Term	Definition	See also
Agentless	Agentless analysis means a sample's behaviour is recorded from outside the machine it runs on, by the hypervisor and the host, so that the recording does not depend on software the sample could find and disable. Packet capture, screen capture and a memory image are collected this way here; API-level detail is supplied by an in-guest component as a second source rather than the only one.	Hypervisor, VMI, ETW
Alternate data stream	An alternate data stream is a second, unnamed-by-default stream of content NTFS lets a file carry alongside its main contents, so a file can hold bytes that a directory listing and a naive copy never show. Analysts read the streams explicitly because content parked there is invisible to anything that only looks at the file's ordinary size.	Mark of the Web, Slack space, Static analysis
AMSI	The Antimalware Scan Interface is a Windows facility that lets a script engine hand the text it is about to run to the installed antimalware product before it runs. It matters to an analyst because it is a place where the deobfuscated form of a script becomes visible, and because samples are frequently observed trying to interfere with it.	Encoded command, ETW, Fileless
Anti-debugging	Anti-debugging is any check a program makes to decide whether it is being examined by a debugger, from reading a documented flag to timing its own instructions. A sample that finds one often changes course rather than crashing, so a run that looks uneventful may be a run that decided to be uneventful.	Anti-VM, Sleep evasion, Dynamic analysis
Anti-VM	Anti-VM is the family of checks a sample makes to decide whether it is running on a virtual machine rather than on someone's desktop, by looking for device names, driver files, hardware identifiers and timing artifacts left by virtualisation. It is why an analysis image is prepared to look ordinary and why a quiet run is not by itself evidence of a harmless file.	Anti-debugging, Hypervisor, Environmental keying
APC injection	An asynchronous procedure call is a Windows mechanism for queueing a function to run on a chosen thread the next time that thread is in a state to accept it. Code injection built on it is recognised in a trace by one process queueing work onto a thread belonging to another.	Injector, Thread hijacking, Process hollowing
API hashing	API hashing is the practice of storing a hash of a function's name instead of the name itself, and resolving the address at run time by hashing every export until one matches. The effect on static analysis is that the import table and the strings say almost nothing about what the code calls, and the intent only becomes visible while it runs.	Import address table, Imphash, Obfuscation
Application manifest	A manifest is an XML block, embedded in an executable or shipped beside it, that declares what the program requires from Windows: the privilege level it asks for, the version of shared libraries it binds to, and the compatibility behaviour it expects. It is worth reading because the requested privilege level is a statement of intent made before the program runs.	PE file, Resource section, UAC bypass
Application shim	A shim is a Windows compatibility layer that sits between a program and the operating system to adjust behaviour for software that expects an older version. Registered shims are examined during triage because the mechanism causes chosen code to be loaded into a chosen program.	Persistence, Hooking, Registry hive
Authenticode	Authenticode is Microsoft's code-signing format for Windows executables, and checking it tells you who signed a file, whether the signature still matches the bytes, whether the certificate has been revoked, and whether anything was appended after the signature.	PE file, BYOVD

Term	Definition	See also
BAM key	HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\<SID>, where the Background Activity Moderator records each executable a user ran as a value name in \Device\HarddiskVolumeN form, the data holding a FILETIME of last execution. Retention runs about a week, and console binaries land here that no GUI-launch artefact records.	Prefetch, Registry hive, Process tree
BaseNamedObjects	The object manager directory holding user-mode named kernel objects: mutants, events, semaphores, waitable timers, sections and jobs. Per-session names live under \Sessions\<n>\BaseNamedObjects, and the Global\ prefix redirects to the shared directory, so a low-privileged process can squat a name a service expects to create.	Mutex, Infection marker, Named pipe
Beacon	A beacon is the regular check-in a compromised machine makes to its operator's server, and its regularity is the giveaway: evenly spaced connections of similar size, repeated over a run, read as command-and-control rather than as ordinary traffic.	C2, PCAP, DGA
BIFF record	The record unit of the legacy binary spreadsheet workbook stream: two bytes of record type, two bytes of length, then the payload. Maldoc triage parses that stream field by field, since a BOUNDSHEET record whose visibility byte reads 0x02 marks a sheet very hidden, the usual home of a formula-language macro sheet.	Maldoc, OLE, Macro
