Hacking and Phishing

Attacker lifecycle (high-level — memorize these stages)

• Reconnaissance: passive (OSINT) and active (network probes) info gathering.
• Scanning & enumeration: port scans, banner grabbing, probing services to find weaknesses.
• Exploitation: using a vulnerability or misconfiguration to gain access (exploit code, social engineering).
• Privilege escalation: moving from low privilege to admin/root.
• Persistence: backdoors, scheduled tasks, registry autoruns to survive reboots.
• Lateral movement & discovery: hopping to other systems and mapping internal resources.
• Exfiltration & cover tracks: stealing data and deleting logs or using encryption/tunneling to hide activity.

Common categories of attacks (know examples + defensive controls)

• Malware — ransomware, trojans, worms, rootkits, spyware. Controls: EDR/antivirus, application whitelisting, backups, least privilege.
• Credential attacks — brute force, credential stuffing, password spraying, keylogging. Controls: MFA, account lockout, password complexity, monitoring for anomalous logins.
• Network attacks — MITM, ARP poisoning, DNS spoofing/poisoning. Controls: mutual TLS, network segmentation, DHCP snooping, ARP inspection, DNSSEC where applicable.
• Web application attacks — SQL injection, XSS, CSRF, SSRF. Controls: input validation, prepared statements/parameterized queries, WAF, secure session management.
• Supply chain attacks — compromised libraries or service providers. Controls: software bill of materials (SBOM), code signing, patch management, vet vendors.
• Physical attacks & insider threats — tailgating, theft, malicious insider. Controls: access controls, CCTV, separation of duties, monitoring, DLP.

Phishing & social engineering (types and exam-worthy details)

• Phishing (generic email) — mass emails aiming for credentials or malware. Indicators: generic greeting, urgency, mismatched URLs, poor grammar. Defenses: email filters, SPF/DKIM/DMARC, user training, URL rewriting/sandboxing.
• Spear phishing — targeted to a person/organization using personalized details. Higher success rate — requires targeted defense and user awareness.
• Whaling — high-value targets (C-suite). Often blends social engineering + business context (e.g., fake wire requests). Use high verification on financial requests.
• Vishing — phishing over voice calls. Controls: phone-based verification procedures, caller ID validation, staff training.
• Smishing — phishing via SMS. Controls: block suspicious links, user awareness.
• Pharming — DNS or hosts file manipulated to redirect victims. Controls: DNSSEC, monitoring, proper patching, DNS filtering.
• Quid pro quo / baiting — offer something for action (e.g., “install this tool”). Controls: policy, training, app whitelisting.

Indicators of Compromise (IoCs) — what to spot

• Unexpected outbound network traffic or connections to strange domains/IPs.
• Sudden increases in failed logons or logon from odd geolocations.
• New or altered accounts, unexpected scheduled tasks, strange services.
• Unusual file encryption, ransomware notes, or mass file renames.
• Disabled security tools or cleared logs.
  These are things to memorize as “red flags.”

Detection & monitoring (what Security+ expects you to know)

• SIEM for centralized log collection and correlation.
• EDR for endpoint detection and response.
• IDS/IPS for network anomaly/signature detection. Know difference: IDS alerts, IPS blocks (inline).
• UEBA (user & entity behavior analytics) for spotting abnormal behavior.
• Network taps / port mirroring for passive monitoring.
• Threat intelligence / IOC feeds to match indicators.

Prevention & hardening (practical controls to memorize)

• MFA — single most effective control vs credential reuse/phishing.
• Least privilege and role-based access control (RBAC).
• Patch management and vulnerability scanning.
• Network segmentation and microsegmentation.
• Application control / whitelisting and sandboxing.
• Email security: spam filters, sandboxing attachments, SPF/DKIM/DMARC.
• Backups & recovery: air-gapped/offline copies, tested restores.
• User training & simulated phishing tests — measure click rates and remediate.

Incident response basics (chain to remember)

• Preparation → Identification → Containment → Eradication → Recovery → Lessons learned.
• Keep forensic images, preserve logs, document actions. Know when to involve legal/regulatory teams.

Legal/ethical note (important for exam & practice)

• Don’t perform offensive hacking on networks you don’t own/authorize. For labs, use isolated environments (VMs, CTF platforms). Security+ expects defensive knowledge, not how to perform real-world attacks.

Exam mnemonics & high-value facts to memorize

• IDS vs IPS behavior (IDS alert-only; IPS inline & can block).
• SPF/DKIM/DMARC purpose order: SPF (sender IP auth), DKIM (signed email), DMARC (policy + reporting).
• Common social-engineering types: phishing, spear, whaling, vishing, smishing, baiting, tailgating.
• Ransomware defenses: offline backups, segmentation, patching, EDR.
• Privilege escalation common signs: new admin accounts, use of tools like mimikatz (know the concept, not how to run it).

Study actions (what to do next — high ROI)

• Do simulated phishing drills and review results / remediation steps.
• Practice identifying IoCs in mock logs (SIEM labs).
• Memorize acronyms: MFA, RBAC, WAF, EDR, SIEM, IDS/IPS, UEBA, SPF/DKIM/DMARC.
• Use lab platforms (e.g., virtual labs/CTFs) for safe hands-on practice with detection tools (not offensive operations on real networks).
• Create flashcards for attack signs, controls, and the incident response steps.