Cybersecurity Reference

Cybersecurity Glossary

Over 150 terms used by forensic analysts, security professionals, attorneys, and incident responders, defined clearly and placed in context. Use the search bar or alphabetical index to find any term.

Cybersecurity analyst reviewing threat intelligence data across multiple monitors

No terms match your search. Try different keywords or clear the filter.

A. Classic Cyber Threats

Classic Threats

Adware: Software that displays or delivers unsolicited advertising, typically bundled with free applications. Modern adware frequently crosses into spyware territory, tracking browsing habits, search queries, and geographic location without disclosure. In civil litigation, adware found on a device can raise questions about what other unauthorized software may have been installed and what data was collected from the user without their knowledge.
APT (Advanced Persistent Threat): Prolonged, targeted attack campaigns in which a threat actor gains access to a network and remains undetected for weeks, months, or years, systematically exfiltrating data or pre-positioning for sabotage. APTs are most often attributed to nation-state actors or well-funded criminal organizations. Forensic analysis of an APT intrusion typically involves reconstructing a detailed timeline of attacker movement through the environment, identifying every system touched, and cataloging all data accessed or removed.
Back Door: A hidden mechanism, either intentionally built into software by a developer or secretly installed by an attacker, that allows unauthorized access to a system while bypassing normal authentication. Back doors can persist across reboots and survive software updates if embedded deeply enough. Forensic examiners look for back doors during post-incident analysis by examining running processes, scheduled tasks, startup entries, and network connections to identify unauthorized persistent access channels.
Black Hat: A hacker who operates outside legal or ethical boundaries, typically for personal financial gain, espionage, or malicious disruption. The term derives from old Western films where villains wore black hats. Black hat actors may work independently, as part of organized crime groups, or on behalf of state sponsors, and the line between the three is increasingly blurred in modern cybercrime.
Bot: A compromised device running automated malware that accepts commands from a remote operator, often without any visible sign to the device's owner. Bots are the building blocks of botnets and are routinely recruited through drive-by downloads, phishing, or exploitation of unpatched vulnerabilities. A single bot infection can serve as the initial foothold for lateral movement throughout an enterprise network.
Botnet: Networks of compromised computers (bots) controlled by a threat actor through a command-and-control (C2) server or peer-to-peer protocol. Botnets are used to conduct distributed denial-of-service attacks, send spam at massive scale, mine cryptocurrency, steal credentials, and distribute additional malware. Modern botnets may number in the millions of devices and are leased out as a commodity on underground marketplaces. Forensic analysis of a botnet infection focuses on identifying C2 communication artifacts in network logs, browser history, and system memory.
Brute Force Attack: A method of gaining unauthorized access by systematically trying every possible password, PIN, or encryption key until the correct one is found. Modern brute force tools use GPU acceleration and pre-computed hash tables (rainbow tables) to crack passwords at billions of guesses per second. Authentication logs showing repeated failed login attempts followed by a success are a primary forensic indicator of a successful brute force attack.
Buffer Overflow: A vulnerability that occurs when a program writes more data to a memory buffer than it can hold, overflowing into adjacent memory regions and potentially overwriting control data such as return addresses. Attackers craft malicious input to redirect program execution to their own code (shellcode). Buffer overflow exploits have existed for decades but remain relevant in legacy software, embedded systems, and OT/ICS environments where patching is infrequent.
Command and Control (C2): The infrastructure a threat actor uses to send instructions to compromised systems and receive stolen data. C2 channels range from dedicated servers to legitimate cloud services, social media accounts, and encrypted messaging platforms, all chosen to blend into normal traffic. Identifying and documenting C2 infrastructure is a critical step in incident response, as it reveals the scope of a compromise and provides evidence of attacker intent. Network forensics tools such as packet captures and DNS query logs are essential for reconstructing C2 communication patterns.
Cookies: Small data files placed on a user's device by websites to retain session state, preferences, or tracking identifiers. While cookies have legitimate uses, session cookies can be stolen by cross-site scripting or man-in-the-middle attacks to hijack authenticated sessions without needing a password. In digital forensic examinations, browser cookie files are a rich source of historical data about sites visited, login times, and user identifiers, even after browsing history has been deleted.
Cracker: In security parlance, an individual who breaks into systems or bypasses software protections without authorization, as distinguished from a "hacker," whose original meaning referred to creative technical problem-solving. The term is also used for tools that crack encrypted passwords or bypass software licensing. Forensic examiners may encounter cracking utilities on suspect devices as evidence of intentional unauthorized access attempts.
Credential Stuffing: An automated attack that takes username and password pairs from previous data breaches and tests them against other services, exploiting the widespread habit of password reuse. Because the credentials are real and the login attempts appear legitimate, credential stuffing is difficult to detect without behavioral analytics. A successful credential stuffing attack does not require any technical exploitation of the target; the attacker simply authenticates normally using stolen data.
Cross-Site Scripting (XSS): A web application vulnerability in which an attacker injects malicious scripts into content served to other users' browsers. The victim's browser executes the script in the context of the trusted site, enabling cookie theft, session hijacking, keylogging, and redirection to phishing pages. XSS vulnerabilities frequently appear in source code reviews and are among the most commonly documented findings in web application penetration tests.
DNS Poisoning: Also called DNS cache poisoning or DNS spoofing, this attack corrupts the cache of a DNS resolver with false records, causing users who query that server to be directed to attacker-controlled IP addresses instead of legitimate ones. Victims typically see no visible warning. DNS poisoning is used to redirect banking customers to phishing sites, intercept email, and deliver malware to users who believe they are visiting trusted domains.
DoS (Denial of Service): An attack that makes a system, service, or network unavailable by overwhelming it with traffic or requests, or by exploiting a vulnerability that causes the target to crash. A DoS attack originates from a single source, as opposed to a DDoS attack which uses many. Network traffic logs, firewall records, and server access logs are the primary forensic artifacts used to document a DoS incident and attribute responsibility.
DDoS (Distributed Denial of Service): A denial-of-service attack launched simultaneously from thousands or millions of compromised devices (a botnet), making it far more difficult to filter and block than a single-source attack. DDoS attacks are sold as a service on the dark web for as little as a few dollars per hour and are used for extortion, competitive sabotage, hacktivism, and as a distraction while attackers conduct other intrusions. Forensic documentation of a DDoS attack involves preserving packet capture data, traffic flow records, and ISP logs in a manner suitable for civil litigation or regulatory reporting.
Drive-By Download: Malware delivery that occurs automatically when a user visits a compromised or malicious web page, without any deliberate action such as clicking a download link. The attack exploits vulnerabilities in browsers, browser plugins (Flash, PDF readers, Java), or the operating system itself. Drive-by downloads are a primary delivery mechanism for exploit kits and represent a significant threat to organizations whose employees browse the web on corporate machines.
Dumpster Diving: The practice of searching through discarded materials, including physical trash and recycled storage media, to find sensitive information such as account numbers, passwords, organizational charts, or hardware that retains data. Organizations that fail to shred documents or properly wipe storage devices before disposal create easily exploitable vulnerabilities. Physical evidence recovered through dumpster diving may be legally admissible, since items discarded in public areas generally carry no expectation of privacy.
Easter Egg: A hidden feature or message intentionally embedded in software by developers, activated by undocumented keystrokes or input sequences. Most Easter eggs are harmless and humorous, but they illustrate that production software can contain undisclosed functionality, which becomes relevant when examining software for unauthorized back doors or hidden capabilities. Source code review can identify Easter eggs and distinguish them from malicious hidden functions.
Exploit Kit: A packaged toolkit, typically deployed on compromised web servers, that automatically probes visiting browsers for known vulnerabilities and delivers the appropriate exploit. Exploit kits like Blackhole (active roughly 2010 to 2013), Angler (active roughly 2013 to 2016), and RIG automated what was once a manual attack process, enabling even low-skill actors to infect large numbers of victims. They are frequently the delivery mechanism for ransomware, banking trojans, and credential stealers.
Fileless Malware: Malware that operates entirely in memory rather than writing files to disk, exploiting legitimate system tools such as PowerShell, WMI, or the Windows Registry to execute malicious code. Because no executable file is ever written, signature-based antivirus often fails to detect it. Forensic analysis of fileless malware requires memory forensics, examination of PowerShell logs, WMI subscriptions, and registry run keys, all of which are volatile and must be captured quickly.
Firewall: A security control that monitors and filters network traffic based on defined rules, blocking unauthorized connections while allowing legitimate ones. Firewalls range from simple packet filters to modern appliances that inspect application-layer content, detect intrusions, and enforce identity-based policies. Firewall logs are among the most valuable forensic artifacts in a network breach investigation, providing a record of every connection attempt, blocked packet, and allowed session.
Gray Hat: A hacker who occupies ambiguous ethical territory, often accessing systems without permission to identify vulnerabilities and then notifying the owner, sometimes demanding payment for remediation assistance. Gray hat activity is unauthorized and technically illegal regardless of intent. Organizations receiving unsolicited security disclosures from gray hat actors should consult legal counsel before responding, as the situation can have contractual and criminal law implications.
Hacker: Broadly, a person with advanced technical skills who uses them to gain access to systems, networks, or data. The term originally described creative problem-solvers in the computing community. Today it is used both as a neutral descriptor and as shorthand for a malicious actor; context and the white/gray/black hat distinction clarify intent. In legal proceedings, "hacker" is often used loosely, making precise technical characterization important for forensic expert witnesses.
Indicators of Compromise (IoC): Observable artifacts that suggest a system or network has been compromised, including malicious IP addresses, file hashes, domain names, registry keys, and behavioral patterns associated with known threat actors. Security teams share IoCs through threat intelligence platforms to help others detect the same threats quickly. In forensic analysis, documented IoCs provide the evidentiary basis for determining when and how an intrusion occurred and which systems were affected.
Keylogger: Software or hardware that records every keystroke made on a device and transmits or stores the data for unauthorized review. Keyloggers capture passwords, messages, banking credentials, and confidential communications without detection. In domestic litigation and workplace investigations, forensic examiners frequently encounter keyloggers installed by spouses, employers, or stalkers, and the analysis must determine exactly what data was captured and where it was sent.
Kill Chain: A model, originally developed by Lockheed Martin for military targeting, adapted to cybersecurity to describe the sequence of steps an attacker must complete to achieve an objective: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Defenders use the kill chain model to identify which stage an attacker is in and where controls can interrupt the attack. Forensic analysts reconstruct kill chains during post-incident review to document exactly how an attacker moved from initial access to final impact.
Lateral Movement: The techniques an attacker uses after gaining initial access to move from system to system within a network, escalating privileges and reaching high-value targets such as domain controllers, databases, or sensitive file shares. Common lateral movement methods include pass-the-hash, remote service exploitation, and abuse of legitimate administrative tools. Identifying lateral movement is a central task in network forensic investigations, since the initial point of entry is often not where the most damage was done.