Big pool	Kernel pool allocations above roughly a page, over 4064 bytes on x64, which carry no _POOL_HEADER and are tracked instead in the _POOL_TRACKER_BIG_PAGES array at nt!PoolBigPageTable. Pool tag scanning across an image cannot see them, so a memory analyst walks that table to recover large tagged buffers.	Memory forensics, VAD, Rootkit
binfmt_misc	Linux kernel feature that binds a magic byte pattern or a filename extension to an interpreter, registered by writing :name:type:offset:magic:mask:interpreter:flags to /proc/sys/fs/binfmt_misc/register. A handler laid over the magic of a common binary format turns every execve of such a file into a run of the named interpreter, and no file on disk changes.	Persistence, LOLBin, Loader
BIOS Parameter Block	The geometry structure at offset 0x0B of a volume boot record: bytes per sector, sectors per cluster, and on NTFS the $MFT start cluster at 0x30 with a signed clusters-per-record byte at 0x40. Manual carving of a raw image begins here, because cluster numbers mean nothing without those fields.	File carving, Slack space, Magic bytes
Blob heap	The #Blob stream of CLI metadata as specified in ECMA-335, a run of length-counted binary items holding method, field and local variable signatures, constant values, custom attribute arguments and public keys. A HeapSizes bit in the #~ header widens its indexes from 2 bytes to 4, which breaks hand-rolled parsers.	P-code, Obfuscation, PE file
Boot-start driver	A driver whose Services key sets Start to 0, loaded into memory by the boot loader before the kernel initializes anything else, with ordering decided by ServiceGroupOrder plus the Group and Tag values. Kernel persistence targets this window, which is why Early Launch Anti-Malware classifies each one first.	Bootkit, BYOVD, Rootkit
Bootkey	The 128-bit value, also called the SysKey, split across the Class attributes of the JD, Skew1, GBG and Data subkeys under HKLM\SYSTEM\CurrentControlSet\Control\Lsa and reassembled through a fixed byte permutation. Offline SAM hash extraction and LSA secret decryption both start by deriving it.	Registry hive, Memory forensics, Stealer
Bootkit	A bootkit is code that arranges to run during system start-up, before or alongside the operating system loader, so that it is already resident when the defences that would look for it are initialised. It sits in the boot chain rather than in a file the running system lists, which is why boot-time integrity measurement is the layer that detects it.	Rootkit, Persistence, Memory forensics
Bound import directory	Data directory 11 of a PE, an array of IMAGE_BOUND_IMPORT_DESCRIPTOR entries naming DLLs whose exports the linker already resolved into the IAT, each carrying the export timestamp seen at link time. The loader re-resolves on a timestamp mismatch and ASLR makes binding moot, yet the stale stamps still fingerprint the build host.	Import address table, Export table, PE file
Branch Trace Store	An x86 debug facility, armed through the IA32_DEBUGCTL MSR, that writes a source and destination address for every taken branch into a buffer inside the DS save area. Control flow through a packed sample reconstructs from those records, with no patched bytes or in-process hooks for the sample to notice.	Anti-debugging, Unpacking, Hardware breakpoint
Build ID	Toolchain-generated hash of the linked ELF image, stored in the .note.gnu.build-id note and left intact by stripping. Debuggers resolve split symbols through /usr/lib/debug/.build-id/. During triage, one value shared by files of differing hashes means a single link output later stripped, padded or wrapped.	Symbol table, Imphash, PDB path
BYOVD	BYOVD, or bring your own vulnerable driver, is the technique of loading a legitimately signed but flawed kernel driver in order to borrow its kernel access, which is how attackers reach the kernel without needing a signed driver of their own.	Authenticode, LOLBin, Persistence

Term	Definition	See also
C2	C2, short for command and control, is the infrastructure a piece of malware talks to after it lands. The addresses, domains and URLs behind it send the sample instructions and receive what it steals.	Beacon, IOC, DGA
Call stack	The call stack is the chain of return addresses that says which function called which to reach the code executing now. In behavioural analysis it is what separates a suspicious call made by the program's own code from the same call made by injected memory that has no file behind it.	Shellcode, Injector, Process tree
capa	capa is an open-source tool that reads a program's disassembled code and reports the capabilities it finds, such as keylogging, process injection, encryption and persistence, without running the file.	Static analysis, MITRE ATT&CK, PE file
Code cave	A code cave is a region of unused space inside an already-compiled file, such as the padding between sections, that is large enough to hold added instructions. Content found in one is worth extracting because that space has no legitimate reason to contain code.	Overlay, PE section, File infector
COM hijacking	Component Object Model hijacking is the redirection of a registered COM object to a different implementation, usually by writing a per- user registry entry that Windows consults before the machine-wide one. It is observed as persistence because the replacement is loaded by whatever legitimate program next asks for that object.	Persistence, Registry hive, Run key
