CySA+
  • CySA+ CS0-002 Exam Objectives
  • Threat Intelligence Cycle
  • Intelligence Sources
  • Security Intelligence Sharing
  • Threat Classification and Threat Actors
  • Threat Research and Indicators of Compromise
  • Attack Frameworks and The Cyber Kill Chain
  • Defining Threat Modeling and Threat Hunting
  • Vulnerability Identification and Validation
  • Vulnerability Scan Results and CVSS Scores
  • Nmap and Enumeration
  • Security Controls
  • Defense in Depth Security Baselines
  • Security Trend Analysis
  • Remediation Issues
  • Asset, Change, and Configuration Management
  • Software Development Lifecycle & Development Models
  • Software Assessment and Code Review
  • Mitigating Attack Types Part 1
  • Mitigating Attack Types Part 2
  • Mitigating Attack Types Part 3
  • Password Cracking and Hashing
  • Privilege Escalation & Man-in-the-Middle
  • Network Based IoCs
  • Host Based IoCs
  • Network Architecture and Segmentation
  • Network Traffic, Packet, and Protocol Analysis
  • Pentesting and Active Defense
  • Firewalls
  • URL Analysis & DNS in Malware
  • Network Access Control and Port Security
  • Identity and Access Management (IAM)
  • Web Application Scanners
  • SSL/TLS Digital Certificate Management
  • Mobile Threats
  • Email Threats and Mitigation
  • Data Loss Prevention (DLP)
  • Endpoint Security and Behavior Analysis
  • Hardware Assurance
  • Blackholes and Sinkholes
  • IoT, Embedded Systems & ICS/SCADA Threats
  • Log Analysis & Continuous Security Monitoring
  • SIEM and Event Correlation
  • Malware Analysis
  • Cloud Models and Service Threats
  • Cloud Automation and Other Cloud Threats
  • VDI, Containers, and Microservices
  • CI/CD, IaC, DevOps
  • AI and Machine Learning
  • Digital Forensics
  • Technical Controls for Securing Data
  • Non-Technical Controls for Securing Data
  • Security Policies and Procedures
  • Continuity Planning and Risk Assessment
  • Incident Response Phases and Communication
Powered by GitBook
On this page

Privilege Escalation & Man-in-the-Middle

  • Privilege Escalation

    • Gain access to what you should not be able to access.

    • Start as a normal user, and grant yourself more permissions

    • Inject code into a “privileged” app or service

    • Sudo / “Run as administrator”. Built in privilege escalation.

    • Mitigation?

      • Passwords, MFA, least privilege, sanitize input, patching, change default credentials

  • Pass the hash attack

    • Once captured, present the hash value instead of the password.

    • Older versions of Windows (LM hashes)

    • Newer versions with backwards-compatible configurations

  • Golden Ticket

    • One ticket to rule them all

    • Applies to Kerberos

    • Can grant Admin permissions to AD

    • On vulnerable versions, dumping the AD data store (NTDS.DIT) reveals the krbtgt hashes

    • These hashes can be used to create a “golden ticket” for any user in AD

    • “Kerberoasting”

  • Man in the middle attack

    • Network traffic interception. Optional redirection

    • Software: code injection. Man in the browser.

    • Keyloggers

    • ARP poisoning

  • DNS Attacks

    • Buffer overflows

    • DNS amplification

    • Mitigation?

      • Patching

      • Block malicious sources

  • Rootkits

    • Kernel level malware

    • Replaces OS files with malicious ones

    • Require root access

    • Mitigation: antivirus. File integrity monitoring.

    • Tripwire – File integrity monitoring for Linux.

    • File-sight for Windows FIM.

PreviousPassword Cracking and HashingNextNetwork Based IoCs

Last updated 2 years ago