access to VLANs beyond those intended. VLAN configuration documentation is reviewed during network forensic examinations to understand what network segments an attacker could have reached.

A virtual private network protects selected communications through a tunnel and may provide remote access. Stolen credentials or sessions can be an entry route, but this definition does not rank them against all other attack paths. Authentication and gateway records may support analysis, subject to available fields, retention and corroboration.

An approach that grants no implicit trust solely because a user or device is inside a network or owned by the organization. NIST SP 800-207 describes resource-focused access decisions based on authentication, authorization and the available security context. Access should be limited to the agreed resource and reevaluated under the organization's policy. A zero-trust architecture does not guarantee that every event is logged or every compromise is prevented.

A legal protection that may apply to confidential communications for obtaining or providing legal advice. Digital evidence can contain privileged material alongside ordinary business records. Involving an attorney does not automatically protect every forensic report or communication, and work-product protection is a separate issue. Counsel determines applicable privilege, review procedures and disclosure obligations; examiners support identification and controlled handling.

California's consumer privacy law, amended by the CPRA, gives qualifying residents rights concerning covered businesses' handling of personal information, subject to exceptions. These include access, correction, deletion and certain opt-out rights. A limited private right of action concerns specified security breaches and conditions; not every privacy violation qualifies. Breach-notification duties also arise under separate laws. Counsel determines applicability and response obligations.

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 directs CISA to establish reporting requirements for covered critical-infrastructure entities. The statute sets a framework for reporting covered cyber incidents within 72 hours and ransom payments within 24 hours. Applicability, definitions and implementation depend on the governing regulations and their effective dates. A glossary entry is not a determination that a particular organization or incident must report.

The Department of Defense's Cybersecurity Maturity Model Certification program assesses protection of specified federal contract information and controlled unclassified information. Requirements depend on the applicable contract, assessment level and program rules. Evidence may include configurations, access controls, assessment records and operating practices. A forensic review can document those facts but is not a substitute for an authorized CMMC assessment or certification.

The federal reliability framework associated with Daubert and later decisions, applied alongside Federal Rule of Evidence 702. The court evaluates whether proposed expert testimony satisfies the applicable requirements for helpfulness, factual support and reliable methods and application. Testing, error rates, peer review and acceptance can be relevant factors, not a universal checklist that guarantees admission. The court decides admissibility.

The process of identifying, preserving, collecting, processing, reviewing, and producing electronically stored information (ESI) in response to litigation, regulatory inquiries, or government examinations. ESI includes email, documents, databases, social media, text messages, cloud storage, and metadata. The Federal Rules of Civil Procedure govern eDiscovery in federal litigation, including requirements for proportionality, litigation holds, and the treatment of inaccessible data. GDF provides forensic collection and processing services for eDiscovery matters requiring specialized technical expertise.

A federal law protecting personally identifiable information in education records at covered educational agencies and institutions. It provides access and amendment rights and limits disclosure, with exceptions. FERPA does not itself impose a general parent-notification requirement for every data breach; other laws may require notice. Examiners document access and disclosure facts while the institution and counsel determine obligations.

Federal Rule of Evidence 902(14) addresses authentication of data copied from an electronic device, storage medium or file through a process of digital identification, supported by a qualified person's certification. Notice and inspection requirements also apply. It differs from Rule 902(13), which concerns records generated by electronic processes or systems. Self-authentication does not resolve hearsay, relevance or every other admissibility issue.

The EU General Data Protection Regulation governs personal-data processing within its material and territorial scope; it is not limited to citizenship or a simple residency test. Article 33 generally requires a controller to notify the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to create a risk to individuals' rights and freedoms. Separate duties and exceptions apply to processors and notification of individuals. Counsel evaluates applicability.

U.S. health-information rules applying to covered entities and business associates within their scope. The Breach Notification Rule concerns unsecured protected health information and includes exceptions and assessment requirements. Notification timing and recipients vary: individual notices generally have a 60-day outer limit, HHS reporting differs by breach size, and the media threshold concerns more than 500 residents of a state or jurisdiction. Technical findings support the legal assessment rather than determining it alone.

Critical Infrastructure Protection reliability standards addressing cybersecurity of covered bulk electric system assets and responsible entities. Requirements and applicability depend on the specific standard, asset categorization and jurisdiction. Evidence can include access records, configurations, change management and incident documentation. Compliance and enforcement conclusions require the applicable rules and responsible authorities, not a generic penalty figure.

NIST's Cybersecurity Framework organizes cybersecurity risk management. CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. Profiles and tiers help organizations describe current and target practices. The framework is not a certification or an automatic finding of legal compliance. An assessment should identify the version, outcomes and evidence evaluated.

The Payment Card Industry Data Security Standard covers protection of payment account data in applicable environments. Requirements address areas such as access, configuration, monitoring and vulnerability management. Following a suspected compromise, payment brands or acquiring institutions may require work by a PCI Forensic Investigator under their programs. That requirement is not automatic for every incident, and a general forensic assessment is not a PFI designation.