Control flow flattening	Control flow flattening rewrites a function so that its blocks all become cases of one dispatch loop driven by a state variable, which destroys the shape a reader or a decompiler would otherwise use to follow it. The behaviour is unchanged, so a run in a sandbox still shows what the function does even when reading it does not.	Obfuscation, Opaque predicate, Dynamic analysis
Control Flow Guard	Control Flow Guard is a Windows mitigation that records which addresses in a binary are legitimate indirect call targets and checks each indirect call against that set. Whether a sample was built with it is a fact about the binary that static analysis can read straight out of the load configuration.	PE file, ROP, Static analysis
Cryptor	A cryptor is a tool that wraps an existing payload in a layer of encryption plus the small routine needed to undo it at run time, so the bytes on disk differ from build to build while the payload does not. It is why file hashes are weak identity for a family and why memory, not disk, is where the payload is recovered.	Packer, Unpacking, TLSH

Term	Definition	See also
Dead drop resolver	A dead drop resolver is a legitimate public service, such as a paste site, a profile page or a code repository, used to hold the address of the real command and control server rather than the traffic itself. The request that fetches it looks ordinary, which is why the extracted content matters more than the destination.	C2, IOC, DGA
Debug directory	The debug directory is the part of a Windows executable that records where its symbol file lives and when the build was produced. It is read during triage because the recorded path frequently carries the build machine's directory layout and the project's own name.	PDB path, PE file, Rich header
Decoy document	A decoy document is a plausible file opened for the person who was targeted, so that the click that started the execution appears to have produced something. Its presence is a strong signal about who a sample was meant for, and its content is treated as evidence rather than as part of the malware.	Maldoc, Macro, Detonation
Defanging	Defanging is the practice of rewriting a malicious indicator so it cannot be clicked or auto-linked, writing hxxp instead of http and 8.8.8[.]8 instead of 8.8.8.8, so that indicators can be pasted into a ticket or an email safely.	IOC, STIX, MISP
Detect It Easy	Detect It Easy is a signature-based identification tool that names the compiler, linker, installer or packer a binary was built with, which is often the first clue that a file has been protected or repackaged.	Packer, Static analysis, Entropy
Detonation	Detonation is deliberately running a suspicious file, script or link inside a disposable, monitored virtual machine so its real behaviour can be recorded instead of guessed at.	Sandbox, Dynamic analysis, Snapshot
DGA	A DGA, or domain generation algorithm, is code inside malware that invents a stream of new domain names to try for its next server, so that blocking any single domain does not cut the malware off.	C2, DNS query, Beacon
Direct syscall	A direct system call is one made by issuing the kernel transition instruction from the program's own code rather than by calling the documented library function that normally does it. Monitoring that watches only those library functions sees nothing, which is why kernel-side and hypervisor-side recording exist alongside it.	Syscall, Indirect syscall, Hooking
DLL search order	The search order is the fixed sequence of directories Windows walks when a program asks for a library by name. It is analytically important because the first match wins, so where a program was started from can decide which library it actually loads.	DLL side-loading, LOLBin, Process tree
DLL side-loading	Side-loading is the pattern where a signed, legitimate program is placed next to a library it will load by name, and that library is not the one its author intended. In a report it shows as a trusted process whose loaded modules include something that came from the same directory as the sample.	DLL search order, Authenticode, LOLBin
DNS query	A DNS query is a request to translate a name into an address, and the queries a sample makes are among the most revealing things it does, because it must ask for a name before it can reach the server behind it.	C2, PCAP, IOC
Domain fronting	Domain fronting is the technique of presenting one hostname in the part of a connection an observer can read while the request inside the encrypted channel asks for a different one, so that the traffic appears to be going somewhere unremarkable. It is one reason a destination address alone is weak evidence and the extracted request matters.	TLS key log, JA3, C2
Downloader	A downloader is a small program whose only job is to retrieve the payload that does the real work, which it does after it is already running on the machine. It is short, often unremarkable in isolation, and the thing worth capturing is the address it reaches for.	Dropper, Stager, Loader
Dropper	A dropper is a program whose only job is to deliver another one. It writes or downloads the real payload, starts it, and often deletes itself, which is why the first file in an incident is frequently not the interesting one.	Process tree, Packer, Persistence