Living Off the Land (LOTL): An attack technique in which threat actors use legitimate, pre-installed system tools (such as PowerShell, WMI, PsExec, and certutil) to conduct malicious activities, minimizing the need to deploy custom malware. Because the tools used are trusted by the operating system and standard security products, LOTL attacks evade most signature-based detection. Forensic investigation of LOTL attacks requires deep analysis of event logs, PowerShell script block logging, and process creation records to distinguish malicious use from normal administrative activity.
Logic Bomb: Malicious code deliberately inserted into software that lies dormant until a specific trigger condition is met, such as a particular date, time, or the removal of an employee account from the directory. Logic bombs have been used by disgruntled insiders to destroy data or sabotage systems after termination. Source code forensics can identify logic bombs by examining version control history, comparing binaries to source, and flagging conditional constructs tied to time-based or personnel-based triggers.
Malware: An umbrella term for any software designed to harm, disrupt, or gain unauthorized access to systems or data. The category includes viruses, worms, trojans, ransomware, spyware, adware, rootkits, and more. Modern malware is often modular, combining multiple capabilities such as credential theft, lateral movement, and data exfiltration into a single infection. Forensic malware analysis involves static examination of code, dynamic analysis in sandboxed environments, and behavioral correlation with network and endpoint logs.
Man-in-the-Middle (MitM): An attack in which an adversary secretly positions themselves between two communicating parties, intercepting and potentially altering traffic while each party believes they are communicating directly with the other. MitM attacks are conducted through ARP spoofing, DNS poisoning, rogue Wi-Fi access points, and SSL stripping. They are particularly dangerous in financial transactions and authentication flows. TLS certificate analysis and packet captures are key forensic tools for documenting a MitM event.
Master Program: In early botnet architecture, a master program was the central controller used by an attacker to issue commands to handler systems, which in turn relayed instructions to individual compromised hosts. The term is less common today as C2 infrastructure has grown more sophisticated, but the underlying concept of hierarchical botnet control remains relevant in analyzing legacy malware and attribution in older intrusion cases.
Payload: The component of a malware package that carries out the intended malicious action, distinct from the delivery or exploit mechanism. Payloads may encrypt files (ransomware), exfiltrate data, delete records, install a back door, or enlist the system in a botnet. Identifying the payload is a central goal of malware analysis, as it determines the actual harm caused and informs both remediation and the legal theory of damages in litigation.
Phishing: A social engineering attack that uses deceptive email, text messages, or websites to trick recipients into revealing credentials, clicking malicious links, or opening infected attachments. Spear phishing targets specific individuals using personalized information; whaling targets senior executives. Email header analysis, link analysis, and metadata examination are standard forensic techniques for tracing phishing campaigns and determining whether employees acted reasonably when deceived.
Phreaker: A practitioner of phone phreaking, the manipulation of telephone systems to make free calls, redirect calls, or gain unauthorized access to phone company infrastructure. Phreaking culture in the 1960s-1980s directly shaped the early hacker community. While classic phreaking techniques are largely obsolete, modern variants target VoIP systems, SS7 networks, and cellular provider infrastructure to intercept calls, redirect two-factor authentication SMS codes, or conduct toll fraud.
Polymorphic Virus: A virus that mutates its own code with each replication, changing its signature while preserving its function, specifically to evade signature-based antivirus detection. Metamorphic viruses take this further by rewriting their entire logic, not just encrypting the payload. Detecting polymorphic malware requires behavioral analysis and heuristic scanning rather than static signature matching. Forensic analysis of polymorphic infections often involves unpacking the virus in a controlled environment to identify its underlying function.
Privilege Escalation: The process by which an attacker with limited access gains higher-level permissions, moving from a standard user account to local administrator, then to domain administrator or system-level access. Privilege escalation exploits misconfigurations, unpatched vulnerabilities, weak service account credentials, and overly permissive Group Policy settings. Forensic investigators document privilege escalation by reviewing security event logs for unusual account activities, token manipulation events, and unexpected changes to group membership.
Rootkit: A collection of software tools that allows an attacker to maintain persistent, hidden access to a system while concealing the attacker's presence from the operating system, administrators, and security tools. Kernel-level rootkits are especially dangerous because they operate below the OS and can hide processes, files, network connections, and registry entries. Detecting rootkits often requires booting from a trusted external medium or performing off-system forensic analysis using a forensic image, since the running OS cannot be trusted.
Script Kiddie: An inexperienced attacker who uses pre-written tools, exploit scripts, and automated frameworks without understanding the underlying technical mechanisms. While script kiddies are unsophisticated, they cause real harm by deploying tools that were designed by skilled actors. Many ransomware incidents and web defacements are carried out by script kiddies using commodity exploit kits. The lack of technical sophistication can sometimes actually make attribution harder, since there are fewer distinctive techniques to identify.
Social Engineering: The manipulation of people rather than technology to obtain unauthorized access to information, systems, or facilities. Social engineering exploits human psychology, including trust, authority, urgency, and fear, more reliably than most technical attacks. Pretexting (creating a false identity), vishing (voice phishing), baiting (leaving infected USB drives), and tailgating (following authorized personnel into secured areas) are all social engineering techniques. In legal proceedings, establishing that an organization's staff were deceived rather than negligent can be critical to liability determinations.
Spam: Unsolicited bulk electronic messages sent to large numbers of recipients, primarily through email but also via SMS, social media, and messaging apps. Beyond being a nuisance, spam serves as a primary delivery vehicle for phishing, malware, and fraud. Spam campaigns are generated by botnets capable of sending billions of messages per day. Email header analysis can trace spam back through relay servers and identify the originating botnet or mail server, which is relevant in CAN-SPAM enforcement actions and phishing prosecutions.
Spoofing: The falsification of identifying information in a communication, such as an email sender address, IP address, caller ID, GPS coordinates, or website URL, to deceive recipients into believing the communication comes from a trusted source. Email spoofing is foundational to business email compromise (BEC) fraud. Forensic analysis of spoofed communications focuses on examining headers, authentication records (DMARC, SPF, DKIM), and network logs to distinguish the claimed source from the actual origin.
Spyware: Software that secretly monitors user activity and transmits the collected data to a third party without consent. Spyware captures keystrokes, screenshots, browsing history, email content, location data, and microphone or camera feeds. Commercial spyware marketed to employers or parents occupies a legal gray area; its installation on a device without the user's knowledge or consent is illegal in most U.S. jurisdictions. GDF regularly performs forensic analysis to detect spyware in domestic litigation, stalking cases, and corporate espionage matters.
SQL Injection: An attack on web applications that inserts malicious SQL commands into input fields, manipulating the database query and allowing attackers to read, modify, or delete database contents, bypass authentication, or execute operating system commands. SQL injection is one of the most prevalent and destructive web vulnerabilities. Database logs and web server access logs are the primary forensic record of SQL injection attacks, documenting the exact queries submitted and what data was accessed.
Supply Chain Attack: An attack that targets a less-secure element in an organization's supply chain, such as a software vendor, managed service provider, or hardware manufacturer, to gain access to the ultimate target. The SolarWinds incident, in which malicious code was injected into a software update trusted by thousands of organizations, is the defining example. Supply chain attacks are particularly difficult to detect because the malicious component arrives through a trusted update or delivery channel. Forensic analysis must trace the intrusion back to its origin in the supply chain rather than assuming the organization's own perimeter was breached directly.
Time Bomb: A variant of a logic bomb that triggers based on a specific date or time rather than another condition. Time bombs have been used by software vendors to disable unlicensed software, but are more dangerously employed by malicious insiders to cause damage at a predetermined future date, often after the perpetrator has left the organization. Forensic examination of scheduled tasks, cron jobs, and time-based conditional code is standard practice when a time bomb is suspected.
Trojan: Malware that disguises itself as legitimate, useful software to trick users into installing it. Unlike viruses, trojans do not self-replicate; they rely entirely on the user to install and run them. Once executed, a trojan may deliver ransomware, open a back door, install a keylogger, or enlist the device in a botnet. Remote access trojans (RATs) give attackers full interactive control of the infected system. File metadata, hash values, and behavioral analysis are used forensically to identify trojans and determine what actions they performed.
Virus: A self-replicating program that attaches to legitimate host files or boot sectors and spreads when infected files are shared or executed. Unlike worms, viruses require user action to propagate. A virus may be benign, displaying a message, or destructive, corrupting files and overwriting data. Forensic analysis identifies viruses through file hash comparison against known malware databases, behavioral analysis, and examination of recently modified files and system areas the virus may have altered.
Wardriving: The practice of driving or walking through an area with a Wi-Fi-enabled device to identify and map wireless networks, typically for the purpose of finding unsecured access points to exploit. Data collected during wardriving can include network names, encryption types, and GPS coordinates. The term now extends to any mobile scanning of wireless networks; warwalking and warbiking are common variants. Evidence of wardriving software on a device can be forensically significant in cases involving unauthorized network access.
Watering Hole Attack: A targeted attack in which the threat actor compromises a website known to be frequented by the intended victims, rather than attacking the target directly. When members of the target group visit the site, they are infected via a drive-by download or malicious redirect. Watering hole attacks are associated with nation-state actors targeting government employees, researchers, and industry professionals who visit specialized forums or association websites.
White Hat: A security professional who uses hacking techniques with explicit authorization to identify and remediate vulnerabilities before malicious actors can exploit them. White hat activities include penetration testing, vulnerability assessments, and bug bounty research. Their findings are documented and disclosed to the organization rather than exploited. Engagement letters and scoping agreements are essential to establishing the legal authorization that distinguishes white hat work from criminal conduct.
Worm: Self-replicating malware that spreads across networks without requiring user interaction or a host file, exploiting vulnerabilities in network services to copy itself from machine to machine. Worms consume bandwidth and system resources in addition to whatever malicious payload they carry. The WannaCry and NotPetya incidents demonstrated how a single worm can propagate across hundreds of thousands of systems in hours, causing billions of dollars in damages. Network traffic logs, firewall records, and endpoint detection data are used forensically to trace worm propagation paths.
Zero Day Threat / Exploit: A vulnerability that is unknown to the vendor or the public, giving defenders "zero days" to prepare a patch or mitigation before it is actively exploited. Zero-day exploits are among the most valuable commodities in the cyber underground, with nation-states and brokers paying millions of dollars for reliable exploits targeting widely deployed software. When a zero-day is used in a breach, forensic analysis must focus on behavioral indicators rather than signatures, since no patch or detection rule yet exists.
Zombie / Zombie Drone: A compromised computer that is remotely controlled by an attacker and used to carry out attacks or transmit spam without the knowledge of its owner. Zombies are the individual nodes that make up botnets. The owner of a zombie device is typically an innocent victim who unknowingly contributes to attacks against others. Forensic analysis of a suspected zombie device focuses on identifying the malware responsible, the C2 server it communicates with, and what actions were taken using the device's resources.