Developed by the American Institute of CPAs (AICPA), SOC 2 is a reporting framework for service organizations that evaluates controls relevant to security, availability, processing integrity, confidentiality, and privacy of customer data. SOC 2 Type II reports, covering an actual period of operation rather than a point-in-time snapshot, are routinely required by enterprise customers as evidence of their vendors' security controls. In litigation involving vendor breaches, SOC 2 reports and the underlying control documentation are frequently sought in discovery to assess what security commitments were made and whether they were met.

The Sarbanes-Oxley Act addresses public-company financial reporting and internal controls. Section 404 concerns management assessment of internal control over financial reporting, with external-auditor attestation requirements and exemptions depending on issuer status. Relevant technical evidence may include access, change-control and log-integrity records. Counsel and accounting professionals determine the applicable obligations.

Court-ordered measures addressing failures to preserve evidence under applicable law. Federal Rule of Civil Procedure 37(e) addresses electronically stored information that should have been preserved, was lost because reasonable steps were not taken, and cannot be restored or replaced. Curative measures and the more severe measures requiring intent to deprive have different conditions. Examiners document preservation and loss; the court determines consequences.

The use of unique biological characteristics, including fingerprints, facial geometry, iris patterns, voice, or behavioral traits, to verify a person's identity. Biometric systems are increasingly used for device unlocking, banking authentication, and border control. Unlike passwords, biometric data cannot be changed if compromised. The intersection of biometrics and law enforcement is significant: compelling a suspect to provide a fingerprint to unlock a device has been treated differently from compelling a password disclosure under the Fifth Amendment in some jurisdictions, though this area of law continues to evolve.

The collection of authentication credentials (usernames, passwords, API keys, tokens, certificates) through phishing, keylogging, memory scraping, or extraction from compromised systems. Harvested credentials are used directly for unauthorized access, sold to other threat actors, or fed into credential stuffing attacks against other services. Information-stealing malware (stealers) is one of the most prolific credential harvesting mechanisms, exfiltrating browser-stored passwords, session cookies, and autofill data from millions of compromised devices.

The framework of policies, processes, and technologies that manages digital identities and controls what resources each identity can access. IAM encompasses user provisioning, authentication, authorization, role-based access control, and audit logging. Weak IAM implementation, including excessive permissions, unmanaged service accounts, and lack of multi-factor authentication, is a root cause of many significant breaches. IAM logs, including provisioning events, authentication records, and access changes, are essential forensic artifacts in insider threat and unauthorized access examinations.

An attack in which service-ticket material is obtained and subjected to offline password-guessing attempts. Success depends on conditions including password strength and the available ticket encryption; requesting a ticket does not automatically recover a plaintext password. Supported authentication events and other records may help investigate attempts, subject to logging coverage.

Authentication using factors from different categories, such as knowledge, possession or inherence. Protection differs by method and recovery flow. Authentication logs can support analysis of prompts and sessions, but may not alone prove how access occurred or whether a factor was bypassed. Correlate available configuration, identity and endpoint records.

A framework for delegated authorization that allows an application to receive scoped access without learning the user's password. OAuth 2.0 is not itself an authentication protocol; OpenID Connect adds an identity layer. Malicious applications may abuse consent grants or tokens to access email and files. Reviewing grants, token use, application ownership and revocation is important because a password change may not revoke every authorization.

An attack technique that uses a captured password hash to authenticate to remote systems without needing to know the underlying plaintext password. Windows NTLM authentication is particularly vulnerable: once an attacker dumps credential hashes from memory (using tools like Mimikatz), those hashes can be used directly to authenticate across the network. Pass-the-Hash attacks are a staple of lateral movement in Windows environments and leave specific event log artifacts. Forensic analysis can often correlate hash reuse patterns to trace an attacker's path through an enterprise network.

Authentication without a conventional reusable password, using methods such as cryptographic authenticators or one-time links. These methods do not all provide the same phishing resistance. FIDO/WebAuthn passkeys are bound to a relying party and may be device-bound or synchronized across devices. Assessment should cover enrollment, recovery, synchronization, device protection and fallback methods.

An XML-based standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP), most commonly used for enterprise single sign-on. When a user authenticates to the IdP, a digitally signed SAML assertion is passed to the service provider granting access. The SolarWinds supply chain attack involved forging SAML tokens (a technique sometimes called "Golden SAML"), allowing attackers to impersonate any user to cloud services without triggering standard authentication alerts.

An arrangement allowing authentication at an identity provider to support access to connected applications. A compromised session or provider can expand access, but not necessarily to every application simultaneously. Application policy, session state, token scope and revocation behavior affect exposure. Identity and application records need to be examined together.

The theft of an authentication or session token for attempted reuse. Some valid tokens permit access without a new password or MFA prompt; replay depends on scope, expiry, revocation, binding and application controls. Microsoft’s August 2023 Midnight Blizzard report lists token theft among several initial-access approaches, not a universal explanation for every incident. Examine identity, application and endpoint evidence to test suspected reuse.