Dynamic analysis	Dynamic analysis is the study of a sample by running it and recording what it does rather than by reading its code: the processes it starts, the files and registry keys it touches, the memory it allocates and the network it reaches.	Static analysis, Detonation, ETW

Term	Definition	See also
Emulation	Emulation runs a sample's instructions in a software model of a processor and an operating system rather than on the real thing, so behaviour can be observed without a machine ever executing the code. It is faster and safer than detonation and less faithful: anything the model does not implement is a place the sample can behave differently or stop.	Detonation, Dynamic analysis, Sandbox
Encoded command	An encoded command is a script passed to an interpreter in an encoded form, most commonly base64, so that the command line records the encoding rather than the instructions. Decoding it is routine and is done during analysis, because the decoded text is the thing that describes what was actually asked for.	Obfuscation, AMSI, LOLBin
Entropy	Entropy is a measure of how random a stretch of bytes looks, on a scale of zero to eight, and a section of a program that scores near eight is usually compressed or encrypted rather than ordinary code.	Packer, PE file, Detect It Easy
Entry point	The entry point is the address in a file where execution begins once the loader has finished mapping it into memory. It is the first thing a disassembler is pointed at, and a packed file's entry point belongs to the unpacking routine rather than to the program the file will eventually become.	Original entry point, Packer, PE file
Environmental keying	Environmental keying makes a payload decryptable only on a machine with particular properties, such as a domain name, a username or a hardware identifier, by deriving the key from those values rather than carrying it. A sample keyed this way runs correctly on its target and does nothing anywhere else, including in a sandbox.	Anti-VM, Cryptor, Sleep evasion
ETW	ETW, Event Tracing for Windows, is the tracing facility built into the Windows kernel itself, which lets a sandbox record process, file, registry and network events from below the application layer instead of from a tool the sample could tamper with.	Agentless, Dynamic analysis, Process tree
ETW tampering	Event Tracing for Windows is the operating system's own telemetry pipeline, and tampering with it means interfering with the path between a provider and the session recording it so that events stop being written. It is worth stating plainly that a telemetry layer which can be silenced from inside the machine is a layer that has to be corroborated from outside it.	ETW, Agentless, VMI
Export table	The export table lists the functions a library offers to other modules, by name and by ordinal. It is read during triage because a library exporting one oddly named function, or exporting nothing at all, describes how it expects to be loaded.	Import address table, PE file, DLL side-loading

Term	Definition	See also
Fast flux	Fast flux is the practice of changing the addresses a hostname resolves to very frequently, so that blocking any single address accomplishes little. It is one reason a domain observed in a report is recorded alongside the addresses it resolved to at the time rather than instead of them.	DNS query, IOC, C2
Fat binary	Mach-O container holding several architecture slices behind a big-endian fat_header (magic 0xcafebabe, 0xcafebabf for the 64-bit form) plus one fat_arch record per slice giving cputype, offset and size. Slices are independent images and need not match, so triage extracts and hashes each separately.	Magic bytes, Symbol table, PE file
fexecve	Runs the program behind an open file descriptor rather than a path, typically a descriptor from memfd_create that is backed by anonymous memory alone. The process then has no directory entry, and /proc/<pid>/exe reads as /memfd:name (deleted), which is the artifact worth hunting.	Fileless, Reflective loading
FIB (File Information Block)	Header at the start of the WordDocument stream of a legacy .doc file, mapping nearly every other structure in it. Bit 0x200 of the 16-bit field at offset 0x0A decides whether those offsets index the 0Table or the 1Table stream, and a parser that ignores it reads garbage.	Maldoc, OLE, VBA stomping
Fiber	Cooperatively scheduled execution context living inside one thread: ConvertThreadToFiber promotes the caller, then CreateFiber and SwitchToFiber run further contexts on that same kernel thread. Nothing is created kernel-side, so thread- creation telemetry and naive stack walks miss the switched-in code.	FLS callback, Call stack
File carving	Carving recovers a file from a larger blob such as a memory image, a disk region or a network capture, by finding the structures that mark where one begins and ends rather than by reading a directory that points at it. It is how a payload that was never written to disk under a name still becomes a file an analyst can hash.	Magic bytes, Memory forensics, Slack space
File infector	A file infector is malware that modifies existing executables on a machine so that they carry and run its code in addition to their own. It matters operationally because a file infector turns ordinary programs into samples, and cleaning becomes a question about every modified file rather than about one.	Code cave, Persistence, Entry point