B. AI and Machine Learning Threats

AI & ML

Adversarial Machine Learning: The study and practice of attacking machine learning models by crafting inputs designed to cause incorrect or harmful outputs. Adversarial attacks exploit the statistical nature of ML models, producing inputs that are imperceptible to humans but cause models to misclassify images, generate dangerous content, or behave unpredictably. Adversarial ML is central to AI security testing, particularly for models used in fraud detection, access control, and autonomous systems.
AI Bias: Systematic errors in AI model outputs caused by biased training data, flawed model design, or unrepresentative sampling. AI bias can result in discriminatory outcomes in hiring, lending, law enforcement, and medical diagnosis. In litigation, AI bias has become a significant legal issue under anti-discrimination statutes. Forensic analysis of AI systems can document the training data composition, model architecture decisions, and output patterns that give rise to biased results.
AI Governance: The policies, processes, and controls an organization establishes to ensure AI systems are developed and deployed responsibly, transparently, and in compliance with applicable laws and ethical standards. Effective AI governance frameworks address model documentation, bias testing, audit trails, human oversight requirements, and incident response procedures for AI failures. Regulators across the EU, UK, and United States are increasingly requiring formal AI governance documentation from organizations deploying high-risk AI systems.
AI Hallucination: The generation by a large language model or other generative AI system of confident, plausible-sounding but factually incorrect or entirely fabricated content. Hallucinations arise from the statistical nature of language model training and are not a sign of deliberate deception by the model. In legal and forensic contexts, AI hallucinations in submitted documents or expert analyses have led to sanctions and disciplinary actions, underscoring the need for human verification of all AI-generated content used in proceedings.
AI Supply Chain Attack: An attack targeting the development pipeline of an AI system, including training data repositories, pre-trained model weights, ML libraries, or model hosting infrastructure. By compromising an upstream component, an attacker can introduce vulnerabilities or malicious behaviors into AI systems used by many downstream organizations. The attack vector is analogous to traditional software supply chain attacks but uniquely difficult to detect because the malicious behavior may only manifest under specific input conditions.
AI Model Poisoning: An attack in which malicious data is introduced into the training set of a machine learning model to degrade its performance, introduce bias, or cause it to behave maliciously under specific triggering conditions. Unlike inference-time attacks, poisoning attacks corrupt the model during the training process itself. The effects can be permanent and are particularly difficult to detect in models trained on large, crowdsourced datasets where data provenance is difficult to verify.
AI Red Teaming: A structured adversarial testing process in which a team attempts to identify harmful, biased, or dangerous behaviors in an AI system by probing it with adversarial inputs, edge cases, and jailbreak attempts. AI red teaming extends traditional security red teaming to cover technical vulnerabilities alongside content safety, bias, and misuse risks. Organizations deploying public-facing AI systems are increasingly required by policy and regulation to conduct AI red team exercises before deployment.
Alignment Failure: A situation in which an AI system pursues goals or produces outputs that do not reflect the values, intentions, or constraints specified by its designers or operators. Alignment failures range from minor misinterpretations of user instructions to potentially dangerous autonomous actions. In high-stakes applications such as autonomous vehicles, medical diagnostics, and critical infrastructure control, alignment failures have direct safety implications. Documenting alignment failures is an emerging area of AI forensics.
Automated Social Engineering: The use of AI systems, including large language models and voice synthesis tools, to generate personalized phishing messages, conduct voice-based vishing attacks, or simulate trusted individuals at scale. AI-generated social engineering content is indistinguishable from human-authored messages in many cases, significantly increasing the success rate of phishing campaigns. Forensic examination of suspected AI-generated communications may include stylometric analysis and comparison with known AI model output patterns.
Autonomous Weapon System: A weapon system that uses artificial intelligence to select and engage targets without human intervention. Autonomous weapon systems raise profound legal and ethical questions under international humanitarian law, including questions of accountability when the system causes unlawful harm. From a cybersecurity standpoint, these systems are attack targets: compromising the AI component of an autonomous weapon could cause it to misidentify or attack unintended targets.
Data Poisoning: The deliberate injection of corrupted, mislabeled, or manipulated data into training datasets to degrade the performance of a machine learning model or introduce specific vulnerabilities. The poisoned data corrupts the model when it is ingested during training, causing degraded accuracy or introducing hidden backdoors that an attacker can trigger later. Defenders counter data poisoning through data provenance tracking, anomaly detection during training, and robust statistical techniques that reduce the influence of outlying data points.
Deepfake: Synthetic media, typically video or audio, in which a person's likeness, voice, or words are replaced or fabricated using deep learning techniques such as generative adversarial networks. Deepfakes are used for fraud (including CEO impersonation in wire transfer scams), disinformation, non-consensual intimate imagery, and evidence fabrication. GDF's forensic analysis of suspected deepfakes examines pixel-level artifacts, facial landmark inconsistencies, audio spectral anomalies, and metadata to assess authenticity. Courts are increasingly confronted with deepfake evidence challenges.
Evasion Attack: An adversarial attack that crafts inputs to fool a deployed machine learning model into misclassification, without modifying the model itself. Evasion attacks are inference-time attacks, meaning they occur when the model is being used rather than when it is being trained. Classic examples include adding imperceptible noise to images to cause image classifiers to fail, or modifying malware code to evade ML-based antivirus engines while preserving malicious functionality.
Explainable AI (XAI): A field of AI research and engineering focused on making model decisions interpretable to humans, including the ability to explain why a particular output was generated. Explainability is increasingly required by regulation for high-risk AI applications in credit scoring, hiring, and healthcare. In litigation, XAI documentation is relevant to demonstrating that an AI system's decisions were reasonable and non-discriminatory, or conversely to showing that a "black box" model produced outputs that could not be audited or explained.
GANs (Generative Adversarial Networks): A class of neural network architecture consisting of two models, a generator and a discriminator, that compete against each other to produce increasingly realistic synthetic content. GANs were the dominant technology behind early deepfake systems and synthetic image generators, though diffusion models have largely supplanted them in modern synthetic media tools. They are also used legitimately in drug discovery, image enhancement, and data augmentation. From a security standpoint, GANs enable creation of synthetic faces, documents, and audio that may be used to defeat biometric authentication or fabricate evidence.
Large Language Model Jailbreak: A technique for bypassing the safety guidelines and content filters built into a large language model (LLM) by crafting inputs that cause the model to produce content it is designed to refuse, such as instructions for creating weapons, malware, or harmful content. Jailbreaks exploit the tension between model helpfulness and safety guardrails. They are documented through AI red team exercises, and new jailbreak techniques are continuously discovered as models evolve and safety measures are updated.
Membership Inference Attack: An attack against a machine learning model in which an adversary determines whether a specific data record was part of the model's training set. Membership inference is a privacy violation because it can reveal that an individual's sensitive data (medical records, financial information) was used to train the model, even if the data itself was never directly exposed. Membership inference attacks have significant implications for HIPAA compliance and GDPR data minimization requirements.
Model Extraction Attack: An attack in which an adversary queries a machine learning model's API extensively to reconstruct a functional replica of the model without access to its internal parameters or training data. The extracted model can then be used to craft more effective adversarial attacks or stolen as intellectual property. Model extraction attacks raise trade secret and IP protection questions for organizations that have invested significant resources in proprietary AI model development.
Model Inversion Attack: An attack that uses a machine learning model's outputs to reconstruct sensitive input data used during training. For example, a model inversion attack against a facial recognition system might reconstruct recognizable images of individuals whose faces were in the training data. Model inversion demonstrates that ML models can act as unintentional repositories of their training data, posing privacy risks even when the original dataset is kept confidential.
Neural Backdoor: A hidden vulnerability embedded in a neural network during training that causes the model to behave normally under standard inputs but produce attacker-specified outputs when a particular trigger pattern is present in the input. Neural backdoors are a form of model poisoning and are extremely difficult to detect through normal model evaluation, since the model appears to perform correctly until the trigger is activated.
Prompt Injection: An attack against large language model-based applications in which malicious instructions are embedded in user-controlled input, causing the model to override its system instructions and take unintended actions. In agentic AI systems that can execute code, browse the web, or send emails, prompt injection can lead to unauthorized data exfiltration or system compromise. Prompt injection is among the most critical vulnerabilities in LLM-integrated applications and is listed in the OWASP Top 10 for LLMs.
Shadow AI: The use of AI tools by employees without the knowledge or approval of their organization's IT and security teams. Analogous to shadow IT, shadow AI creates risks including the exposure of confidential or regulated data to third-party AI providers, intellectual property loss, and the use of unapproved and unvetted AI outputs in business decisions. Organizations are increasingly discovering shadow AI usage through data loss prevention tools and network traffic analysis.
Synthetic Identity Fraud: A form of fraud in which real and fabricated information are combined to create a new, fictitious identity that can be used to open credit accounts, obtain loans, or bypass identity verification. AI tools, particularly generative models, have dramatically lowered the cost and effort of creating convincing synthetic identities with supporting documentation. Synthetic identity fraud is particularly difficult to detect because no single real individual is victimized, so there is no person to file a fraud report.
Transfer Learning Attack: An attack that targets a pre-trained model used as the foundation for fine-tuning on a specific task, exploiting the fact that vulnerabilities or backdoors embedded in the base model are inherited by all derived models. Because many organizations fine-tune publicly available foundation models rather than training from scratch, a compromised base model can affect thousands of downstream applications. Vetting the provenance and integrity of pre-trained models is a critical step in AI supply chain security.
Voice Cloning: The use of AI to generate a synthetic replica of a specific person's voice from a small sample of audio, capable of saying anything the attacker specifies. Voice clones are used in vishing attacks, CEO fraud, and the generation of fake audio evidence. Audio forensic analysis can sometimes detect voice cloning through spectral analysis, prosody examination, and comparison with known authentic recordings, though detection is increasingly challenging as synthesis quality improves.