File system minifilter	Registered with the filter manager through FltRegisterFilter, a minifilter supplies pre- and post-operation callbacks for file I/O rather than handling raw IRPs. Its altitude number fixes where it sits in the stack, and abusing that ordering is how a driver hides files from filters above it.	Rootkit, BYOVD, Hooking
File system tunneling	NTFS and FAT hold the metadata of a deleted or renamed name for about 15 seconds and hand it back when the same name reappears, so the replacement inherits the old creation time and 8.3 short name. Timelines that look timestomped are sometimes only this cache, sized by MaximumTunnelEntryAgeInSeconds.	Timestomping, Fixup array
FILE_OBJECT	Every open instance of a file gets one from the I/O manager, carrying DeviceObject, FsContext (the FCB), FsContext2 and SectionObjectPointer. Memory forensics walks process handle tables to reach them, listing open files and following SECTION_OBJECT_POINTERS to the cached file data.	Memory forensics, VAD
Fileless	Fileless describes activity that leaves little or nothing on disk because the code lives in memory, in a registry value or in a script passed to an interpreter that is already installed. The name is a statement about where to look rather than a claim that nothing is written.	Memory forensics, LOLBin, Registry hive
Firmware volume	UEFI flash images are built from firmware volumes: a header carrying the _FVH signature, then GUID-named FFS files whose sections hold PE32+ modules such as DXE drivers. An implant arrives as one added or swapped FFS file, which is why volumes get diffed against a known-good image.	Bootkit, Flash descriptor, Persistence
Fixup array	Multi-sector NTFS structures store the last two bytes of every sector in a header array and overwrite them with an update sequence number. Records read straight off a raw image stay malformed until those bytes go back, so hand-parsed MFT and INDX records get the fixup applied first.	File carving, File system tunneling
Flash descriptor	First region of an SPI flash image on x86 platforms, holding the offsets of the other regions plus a matrix of which bus master may read or write each one. A descriptor or BIOS region left writable from the running operating system is the opening a firmware implant needs.	Firmware volume, Bootkit, Persistence
FLOSS	FLOSS is an open-source tool that recovers the strings a program hides from a plain strings dump, including stack strings, decoded strings and those unpacked only at runtime, which is often where the URLs and keys are.	Static analysis, Packer, capa
FLS callback	FlsAlloc registers a destructor that the loader invokes on fiber deletion, thread exit or FlsFree. Older builds keep the callback pointers in a table hanging off the PEB, newer ones in a loader- owned global, with per-thread slot values at TEB->FlsData. Overwriting an entry buys execution at process teardown.	TLS callback, Fiber, PEB
Forwarded export	An export whose address field points inside the export data directory instead of at code: the RVA resolves to an ASCII string such as "ntdll.RtlAllocateHeap", and the loader binds the caller to that other module. Import-resolution code and proxy- DLL work both turn on spotting the difference.	Export table, Import address table, DLL side-loading
Frame pointer omission	Compilers free EBP for general use and address locals off ESP at displacements that shift as the function runs. FPO records in the debug directory (IMAGE_DEBUG_TYPE_FPO, type 3) carry the frame layout an unwinder needs; lacking them, a 32-bit stack walk truncates or invents callers.	Call stack, Debug directory, PDB path
FVEK	The Full Volume Encryption Key that encrypts a volume's sectors, itself wrapped in the volume metadata by a separate volume master key. It sits in kernel pool memory for as long as the volume stays mounted, so memory forensics carves it from a RAM image or hibernation file and mounts the disk offline.	Memory forensics, Bootkey, Memory dump

Term	Definition	See also
Gadget chain	In a deserialization attack, an ordered set of classes already on the target's classpath whose readObject implementations and property setters call one another until control reaches a dangerous sink such as a runtime exec or a reflective invoke. The payload carries no new code, only an object graph that wires existing methods together.	ROP, Shellcode, Fileless
GDI bitmap primitive	Kernel exploitation pattern that upgrades a limited write into arbitrary read and write by corrupting the pvScan0 pixel pointer in a bitmap's SURFACE object, then calling GetBitmapBits and SetBitmapBits against the target address. A manager and worker bitmap pair keeps it reusable. Later Windows builds split that header out under type isolation.	BYOVD, Heap spray, ROP
GDI object abuse	Kernel exploitation pattern that turns a limited write into arbitrary read and write by corrupting the pvScan0 pointer of a kernel bitmap, then reading and writing through GetBitmapBits and SetBitmapBits. A manager and worker bitmap pair keeps the primitive reusable. Type isolation split the bitmap header from its pixel buffer in Windows 10 1709 and broke the classic form.	BYOVD, Heap spray, ROP
GDT call gate	Descriptor in the Global Descriptor Table whose privilege level lets ring 3 far-call it, jumping to ring 0 at the selector and offset held in the descriptor. No mainstream kernel installs one of these legacy transfers, so an unexplained call gate in a GDT read out of a memory image is itself the finding; the table is per processor.	Rootkit, Memory forensics, Hooking
Global Offset Table (GOT)	Writable table of resolved addresses in an ELF image, reached through PLT stubs and filled slot by slot on first call under lazy binding. Overwriting one entry reroutes a library call with no change to executable pages, so the table gets diffed against the on-disk relocations and checked for whether full RELRO mapped it read-only.	Import address table, Hooking, GNU IFUNC
GlobalFlag	REG_DWORD under an image's Image File Execution Options key; bit 0x200 turns on silent process exit monitoring for that binary. A matching SilentProcessExit key with ReportingMode and MonitorProcess then has the error reporting service launch a chosen program every time the target dies, a persistence slot most autorun listings never enumerate.	Run key, Persistence, Registry hive
Glue record	Address record for a name server that lives inside the zone it serves, published in the parent zone beside the delegation to break that circular dependency. Glue pins an address at the registry side, which matters when mapping hostile infrastructure, and resolvers bailiwick-check it because glue for unrelated names was a classic cache poisoning route.	DNS query, Fast flux, Sinkhole
GNU debuglink	The .gnu_debuglink section points a stripped ELF at its separate debug object: the bare file name, padding to a four-byte boundary, then a CRC32 over that file's whole contents. Debuggers look beside the binary, in a .debug subdirectory and under the global debug directory, and refuse a file whose CRC does not match.	PDB path, Symbol table, Debug directory
GNU IFUNC	Symbols typed STT_GNU_IFUNC resolve through a small resolver routine that the dynamic loader calls at relocation time, storing the returned address into a GOT slot via an R_*_IRELATIVE relocation. Resolver code therefore runs before main and ahead of most constructors, an early and quiet entry point for a backdoored shared object.	Global Offset Table (GOT), Entry point, Loader
Golden image	A golden image is the prepared, known-good virtual machine that every analysis starts from, kept read-only so that no sample can affect the next one. Everything about it is part of the experiment, from the installed software and documents to the user profile and hostname, because a sample that can tell it is not an ordinary desktop may decide not to run.	Snapshot, Sandbox, Anti-VM
Golden SAML	Forging SAML assertions with a stolen token-signing private key. The forged assertion validates against the published public certificate, so a relying party grants any identity and any claim, multi-factor included, while the identity provider logs no sign-in because none happened. Hunting moves to signing-key access and service-side token use.	Token impersonation, Persistence
GREASE	GREASE (Generate Random Extensions And Sustain Extensibility, RFC 8701) inserts reserved dummy code points such as 0x0a0a and 0x1a1a into a client hello's cipher suites, extensions, supported groups and ALPN list, keeping peers tolerant of values they have never seen. A fingerprinter must strip them before hashing, or one client yields a fresh JA3 or JA4 per connection.	JA3, JA4, TLS key log
Group Policy Preferences cpassword	Preference XML under SYSVOL (Groups.xml, Services.xml, ScheduledTasks.xml, Drives.xml) that stores a local account password in a cpassword attribute, encrypted with a fixed AES key printed in the protocol documentation. Any authenticated domain user can read the share, so the value decrypts offline; a 2014 patch blocked new ones and left old files in place.	Scheduled task, Persistence
Guard page	A page marked PAGE_GUARD raises STATUS_GUARD_PAGE_VIOLATION on the next access and then loses the flag, which makes it a one- shot alarm. Debuggers build memory breakpoints on that alarm; packers invert it, jumping into a guarded RET that executes normally once a debugger has swallowed the violation.	Anti-debugging, Hardware breakpoint, Packer

Term	Definition	See also
HalDispatchTable	The kernel function-pointer array in ntoskrnl whose second entry is reachable from user mode through the undocumented NtQueryIntervalProfile call. Overwriting HalDispatchTable+0x8 (+0x4 on x86) with the address of a payload turns an arbitrary- write bug into kernel execution; kernel CFG breaks the naive form.	BYOVD, HVCI, Rootkit
Halo's Gate	A repair for Hell's Gate on a hooked ntdll. When a stub opens with a jmp rather than mov r10, rcx, the resolver steps 32 bytes at a time to the stubs on either side, reads a clean system service number there, then adds or subtracts the hop count, because adjacent stubs hold adjacent numbers.	Hell's Gate, Indirect syscall, Unhooking
Handle hijacking	Rather than calling OpenProcess on a guarded target, the caller enumerates open handles with NtQuerySystemInformation, finds a process that already holds one, opens that process with PROCESS_DUP_HANDLE and copies the handle across with NtDuplicateObject. Telemetry watching for opens of the target sees nothing.	Token impersonation, Process dump, Direct syscall