C. Dark Web and Underground

Dark Web

.onion: A special-use top-level domain accessible only through the Tor network, where the domain name is derived from the server's cryptographic public key (in the current v3 format, a 56-character base32 encoding of the full ed25519 public key; in the legacy v2 format, a truncated hash of the key). Onion sites provide anonymity for both the server operator and visitors. While some onion services host legitimate privacy-sensitive content, including whistleblower platforms and news organizations, the dark web is also home to criminal marketplaces, stolen data brokers, and ransomware operator leak sites.
Access-as-a-Service: A dark web market offering in which initial access brokers sell authenticated access to compromised corporate networks, including VPN credentials, remote desktop sessions, and webshell access. Buyers typically use this access to deploy ransomware or conduct further intrusion. The existence of access-as-a-service listings for a specific organization is a critical threat intelligence indicator that warrants immediate incident response action. Prices range from a few hundred dollars to tens of thousands depending on the value and privilege level of the access sold.
Bulletproof Hosting: Web hosting services operated in jurisdictions with weak cybercrime laws or corrupt enforcement, specifically designed to ignore takedown requests from law enforcement and abuse complaints from victims. Bulletproof hosting providers knowingly host phishing pages, malware distribution servers, C2 infrastructure, and child exploitation material. They are a foundational infrastructure element for cybercriminal operations globally. Attribution of cybercrime often requires tracing C2 infrastructure back through bulletproof hosting providers to underlying operators.
Canary Trap: A counterintelligence technique in which slightly different versions of a document or piece of information are distributed to different individuals or groups, allowing the source of a leak to be identified when a specific version appears in unauthorized channels. Canary traps are used by organizations to identify insider threats and the source of intelligence leaks. Digital metadata, document fingerprinting, and unique phrasing can all serve as the "canary" in a document.
Cryptocurrency Tumbler / Mixer: A service that pools cryptocurrency from multiple sources and redistributes it to make blockchain transaction tracing difficult, serving as a money laundering mechanism for ransomware proceeds, dark web market revenue, and other illicit crypto flows. Blockchain analytics firms and law enforcement have developed techniques to de-mix tumbled transactions, and several major mixing services have been seized by the FBI and Europol. Financial forensics involving cryptocurrency increasingly requires specialized blockchain analysis tools and expertise.
Dark Web: The portion of the internet accessible only through specialized anonymizing software such as Tor or I2P, not indexed by standard search engines and not accessible through ordinary browsers. The dark web encompasses a range of activity, from privacy-conscious communications to criminal marketplaces for stolen data, drugs, weapons, and cybercrime services. Organizations monitor the dark web for their own stolen credentials, data, and internal documents as part of threat intelligence programs. GDF assists attorneys and corporate clients in dark web monitoring and evidence collection for litigation.
Dark Web Marketplace: An online market operating on the Tor network where buyers and sellers transact in stolen data, malware, drugs, counterfeit documents, and criminal services using cryptocurrency. Notable examples have included Silk Road, AlphaBay, and Hansa, all of which were shut down by law enforcement. Dark web marketplaces operate with feedback systems, dispute resolution, and escrow services, mirroring legitimate e-commerce. Evidence from dark web marketplace transactions has been used in numerous federal criminal prosecutions.
Dead Drop: A method of communication in which parties exchange information without direct contact, traditionally using physical locations in espionage but adapted to digital contexts as a covert channel. Digital dead drops may use draft email folders shared between accounts, steganographically hidden messages in image files, or covert data embedded in cloud storage. Forensic identification of dead drop communications requires examining access logs, draft folders, and file modification timestamps across multiple accounts.
Digital Escrow: In the context of dark web marketplaces, a system in which a trusted third party holds cryptocurrency payment until the buyer confirms receipt of purchased goods or services, reducing fraud between criminal actors. Legitimate digital escrow exists in legal e-commerce and software licensing contexts. Forensic examination of dark web escrow transaction records can establish the financial relationship between criminal actors and the timing of illicit transactions.
Doxing: The public disclosure of an individual's private personal information, including home address, employer, family members, and financial details, without consent and typically with intent to harass, intimidate, or facilitate physical harm. Doxing is used as a harassment tool, a coercion mechanism against whistleblowers and journalists, and as precursor to "swatting" (calling in false emergency reports to a victim's address). Doxing activity leaves digital traces including forum posts, search queries, and data broker account records that are amenable to forensic analysis.
Exit Scam: A fraud scheme common in dark web marketplaces in which the marketplace operators or vendors accumulate funds in escrow or customer deposits, then disappear with the funds without delivering purchased goods or services. Exit scams have resulted in losses of tens of millions of dollars from dark web marketplace users. They illustrate the fundamental trust problem in criminal ecosystems: the same anonymity that protects criminals from law enforcement also prevents them from reliably enforcing agreements with each other.
I2P (Invisible Internet Project): An anonymizing network overlay that routes traffic through a series of encrypted tunnels to provide privacy and resist traffic analysis. Unlike Tor, which is primarily used to access the public internet anonymously, I2P is optimized for internal network services (hidden services, messaging, file sharing). I2P is used by some threat actors as an alternative to Tor for C2 communications and dark web services, making it relevant in network forensic analysis of advanced threat actors.
Initial Access Broker (IAB): A threat actor who specializes in breaching organizations and selling the resulting network access to other criminal groups rather than exploiting it directly. IABs have become a distinct and important role in the ransomware supply chain, enabling ransomware operators to focus on deployment and extortion while outsourcing the technical work of gaining initial access. Identifying whether an IAB was involved in a breach changes the scope of the forensic investigation and may affect attribution.
Money Mule: An individual who transfers illegally obtained funds on behalf of a criminal organization, typically retaining a percentage as payment. Money mules are often recruited through work-from-home scams and may not initially understand they are participating in fraud. They serve a critical role in laundering proceeds from phishing, romance fraud, business email compromise, and ransomware attacks. Bank transaction records, email communications, and wire transfer logs are the primary forensic artifacts in money mule investigations.
Paste Site: A website that allows users to share text content publicly or via private links, originally designed for code sharing. Paste sites such as Pastebin and similar platforms are routinely used by attackers to dump stolen data, share malware source code, post extortion threats, and communicate C2 instructions. Security teams monitor paste sites for their organization's name, domain, and data patterns as an early warning system for breaches. Archived paste content can provide forensic evidence of when data was exfiltrated and made public.
Ransomware-as-a-Service (RaaS): A criminal business model in which ransomware developers license their malware and supporting infrastructure to affiliates who conduct attacks and share a percentage of ransom payments with the developers. RaaS has transformed ransomware from a niche attack into an industrialized criminal enterprise, enabling even technically unsophisticated actors to deploy sophisticated ransomware. Major RaaS groups include LockBit, BlackCat/ALPHV, and Clop. Forensic investigation of a RaaS attack must distinguish affiliate activity from developer activity to properly attribute the intrusion.
Stealer Logs: Databases of credentials, cookies, browser history, and financial data harvested by information-stealing malware such as Redline, Raccoon, and Vidar, and sold or distributed on dark web forums and Telegram channels. Stealer logs have become one of the primary sources of initial access for threat actors, supplying credentials for credential stuffing attacks and initial access broker listings. A corporate device appearing in publicly circulating stealer logs is a significant indicator of compromise requiring immediate forensic response.
Tor (The Onion Router): A privacy network that routes internet traffic through a series of volunteer-operated relay nodes, wrapping the traffic in multiple layers of encryption before transmission so that each relay decrypts only one layer and learns only the previous and next hop, meaning no single node knows both the origin and destination. Tor is used by journalists, activists, law enforcement, and privacy-conscious individuals for legitimate purposes, as well as by criminals to obscure their location and identity. The presence of Tor browser artifacts on a device is forensically significant and may indicate dark web activity, though it does not by itself prove criminal conduct.
Underground Forum: An online community, typically operating on the dark web or in encrypted channels, where cybercriminals share techniques, tools, and services, buy and sell stolen data, and recruit collaborators. Major Russian-language underground forums such as XSS, Exploit.in, and RaidForums (now defunct) have served as hubs for sophisticated criminal activity for decades. Law enforcement agencies monitor underground forums for threat intelligence, and posts from specific forums are frequently presented as evidence in criminal prosecutions.
Warrant Canary: A regularly published statement by a service provider attesting that, as of the publication date, no secret government requests (national security letters or court orders with gag provisions) have been received. If such a request is received, the provider cannot actively disclose it but can allow the canary statement to lapse or disappear, signaling to users that a secret demand has occurred. Warrant canaries are a transparency mechanism with legal controversy; their effectiveness depends on whether courts will compel a provider to continue publishing a false canary.

D. Digital Forensics and Incident Response

DFIR

Anti-Forensics: Techniques used to destroy, conceal, or corrupt digital evidence, making forensic analysis more difficult or impossible. Common anti-forensic methods include secure deletion, encryption, timestamp manipulation, log clearing, steganography, and the use of memory-resident malware that leaves no disk artifacts. When forensic examiners identify anti-forensic activity, that finding is itself forensically significant: it suggests the suspect was aware of the evidentiary value of the data and acted deliberately to conceal it, which may be relevant to spoliation sanctions in civil litigation or consciousness-of-guilt arguments in criminal proceedings.
Artifact Analysis: The examination of digital artifacts, discrete data items left behind by system activity, user actions, or malware, to reconstruct events. Artifacts include registry entries, prefetch files, link files (LNK), shellbag data, browser history, event logs, and thumbnail caches. Each artifact type records a specific class of activity, and experienced forensic examiners correlate multiple artifact sources to build a complete and coherent picture of what occurred on a system. Understanding which artifacts survive deletion or anti-forensic techniques is a critical forensic skill.
Bit-for-Bit Copy: A forensic image that is an exact sector-by-sector duplicate of a storage device, including all partitions, deleted files, unallocated space, and file system metadata, created without any modification to the original. Also called a forensic clone or raw image. Analysis is performed on the copy, never on the original, to preserve evidence integrity. The hash value of the original and the copy must match to verify that the copy is identical. Bit-for-bit imaging is foundational to maintaining chain of custody and producing court-admissible evidence.
Chain of Custody: The documented, unbroken sequence of possession, control, transfer, and analysis of evidence from the moment of collection to its presentation in a legal proceeding. A gap or irregularity in chain of custody documentation gives opposing counsel grounds to challenge the admissibility and integrity of evidence. GDF maintains meticulous chain of custody documentation for every piece of evidence it handles, including signed receipts, transfer logs, storage location records, and access controls.
Cyber Kill Chain: Lockheed Martin's adaptation of the military kill chain concept to cybersecurity, describing seven phases of a cyberattack: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. The model provides a structured framework for understanding how attacks progress and where defenders can interrupt them. Post-incident forensic analysis frequently maps observed attacker activity to kill chain phases to communicate the attack narrative to executives, attorneys, and insurers.
Dead Box Forensics: Forensic analysis performed on a device that has been powered off before examination, relying on data stored on non-volatile media such as hard drives and flash storage. Dead box forensics preserves the integrity of persistent storage but sacrifices volatile data such as RAM contents, active network connections, and running processes. For most civil and criminal matters, dead box analysis is the standard approach, though modern incident response increasingly supplements it with live forensics to capture volatile evidence before shutting down compromised systems.
Diamond Model of Intrusion Analysis: A threat intelligence framework that models every intrusion event as having four core features: adversary, infrastructure, capability, and victim, connected at the vertices of a diamond. The model enables analysts to pivot from any known feature to discover related information about the others, facilitating threat actor attribution and pattern recognition across multiple incidents. The Diamond Model is particularly useful for structured analytic products used in intelligence sharing and litigation support.
Digital Forensic Imaging: The process of creating a forensic copy of a digital storage device using specialized tools that prevent any write operations to the source device while producing a verified bit-for-bit duplicate. Common forensic image formats include E01 (EnCase), AFF4, and raw (dd) images. The imaging process generates hash values for integrity verification. Forensic imaging is governed by NIST guidelines and is the prerequisite for virtually all subsequent forensic analysis, as it ensures the original evidence is preserved unchanged.
Evidence Spoliation: The intentional or negligent destruction, alteration, concealment, or failure to preserve evidence that is known to be relevant to anticipated or ongoing litigation. Courts have broad authority to sanction spoliation, ranging from adverse inference instructions to default judgment. In digital matters, common acts of spoliation include reformatting drives, running file shredders, deleting emails after a litigation hold should have been in place, and allowing automated deletion policies to continue running after a preservation obligation arose. Forensic analysis can often detect that spoliation occurred even when the underlying data is gone.
File Carving: A forensic technique that recovers files from unallocated disk space by identifying known file headers and footers within raw data, without relying on file system metadata. When files are deleted, the file system entry is removed but the underlying data often remains until overwritten. File carving can recover images, documents, video fragments, and database records even from formatted or partially overwritten drives. Tools such as Foremost, Scalpel, and Magnet AXIOM perform file carving as part of full forensic examinations.
First Responder Protocol: The documented procedures followed by the first person on scene at a digital incident to preserve evidence while minimizing contamination. Key actions include documenting the scene photographically, capturing volatile data (RAM, running processes, network connections) before any shutdown, avoiding running programs on the suspect device, and initiating chain of custody documentation. Failure to follow first responder protocols is a leading cause of evidence loss in digital investigations. GDF trains legal and corporate teams on first responder procedures as part of incident response planning.
Forensic Timeline Analysis: The process of correlating timestamps from multiple sources, including file system metadata, event logs, registry hives, browser history, and network logs, to construct a chronological narrative of events on a system or across a network. Timeline analysis is essential for establishing when an intrusion began, when specific actions were taken, and how events relate to each other across multiple devices and accounts. In litigation, a well-constructed forensic timeline is one of the most persuasive forms of digital evidence because it tells a coherent story supported by multiple independent data sources.
Hash Value: A fixed-length hexadecimal string generated by a cryptographic hash function (SHA-256, SHA-3, or legacy algorithms such as MD5 and SHA-1, which are now considered cryptographically weak) from any input data. Any change to the input, even a single bit, produces a completely different hash. In digital forensics, hash values serve as evidence integrity verification tools: by hashing both the original evidence and the forensic copy and confirming they match, examiners can demonstrate that the copy is an exact duplicate and has not been modified. Hash matching is also used to identify known malware files and known child exploitation material through databases such as NSRL and Project VIC.
Incident Response Plan: A documented set of procedures that specifies how an organization will detect, contain, eradicate, recover from, and learn from security incidents. An effective incident response plan defines roles and responsibilities, communication trees, evidence preservation procedures, regulatory notification timelines, and criteria for engaging outside forensic and legal counsel. Organizations without a tested incident response plan routinely make evidence-destroying mistakes in the chaotic early hours of a breach.
Live Forensics: Forensic data collection from a powered-on system, capturing volatile data that would be lost upon shutdown, including the contents of RAM, running processes, open network connections, logged-in users, and decryption keys held in memory. Live forensics requires careful technique to minimize alteration of the running system while collecting evidence. Modern full-disk encryption makes live forensics increasingly important, since the encryption keys needed to access protected data exist only in memory while the system is running.
Locard Exchange Principle: The criminological principle, articulated by Edmond Locard, that every contact between two objects leaves a trace. In digital forensics, this translates to the principle that every interaction between a user and a system, or between two systems, leaves evidence, including log entries, network connections, file access timestamps, and registry modifications. The digital Locard principle supports the forensic axiom that attacker activity can be detected and reconstructed, even when the attacker has attempted to cover their tracks.
Memory Forensics: The forensic analysis of a captured image of a system's volatile memory (RAM) to identify running processes, network connections, encryption keys, injected code, and fileless malware that leaves no trace on disk. Memory forensics is performed using tools such as Volatility (now at version 3) and other commercial platforms, which parse memory structures to extract meaningful artifacts. A memory capture is time-sensitive and must be taken while the system is running; once a system is shut down, the RAM contents are lost. Memory forensics is essential for investigating advanced threats including fileless malware and nation-state intrusions.
MITRE ATT&CK: A globally accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations of threat actor behavior, maintained by MITRE Corporation. ATT&CK provides a common language for describing attacker behavior that is used by threat intelligence analysts, incident responders, red teams, and security product vendors worldwide. Mapping attacker activity to MITRE ATT&CK techniques in a forensic report provides attorneys and executives with a standardized, defensible framework for understanding what an attacker did and how sophisticated they were.
Network Forensics: The capture, recording, and analysis of network traffic and related logs to detect intrusions, reconstruct communications, identify data exfiltration, and attribute attacks. Network forensics tools include full packet capture systems, NetFlow analyzers, DNS query logs, proxy logs, and SIEM platforms. Unlike endpoint forensics, network forensics provides a record of communication between systems, including when attackers are operating on devices they have not physically touched. Network forensic evidence is particularly important in cases involving remote access, data theft, and communication between co-conspirators.
Packet Capture (PCAP): A full recording of network packets passing through a network interface, stored in a file format (typically .pcap or .pcapng) that can be analyzed with tools such as Wireshark, tcpdump, or commercial forensic platforms. PCAPs capture every byte of network communication, including protocol headers, payload content, timing, and endpoint addresses. In forensic investigations, PCAPs can reconstruct file transfers, chat sessions, credential exchanges, and malware C2 communications in complete detail, provided the traffic is not encrypted end-to-end without key access.
Registry Analysis: Forensic examination of the Windows Registry, a hierarchical database that stores system configuration, user preferences, software settings, and historical activity data. The Registry is a rich forensic source, recording recently accessed files, USB devices connected to the system, program execution history (AppCompatCache, Amcache), user profile information, and persistence mechanisms used by malware. Registry analysis is a standard component of Windows forensic examinations and can reveal evidence of user and attacker activity even when other logs have been cleared.
Slack Space: The unused storage area that exists between the end of a file's data and the end of the file system cluster allocated to it. File systems allocate storage in fixed-size clusters; when a file does not fill its last cluster, the remaining space may contain data from previously deleted files. Slack space is an important source of residual data in forensic examinations and has been the basis for evidence in numerous criminal cases. Modern solid-state drives with TRIM support clear slack space more aggressively than traditional hard drives, reducing but not eliminating this recovery opportunity.
Steganography: The practice of hiding data within other, innocuous-appearing data, such as concealing a text file within the pixel data of an image, an audio file, or a video. Unlike encryption, which makes data unreadable, steganography conceals the very existence of the hidden data. Attackers use steganography to exfiltrate data covertly, embed malware instructions in benign-looking files, and conduct covert C2 communications. Steganalysis, the forensic detection of steganographic content, requires specialized tools and statistical analysis of carrier files.
Threat Hunting: A proactive security practice in which skilled analysts actively search for indicators of threat actor presence within an environment, rather than waiting for automated alerts. Threat hunters develop hypotheses based on threat intelligence and knowledge of attacker behavior, then test them by querying endpoint detection, network logs, and SIEM data. Threat hunting finds threats that evade automated detection and is particularly effective against APTs and living-off-the-land attacks. The findings of a threat hunt often initiate formal forensic investigations and incident response actions.
Threat Intelligence: Evidence-based knowledge about existing or emerging threats, including attacker TTPs, indicators of compromise, targeting patterns, and actor motivations, used to inform defensive decisions. Threat intelligence is categorized as strategic (high-level trends for executives), operational (specific campaigns and actors for security teams), and tactical (IoCs for security tools). In litigation, threat intelligence reports can establish whether a threat was known and whether the victim organization's defenses were appropriate relative to the known threat environment.
Volatility Order: The established forensic principle that digital evidence should be collected in order from most to least volatile, since the most transient data (RAM, cache, running processes) disappears first and must be captured before less volatile data (disk, logs, network devices). RFC 3227 (published by the IETF) and NIST SP 800-86 both address the order of volatility for incident response. Following volatility order maximizes the evidence recovered while minimizing the alteration of longer-lived evidence. Deviating from this order can result in critical evidence being lost permanently.
Write Blocker: A hardware or software device that prevents any write operations from being sent to a storage medium during forensic acquisition, ensuring that the evidence device is not modified during examination. Hardware write blockers are preferred in court-admissible forensics because they operate at a layer below the operating system, providing stronger guarantees than software-only solutions. The use of a write blocker is documented in the forensic examiner's notes and is a standard item in cross-examination of forensic witnesses.