Hardened runtime	A macOS code-signing option, the CS_RUNTIME flag, that enables library validation, ignores DYLD_INSERT_LIBRARIES and denies task ports to other processes. Exception entitlements undo it: com.apple.security.cs.disable-library-validation lets a signed and notarised app load unsigned dylibs again.	DLL side-loading, Injector
Hardware breakpoint	A hardware breakpoint is a stop set through processor debug registers rather than by rewriting the instruction at the target address, so the code in memory is unchanged. That property is why it is used on code that checks itself, and also why programs that look for debuggers read those registers.	Anti-debugging, Hooking, Dynamic analysis
Hardware-enforced Stack Protection	Shadow stacks in silicon: each CALL also writes the return address to a second stack that ordinary stores cannot reach, and RET compares the two copies, raising a control-protection fault (#CP) on a mismatch. An image opts in at link time via an extended DLL characteristics flag in its debug directory, and the check voids the return-address overwrites a ROP chain rests on.	ROP, Control Flow Guard, Call stack
Heap feng shui	Grooming an allocator with a scripted run of allocations and frees so the object a bug corrupts lands beside one whose contents are attacker-controlled. Named in 2007 for browser script exploitation, it is the deterministic-layout work behind most use-after-free write-ups, as opposed to blind spraying.	Heap spray, NOP sled, Shellcode
Heap spray	A heap spray fills a process's memory with many copies of the same content so that an address chosen more or less blindly is likely to land in it. It appears in analysis as a sudden, very repetitive growth in allocated memory before anything else happens.	Shellcode, NOP sled, Memory forensics
Heaven's Gate	Heaven's Gate is the name given to a transition from 32-bit to 64-bit execution inside a single process on 64-bit Windows. It is worth knowing because tooling that assumes one architecture per process can lose the trace at the moment of the switch.	WOW64, Syscall, Dynamic analysis
Hell's Gate	Resolving system service numbers at run time rather than trusting an import: walk the PEB to the ntdll base, parse its export table, read the number out of each stub's 4c 8b d1 b8 prologue, then issue the syscall instruction from private memory. A hooked stub whose prologue no longer matches defeats it.	Direct syscall, Halo's Gate, Heaven's Gate
Hiberfil.sys	The Windows hibernation image at the volume root, written on hibernate and on a Fast Startup shutdown. A PO_MEMORY_IMAGE header carries the signature hibr, or wake once the system has resumed, ahead of Xpress-compressed page ranges (plain LZ77 or Huffman-coded by version) that forensic tooling expands back into a physical memory dump.	Memory forensics, Memory dump
Honeyclient	A client-side honeypot that goes out and visits suspect URLs from an instrumented machine instead of waiting to be contacted. High-interaction builds drive a real browser and diff files, registry keys and processes after each visit; low-interaction ones emulate a browser and score the markup and script that come back.	Detonation, Dynamic analysis, Sandbox
Hooking	Hooking is the redirection of a function call to code of someone else's choosing, whether by rewriting the first instructions of the target or by changing the table an indirect call reads. Both defensive tools and malware use it, so a hook is a fact to attribute rather than a verdict.	Unhooking, Import address table, Direct syscall
Host Protected Area	Sectors at the end of an ATA disk hidden by SET MAX ADDRESS, which lowers the capacity IDENTIFY DEVICE reports so neither firmware nor the operating system ever addresses them. READ NATIVE MAX ADDRESS still returns the true size, and the gap between the two numbers is what an imager must capture separately.	Slack space, File carving, Bootkit
Hotpatch prologue	The two-byte mov edi, edi at the head of x86 system DLL exports, with five bytes of inter-function padding in front of it. A hooking engine writes a five-byte jmp into that padding and swaps the no-op for a short jump back into it, so hook checks compare those seven bytes against a clean copy read from disk.	Hooking, Unhooking, Direct syscall
HVCI	Hypervisor-protected code integrity: a higher-privileged hypervisor programs SLAT permissions so no kernel page is writable and executable at once, and a secure kernel checks a page's signature before it may execute. Unsigned driver code stops loading, which is why an operator brings a signed vulnerable driver instead.	BYOVD, Bootkit, HalDispatchTable
hVNC	Hidden VNC: the implant makes a second Win32 desktop with CreateDesktopW, binds a thread to it with SetThreadDesktop, starts a shell and a browser there, and streams that desktop's framebuffer to the operator. The screen the victim watches never changes, so fraud checks tied to the live session still pass.	RAT, Stealer, Keylogger
Hypervisor	A hypervisor is the software layer that creates and runs virtual machines, and because it sits underneath the guest operating system it can watch that guest without anything inside the guest being able to see it.	Agentless, VMI, Sandbox