E. OT / ICS / SCADA Security

OT / ICS

Air Gap: A security measure in which a computer or network is physically isolated from other networks, including the internet and corporate IT networks, with no direct wired or wireless connection. Air gaps have traditionally been used to protect critical control systems. The Stuxnet attack demonstrated that air gaps are not impenetrable: sophisticated actors can bridge them using infected removable media. True air gaps also require careful management of human access, since the most common air gap violation involves personnel carrying infected USB drives between secure and insecure environments.
CISA: The U.S. federal agency, established in 2018 under the Department of Homeland Security, responsible for protecting critical infrastructure from physical and cyber threats. CISA issues binding operational directives for federal agencies, publishes advisories about threats to critical infrastructure sectors, and coordinates with private sector owners of critical infrastructure on incident response and resilience. CISA's ICS-CERT (now merged into CISA) has been the primary government resource for OT/ICS vulnerability disclosures and incident response support.
Control Logic: The programmed instructions running on PLCs, RTUs, and other OT devices that govern physical processes such as valve operation, motor control, and safety interlocks. Control logic is typically written in IEC 61131-3 languages including Ladder Logic and Structured Text. Unauthorized modification of control logic, as seen in the Stuxnet attack and the Oldsmar, Florida water treatment incident, can cause physical damage, safety hazards, or process disruption. Forensic examination of control logic involves comparing current firmware against known-good baselines and analyzing logged change histories.
DCS (Distributed Control System): A process control system in which control elements are distributed throughout the plant rather than centralized in a single location, connected by a high-speed communications network. DCS platforms are common in chemical plants, refineries, and power generation facilities where tight, continuous process control is required. Unlike SCADA systems, which gather data from remote field sites, a DCS is typically confined to a single facility. DCS cybersecurity is a specialized discipline due to the real-time constraints, proprietary protocols, and catastrophic consequences of failure in process industries.
DNP3: Distributed Network Protocol 3, a communications standard widely used in electric utility SCADA systems for communication between master stations and field devices such as RTUs and intelligent electronic devices (IEDs). DNP3 was not designed with security in mind and lacks built-in authentication and encryption in its original specification. DNP3 Secure Authentication (SA), standardized as part of IEEE 1815-2012, was added to the protocol, but adoption has been slow. Attackers who gain access to a DNP3 network can issue unauthorized commands to grid equipment, making DNP3 security a critical concern for power utilities.
HMI (Human-Machine Interface): The graphical interface through which operators monitor and control industrial processes, displaying real-time data from sensors and field devices and allowing operators to adjust setpoints and issue commands. HMIs are frequently Windows-based systems connected to both the OT network and, inappropriately, the corporate IT network or the internet, making them a primary attack surface in ICS environments. Compromising an HMI gives an attacker the same view and control capability as a legitimate operator.
Historian Database: A specialized time-series database used in industrial environments to record process data, including sensor readings, setpoints, alarms, and operator actions, at high frequency over long time periods. Historian databases serve as the OT equivalent of security event logs, providing a record of what the process was doing at any given time. In forensic analysis of OT incidents, historian data can reveal when process parameters deviated from normal ranges, when alarms were suppressed, and whether physical process disruption occurred before or after a detected cyber event.
ICS (Industrial Control System): A broad category of control systems used to monitor and control industrial processes, encompassing SCADA systems, DCS, PLCs, RTUs, and other automation technologies deployed in energy, water, manufacturing, transportation, and other critical sectors. ICS security has become a national security priority as these systems, originally designed for isolation, are increasingly networked and exposed to cyber threats. A cyberattack on ICS can cause physical damage, environmental harm, and loss of life, making ICS forensics a specialized and high-stakes discipline.
Industrial Protocol: Communication protocols designed for use in industrial control environments, including Modbus, DNP3, PROFIBUS, EtherNet/IP, IEC 61850, and OPC-UA. Most traditional industrial protocols were designed for reliability and determinism rather than security, lacking authentication, encryption, or integrity verification. Network forensics in OT environments requires knowledge of these protocols to distinguish normal operational traffic from attacker-generated commands, since the same protocol used by operators is used by attackers who have gained access to the OT network.
Ladder Logic: A graphical programming language used to program PLCs, based on relay logic diagrams used in early factory automation. Ladder logic remains the most widely used PLC programming language in North American manufacturing and utility industries. Forensic analysis of ladder logic programs requires OT-specific expertise: examiners compare the current PLC program against a known-good baseline to identify unauthorized modifications that could alter physical process behavior, open or close valves, or disable safety interlocks.
Modbus: One of the oldest and most widely deployed industrial communication protocols, developed in 1979 by Modicon for serial communication between master controllers and peripheral devices in industrial control systems. Modbus is simple, robust, and openly documented, which has contributed to its longevity but also its insecurity: it has no authentication, no encryption, and no protection against replay attacks. Any device on a Modbus network can send commands to any PLC, making unauthorized access straightforward once network access is achieved. Modbus traffic is a primary analysis target in ICS forensic investigations.
OT (Operational Technology): Hardware and software that detects or causes changes in physical processes through direct monitoring and control of physical devices, processes, events, and infrastructure, as distinguished from information technology (IT) which processes and stores information. OT includes PLCs, DCS, SCADA systems, RTUs, and safety instrumented systems deployed in utilities, manufacturing, oil and gas, and transportation. The convergence of OT and IT networks has created new attack surfaces and requires security approaches that account for OT's unique real-time, availability-first operational requirements.
PLC (Programmable Logic Controller): A ruggedized industrial computer designed for real-time control of machinery and processes in manufacturing, utility, and infrastructure environments. PLCs execute control logic programs continuously, reading inputs from sensors and issuing outputs to actuators based on programmed logic. Stuxnet's targeting of Siemens S7-series PLCs demonstrated that PLC firmware and programs are realistic attack targets with potentially catastrophic physical consequences. Forensic examination of PLCs requires specialized hardware connections and vendor-specific software tools to read and analyze programs and execution logs.
Purdue Model: A hierarchical reference architecture for industrial control systems, originating from the Purdue Enterprise Reference Architecture, that defines six levels of an industrial enterprise from physical processes (Level 0) through intelligent devices (Level 1), control systems (Level 2), site operations (Level 3), business logistics (Level 4), and enterprise networks (Level 5). The Purdue Model is widely used to define network segmentation requirements in ICS environments and guides the placement of security controls at boundaries between levels. Understanding the Purdue Model is essential for forensic examiners analyzing how attackers moved from IT networks into OT environments.
RTU (Remote Terminal Unit): A field device used in SCADA systems to collect data from sensors and instruments at remote locations and transmit it to the central SCADA master station, while also relaying control commands from the master to local actuators. RTUs are deployed at geographically distributed sites such as substations, pump stations, and wellheads. Because RTUs often operate in remote, physically unmonitored locations, physical security and secure communications protocols are both important considerations for protecting them from tampering.
SCADA (Supervisory Control and Data Acquisition): A category of industrial control systems used to monitor and control geographically dispersed infrastructure such as electric grids, water treatment plants, oil and gas pipelines, and transportation networks. SCADA systems collect real-time data from field devices (RTUs, PLCs) and display it to operators, who use the system to issue control commands. SCADA security failures have real-world safety consequences: successful attacks have disrupted power distribution, contaminated water supplies, and disabled safety systems. GDF's OT/ICS forensic team specializes in post-incident analysis of SCADA security events.
Safety Instrumented System (SIS): An independent system designed to bring an industrial process to a safe state when predetermined conditions are exceeded, preventing catastrophic outcomes such as explosions, toxic releases, or equipment failure. The TRITON/TRISIS malware, discovered in 2017, specifically targeted Schneider Electric Triconex safety systems at a Middle Eastern petrochemical facility, with the apparent goal of disabling safety systems to enable a catastrophic incident. Attacks against SIS are considered among the most dangerous categories of ICS cyberattack.

F. Network and Infrastructure

Network

CIDR (Classless Inter-Domain Routing): A method for allocating IP addresses and routing internet traffic that replaced the older class-based addressing system, using a prefix notation (e.g., 192.168.1.0/24) to specify both the network address and the number of bits in the subnet mask. Understanding CIDR notation is necessary for interpreting firewall rules, access control lists, and network forensic evidence, since IP address ranges are frequently specified using CIDR in configuration files, threat intelligence feeds, and incident reports.
DMZ (Demilitarized Zone): A network segment that sits between an organization's internal network and the internet, hosting publicly accessible services such as web servers, email servers, and DNS resolvers while isolating them from the more sensitive internal network. If a server in the DMZ is compromised, the attacker should face additional barriers before reaching internal systems. Forensic analysis of incidents involving internet-facing infrastructure frequently begins with an examination of DMZ systems, since they are the most exposed point of entry.
DNS (Domain Name System): The distributed naming system that translates human-readable domain names (www.example.com) into IP addresses that computers use to route traffic. DNS is described as the "phone book of the internet." It is also a rich forensic data source: DNS query logs record every domain a device has looked up, including C2 domains used by malware, phishing site lookups, and data exfiltration via DNS tunneling. DNS logs are among the first artifacts examined in network forensic investigations.
Egress Filtering: The application of firewall rules or network controls to outbound traffic leaving an organization's network, blocking unauthorized connections from internal systems to external destinations. Egress filtering limits the ability of malware to communicate with C2 servers and reduces data exfiltration. Organizations that rely exclusively on perimeter ingress filtering while ignoring egress controls provide attackers who gain internal access with a wide-open path for data theft and C2 communication. Firewall logs showing unexpected outbound connections are often the first indicator of a compromise.
Encryption: The process of transforming data into an unreadable format using a cryptographic algorithm and key, making it accessible only to parties who possess the correct decryption key. Encryption protects data in transit (using TLS/SSL) and at rest (using full-disk encryption or file-level encryption). In digital forensics, encryption presents both a challenge and an opportunity: encrypted devices may require legal process to compel decryption key disclosure, while the presence of encryption software on a suspect device may be forensically significant.
Honeypot: A decoy system or network resource deployed to attract attackers, detect unauthorized access attempts, and study attacker behavior in a controlled environment. Honeypots have no legitimate operational purpose, so any interaction with them is inherently suspicious. Organizations deploy honeypots to detect insider threats, identify external attackers who have breached the perimeter, and gather threat intelligence. Evidence collected from honeypots may be used in criminal prosecution, though its admissibility requires careful documentation of the honeypot's configuration and operation.
IDS / IPS (Intrusion Detection / Prevention System): Network or host-based systems that monitor traffic or system activity for signatures of known attacks or anomalous behavior. An IDS generates alerts; an IPS additionally blocks malicious traffic automatically. IDS/IPS logs are critical forensic artifacts: they record detection events, timestamps, source and destination IP addresses, and the specific rule or signature that fired, providing a contemporaneous record of attack activity. The absence of IDS/IPS alerts does not mean no attack occurred, since sophisticated attacks are frequently designed to evade signature-based detection.
NAT (Network Address Translation): A method in which a router maps multiple private IP addresses to a single public IP address, conserving public IP space and obscuring the internal network topology from external observers. NAT complicates forensic attribution because many devices sharing a single external IP address cannot be individually identified without internal NAT log records correlating the external connection to a specific internal device and time. Preserving NAT logs is a critical step in incident response and legal holds for network-related incidents.
Network Segmentation: The division of a network into smaller subnetworks with controlled access between them, limiting the spread of an intrusion and reducing the blast radius of a breach. Segmentation is implemented using firewalls, VLANs, and access control lists. Proper segmentation means that an attacker who compromises a workstation in accounting cannot directly reach OT systems or the finance server without passing through a security control that can detect and block lateral movement. Network topology documentation is essential both for security design and for forensic reconstruction of how an attacker moved through an environment.
Packet Sniffing: The capture and analysis of network packets passing over a network, using tools such as Wireshark, tcpdump, or commercial network taps. Packet sniffing is used legitimately for network troubleshooting, performance monitoring, and forensic investigation, and maliciously for credential theft, session hijacking, and reconnaissance. On switched networks, packet sniffing requires either access to a switch port mirror, a network tap, or the use of ARP poisoning to redirect traffic. Encrypted protocols limit the intelligence an attacker (or forensic examiner) can extract from captured packets.
PKI (Public Key Infrastructure): A framework of policies, procedures, hardware, software, and digital certificates that enables secure electronic communications through public-key cryptography. PKI is the foundation of TLS/SSL, email signing (S/MIME), code signing, and document digital signatures. Certificate authority (CA) compromise, certificate mis-issuance, and improper certificate validation are significant security vulnerabilities in PKI. Forensic analysis of PKI involves examining certificate chains, certificate revocation status, and CA logs to authenticate digital signatures and detect certificate-based fraud.
Proxy Server: An intermediary server that forwards client requests to other servers, providing anonymization, content filtering, caching, and access control functions. Forward proxies are used by clients to access the internet; reverse proxies sit in front of servers to distribute load and provide security. Attackers use anonymizing proxy services and proxy chains to conceal their location and identity. Proxy logs are valuable forensic artifacts, recording the source IP, destination URL, timestamp, and data volume for each proxied request.
SIEM (Security Information and Event Management): A platform that aggregates and correlates log data from across an organization's infrastructure, including endpoints, network devices, cloud services, and applications, applying rules and analytics to detect potential security incidents and generate alerts. SIEMs are both a real-time detection tool and a forensic archive: the centralized log repository they maintain is frequently the most complete evidence source available after an incident. SIEM data preservation and forensic export is a critical early step in incident response and legal hold procedures.
TLS / SSL: Transport Layer Security (TLS) and its predecessor Secure Sockets Layer (SSL) are cryptographic protocols that provide authentication, confidentiality, and integrity for network communications. TLS is the foundation of HTTPS and secures email, VPN, and many other protocols. Weaknesses in TLS configuration (outdated protocol versions, weak cipher suites, certificate validation failures) are common penetration testing findings. In forensics, TLS interception by a network security device, where permitted by policy, can provide visibility into otherwise encrypted traffic. All TLS versions below 1.2 are considered insecure.
VLAN (Virtual Local Area Network): A logical subdivision of a physical network, configured at the switch level, that separates broadcast domains and controls which devices can communicate directly without passing through a router or firewall. VLANs are a primary tool for network segmentation, separating user workstations, servers, guest Wi-Fi, and OT devices from each other. VLAN hopping attacks exploit misconfigured switch ports to gain access to VLANs beyond those intended. VLAN configuration documentation is reviewed during network forensic investigations to understand what network segments an attacker could have reached.
VPN (Virtual Private Network): An encrypted tunnel that extends a private network across a public network, allowing remote users and branch offices to access organizational resources securely. VPNs are also used by individuals and threat actors to conceal their true IP address and geographic location. Compromised VPN credentials are a top initial access vector for ransomware and APT actors. VPN authentication logs, including login timestamps, IP addresses, and geographic data, are among the most forensically valuable artifacts in remote access breach investigations.
Zero Trust Architecture: A security model that eliminates the concept of a trusted internal network, instead requiring continuous verification of every user, device, and application before granting access to resources, regardless of whether the request originates inside or outside the traditional network perimeter. Zero trust principles include microsegmentation, least-privilege access, continuous authentication, and thorough logging of all access events. The shift to remote work and cloud computing has accelerated adoption of zero trust, and NIST SP 800-207 provides the authoritative framework for zero trust architecture implementation.

G. Compliance and Legal

Compliance & Legal

Attorney-Client Privilege in Digital Evidence: The application of the attorney-client privilege doctrine to electronic communications between attorneys and clients, including email, text messages, collaboration platform messages, and documents stored in cloud platforms. The privilege protects confidential communications made for the purpose of seeking legal advice. In digital forensic matters, privilege determinations require careful review of electronically stored information before production, and inadvertent disclosure of privileged digital communications is a recurrent issue in eDiscovery. Engaging forensic counsel early in an investigation helps establish privilege protection over the forensic work product itself.
CCPA (California Consumer Privacy Act): California's comprehensive consumer privacy law, effective January 1, 2020 and significantly expanded by the California Privacy Rights Act (CPRA) in 2023, which grants California residents the right to know what personal information is collected, the right to delete it, the right to opt out of its sale, and the right to non-discrimination for exercising these rights. CCPA applies to for-profit businesses meeting certain revenue or data processing thresholds. In breach scenarios, CCPA creates notification obligations and potential statutory damages of $100 to $750 per consumer per incident for unauthorized access to certain categories of personal information.
CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act): A 2022 federal law directing CISA to establish mandatory cyber incident reporting for operators of critical infrastructure. CISA's proposed rule (NPRM, April 2024) specifies 72-hour reporting for significant incidents and 24-hour reporting for ransomware payments; those timelines take effect when the final rule is published. CIRCIA represents a significant expansion of mandatory federal cyber incident reporting and has implications for how organizations must document and preserve incident evidence to satisfy reporting obligations.
CMMC: The Department of Defense's framework requiring defense contractors to demonstrate implementation of cybersecurity controls as a condition of contract eligibility, with certification requirements scaled to the sensitivity of the controlled unclassified information (CUI) involved. CMMC 2.0 establishes three levels: Level 1 (basic cyber hygiene, 17 practices from FAR 52.204-21), Level 2 (advanced, aligned with NIST SP 800-171's 110 practices), and Level 3 (expert, aligned with NIST SP 800-172). A contractor's failure to implement required CMMC controls while attesting compliance may give rise to False Claims Act liability. Digital forensic analysis can document the actual state of contractor cybersecurity implementation in CMMC-related matters.
Daubert Standard: The standard established by the U.S. Supreme Court in Daubert v. Merrell Dow Pharmaceuticals (1993) for the admissibility of expert testimony in federal courts, requiring that such testimony be based on sufficient facts or data, the product of reliable principles and methods, and applied reliably to the facts of the case. Digital forensic experts must meet Daubert requirements by demonstrating that their tools and techniques are scientifically validated, have known error rates, and are generally accepted in the forensic community. GDF's methodologies are designed and documented to satisfy Daubert scrutiny.
eDiscovery (Electronic Discovery): The process of identifying, preserving, collecting, processing, reviewing, and producing electronically stored information (ESI) in response to litigation, regulatory inquiries, or government investigations. ESI includes email, documents, databases, social media, text messages, cloud storage, and metadata. The Federal Rules of Civil Procedure govern eDiscovery in federal litigation, including requirements for proportionality, litigation holds, and the treatment of inaccessible data. GDF provides forensic collection and processing services for eDiscovery matters requiring specialized technical expertise.
FERPA (Family Educational Rights and Privacy Act): A federal law that protects the privacy of student education records and grants students (or their parents) the right to access, review, and request corrections to those records. FERPA applies to educational institutions that receive federal funding. Cybersecurity breaches at educational institutions that expose student education records implicate FERPA notification and remediation obligations. Digital forensic analysis in education sector breaches must account for the special sensitivity of student data under FERPA.
FRE 902(14): Federal Rule of Evidence 902(14), effective December 1, 2017, which provides a self-authentication mechanism for electronic data by allowing a qualified person to certify in a written declaration that they used a process that produces an accurate result, identified the output, and detected no alteration. FRE 902(14) streamlines the admission of digital evidence generated by hash-verified forensic processes without requiring the examiner to testify in person solely for authentication purposes. Understanding FRE 902(14) and its state equivalents is important for structuring forensic reports and declarations to maximize evidentiary efficiency.
GDPR: The European Union's comprehensive data protection regulation, effective May 25, 2018, which governs the collection, processing, and transfer of personal data of EU residents. GDPR imposes strict requirements on lawfulness of processing, data subject rights, data minimization, and security, with penalties of up to 20 million euros or 4% of global annual turnover (whichever is higher) for serious violations, and up to 10 million euros or 2% for less severe infringements. Breach notification is required within 72 hours to supervisory authorities. Organizations operating globally must account for GDPR in their incident response plans and forensic preservation procedures, particularly when handling EU resident data.
HIPAA (Health Insurance Portability and Accountability Act): The primary U.S. federal statute governing protection of individually identifiable health information (PHI) held by covered entities (health plans, providers, and clearinghouses) and their business associates. The HIPAA Security Rule requires implementation of administrative, physical, and technical safeguards. HIPAA breaches affecting 500 or more individuals must be reported to HHS and the media, with individual notification required. Healthcare sector breaches regularly involve digital forensic analysis to determine what PHI was accessed, exfiltrated, or altered, and to satisfy HIPAA's breach notification assessment requirements.
NERC CIP (Critical Infrastructure Protection): A set of mandatory cybersecurity standards developed by the North American Electric Reliability Corporation and enforced by the Federal Energy Regulatory Commission for the bulk electric system in North America. NERC CIP standards cover electronic security perimeters, access management, configuration change management, incident reporting, and recovery planning. Violations can result in penalties of up to $1 million per violation per day. Forensic analysis in NERC CIP enforcement actions requires deep familiarity with both the technical standards and the electric utility environment.
NIST CSF (Cybersecurity Framework): A voluntary framework published by the National Institute of Standards and Technology, organizing cybersecurity activities into five core functions: Identify, Protect, Detect, Respond, and Recover. The NIST CSF 2.0 update, released in 2024, added a sixth function, Govern. While voluntary for most organizations, the NIST CSF has become a de facto standard referenced in regulatory guidance, cyber insurance underwriting, and litigation to assess the reasonableness of an organization's cybersecurity posture. In litigation, demonstrating alignment with the NIST CSF can help establish that an organization acted reasonably in protecting its systems.
PCI DSS (Payment Card Industry Data Security Standard): A set of security standards developed by the PCI Security Standards Council, mandated by credit card brands (Visa, Mastercard, Amex, Discover) for any entity that stores, processes, or transmits cardholder data. PCI DSS requirements cover network security, access control, encryption, vulnerability management, monitoring, and security policies. Payment card breaches trigger forensic investigation requirements: a PCI Forensic Investigator (PFI) must conduct the investigation, and findings are reported to the card brands. Non-compliance can result in fines, card brand termination, and reputational damage.
SOC 2: Developed by the American Institute of CPAs (AICPA), SOC 2 is a reporting framework for service organizations that evaluates controls relevant to security, availability, processing integrity, confidentiality, and privacy of customer data. SOC 2 Type II reports, covering an actual period of operation rather than a point-in-time snapshot, are routinely required by enterprise customers as evidence of their vendors' security controls. In litigation involving vendor breaches, SOC 2 reports and the underlying control documentation are frequently sought in discovery to assess what security commitments were made and whether they were met.
SOX (Sarbanes-Oxley Act): Enacted in 2002, this U.S. federal law establishes requirements for financial reporting accuracy, internal controls, and auditor independence for publicly traded companies. SOX Section 404 requires management and external auditors to assess the effectiveness of internal controls over financial reporting. IT systems that support financial reporting are in scope for SOX compliance, including access controls, change management, and log integrity. Digital forensic analysis of SOX-relevant systems is conducted in connection with securities fraud investigations, internal audits, and SEC enforcement actions.
Spoliation Sanctions: Court-imposed penalties for the destruction or failure to preserve relevant evidence, ranging from adverse inference instructions (permitting the jury to assume the missing evidence would have been harmful to the spoliating party) to striking pleadings, entering default judgment, or imposing monetary sanctions. Federal Rule of Civil Procedure 37(e) governs sanctions for the failure to preserve electronically stored information. Courts examine whether the destruction was intentional ("willful") versus negligent, with intentional spoliation typically receiving harsher sanctions. Engaging digital forensic counsel promptly after a potential claim arises is the most effective way to avoid spoliation sanctions.

H. Identity and Access

Identity & Access

Biometric Authentication: The use of unique biological characteristics, including fingerprints, facial geometry, iris patterns, voice, or behavioral traits, to verify a person's identity. Biometric systems are increasingly used for device unlocking, banking authentication, and border control. Unlike passwords, biometric data cannot be changed if compromised. The intersection of biometrics and law enforcement is significant: compelling a suspect to provide a fingerprint to unlock a device has been treated differently from compelling a password disclosure under the Fifth Amendment in some jurisdictions, though this area of law continues to evolve.
Credential Harvesting: The collection of authentication credentials (usernames, passwords, API keys, tokens, certificates) through phishing, keylogging, memory scraping, or extraction from compromised systems. Harvested credentials are used directly for unauthorized access, sold to other threat actors, or fed into credential stuffing attacks against other services. Information-stealing malware (stealers) is one of the most prolific credential harvesting mechanisms, exfiltrating browser-stored passwords, session cookies, and autofill data from millions of compromised devices.
Identity and Access Management (IAM): The framework of policies, processes, and technologies that manages digital identities and controls what resources each identity can access. IAM encompasses user provisioning, authentication, authorization, role-based access control, and audit logging. Weak IAM implementation, including excessive permissions, unmanaged service accounts, and lack of multi-factor authentication, is a root cause of many significant breaches. IAM logs, including provisioning events, authentication records, and access changes, are essential forensic artifacts in insider threat and unauthorized access investigations.
Kerberoasting: An Active Directory attack technique in which an attacker with any valid domain account requests Kerberos service tickets for accounts registered with Service Principal Names (SPNs), then extracts and offline-cracks the ticket to recover the service account's plaintext password. Service accounts often have elevated privileges and weaker password policies, making them highly valuable targets. Kerberoasting is a common post-compromise lateral movement technique and leaves specific artifacts in Windows Security event logs that forensic examiners look for during Active Directory incident response.
Multi-Factor Authentication (MFA): An authentication method that requires users to provide two or more verification factors from different categories: something they know (password), something they have (authenticator app or hardware token), and something they are (biometric). MFA dramatically reduces the risk of account compromise from credential theft alone. Attackers have responded with MFA bypass techniques including SIM swapping, real-time phishing proxies, and push-notification fatigue attacks ("MFA bombing"). Forensic analysis of authentication logs can determine whether MFA was enabled, whether it was bypassed, and how an attacker ultimately gained access.
OAuth: An open authorization framework that allows third-party applications to obtain limited access to a user's account on another service without exposing the user's password. OAuth 2.0 is the standard underlying "Sign in with Google" and similar delegated access flows. Attackers exploit OAuth through malicious app registrations that request broad permissions, using consent phishing to trick users into granting access to their email or files. Unauthorized OAuth grants can persist even after a password reset, making them a frequently overlooked foothold during incident response.
Pass-the-Hash: An attack technique that uses a captured password hash to authenticate to remote systems without needing to know the underlying plaintext password. Windows NTLM authentication is particularly vulnerable: once an attacker dumps credential hashes from memory (using tools like Mimikatz), those hashes can be used directly to authenticate across the network. Pass-the-Hash attacks are a staple of lateral movement in Windows environments and leave specific event log artifacts. Forensic analysis can often correlate hash reuse patterns to trace an attacker's path through an enterprise network.
Passwordless Authentication: Authentication methods that eliminate the need for traditional passwords, relying instead on cryptographic keys, biometrics, hardware tokens, or magic links. The FIDO2 standard and WebAuthn protocol are the primary technical foundations for passwordless systems in use today. Passkeys, the consumer implementation of FIDO2, are tied to a specific device and resistant to phishing because the cryptographic operation never exposes a reusable secret. Passwordless authentication significantly narrows the attack surface for credential-based attacks.
SAML (Security Assertion Markup Language): An XML-based standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP), most commonly used for enterprise single sign-on. When a user authenticates to the IdP, a digitally signed SAML assertion is passed to the service provider granting access. The SolarWinds supply chain attack involved forging SAML tokens (a technique sometimes called "Golden SAML"), allowing attackers to impersonate any user to cloud services without triggering standard authentication alerts.
Single Sign-On (SSO): An authentication architecture that allows users to log in once and gain access to multiple connected applications without re-authenticating for each. SSO is built on protocols like SAML, OAuth, and OpenID Connect. While SSO improves user experience and often raises security baselines, it also concentrates risk: a compromised SSO session or identity provider can grant attackers access to every integrated application simultaneously. SSO audit logs are a high-value forensic artifact, often recording which applications were accessed during a compromised session.
Token Theft: The theft of authentication or session tokens that grant access to systems or services, allowing attackers to bypass password and MFA requirements entirely. Tokens are commonly stolen from browser memory, disk storage, or intercepted during transmission. Session cookie theft enables attackers to replay authenticated sessions to cloud services, email platforms, or enterprise applications. Microsoft's detection of the Midnight Blizzard threat actor in 2023 highlighted token theft as a primary initial access technique. Forensic analysis focuses on identifying stolen token use through anomalous IP addresses, user agents, or access patterns in authentication logs.

Encountered a Term in Your Case?

Understanding what happened is the first step. GDF's certified forensic analysts can examine digital evidence, identify attack techniques, and produce court-admissible reports. All consultations are strictly confidential.

Get a Free Consultation Call 1-800-868-8189

Last updated: April 14, 2026

Cybersecurity Glossary

A. Classic Cyber Threats

B. AI and Machine Learning Threats

C. Dark Web and Underground

D. Digital Forensics and Incident Response

E. OT / ICS / SCADA Security

F. Network and Infrastructure

G. Compliance and Legal

H. Identity and Access

Encountered a Term in Your Case?

Related Services

Computer Forensics

Network Forensics

eDiscovery Services

Questions About a Cyber Incident?