Term	Definition	See also
Image base	The image base is the address a compiled file was built to load at. When it cannot be honoured the loader places the file elsewhere and applies the relocation table, which is why a memory image and the file on disk can differ byte for byte while being the same program.	Relocation table, PE file, Memory forensics
Imphash	An imphash is a hash of the list of functions a Windows program imports, and because that list survives a recompile that changes every byte of the file, it groups builds of the same family together where a file hash cannot.	PE file, ssdeep, TLSH
Import address table	The import address table is the array of function pointers a module's calls go through, filled in by the loader once the libraries are mapped. It is read statically to learn what a program intends to call, and watched at run time because rewriting an entry redirects every call that uses it.	Imphash, Hooking, API hashing
Indirect syscall	An indirect system call reaches the kernel by jumping to the transition instruction inside the legitimate system library instead of issuing it from the program's own memory. It exists because the simpler direct form is conspicuous, and it is one more reason recording from outside the machine is worth its cost.	Direct syscall, Syscall, VMI
Infection marker	An infection marker is anything a sample creates so that a later copy of itself can tell the machine is already compromised and exit, most often a named kernel object, a file or a registry value. Analysts value markers because they are stable across builds and make a precise, low-noise detection.	Mutex, IOC, Persistence
Injector	An injector is code whose purpose is to get other code running inside a process that is not its own, by allocating memory there, writing to it and arranging for it to execute. What makes it visible is not any single step but the sequence, performed across a process boundary.	APC injection, Process hollowing, Thread hijacking
IOC	An IOC, or indicator of compromise, is one concrete observable that can be searched for elsewhere. An address, a domain, a URL, a file hash, a mutex, a registry key, a file path, an email address and a TLS fingerprint all qualify.	Defanging, STIX, MISP

Term	Definition	See also
JA3	JA3 is a fingerprint computed from the way a client opens a TLS connection, and it identifies the software doing the talking even when the traffic itself is encrypted and the destination changes.	JA4, TLS key log, PCAP
JA4	JA4 is the newer generation of TLS client fingerprinting, designed to be more stable and more readable than JA3 and to resist the trivial reshuffling that let a client change its JA3 at will.	JA3, TLS key log, PCAP
JIT spraying	Exploitation that makes a just-in-time compiler write the payload. Long chains of XOR constants in script compile into predictable executable pages with the immediates intact, and entering a byte or two past an instruction boundary reinterprets those immediates as code. Constant blinding is the standard countermeasure.	Heap spray, Shellcode, NOP sled
Jitter	Jitter is deliberate randomness added to the interval between a compromised machine's check-ins, so that the pattern does not appear as a fixed heartbeat in traffic records. It is why beacon detection reasons about a distribution of intervals rather than about one number.	Beacon, C2, PCAP
JNI_OnLoad	The Java Native Interface initialiser a runtime calls the moment a native shared library is loaded, before any method declared native in Java can run. Packed mobile libraries park their ptrace anti-debug checks and their RegisterNatives table here, so the Java-name-to-native-routine mapping exists only at runtime.	Anti-debugging, Export table, Packer
Job object	A Windows kernel object that manages a set of processes as a unit: AssignProcessToJobObject adds members and JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE kills every member when the last handle closes. Escape needs both JOB_OBJECT_LIMIT_BREAKAWAY_OK on the job and CREATE_BREAKAWAY_FROM_JOB at spawn. IsProcessInJob answers the membership question, a weak tell since jobs became nestable.	Sandbox, Process tree
Journal ($UsnJrnl:$J)	NTFS logs one record per metadata change into a sparse alternate data stream, \$Extend\$UsnJrnl:$J, each carrying file and parent reference numbers, a timestamp and a reason bitmask such as USN_REASON_FILE_DELETE (0x200). Records outlive the MFT entries they name, so files a dropper created and deleted still surface.	Timestomping, File carving, Prefetch
JScript.Encode	An encoding for script source that opens with the marker #@~^, ends with ^#~@, and normally arrives as .jse or .vbe or inline under that language attribute. The body is a keyless substitution over three rotating alphabets, decoded by the scripting host at load, so it beats naive string matching and nothing beyond it.	Obfuscation, Encoded command, Maldoc
Jump-oriented programming (JOP)	Code reuse without a single ret: functional gadgets end in an indirect jmp or call, and a dispatcher gadget steps a register that serves as virtual program counter through a table of gadget addresses. Shadow stacks and return-address checks stay quiet because no return executes; indirect-branch tracking is what bites.	ROP, Shellcode
Junction point	A directory-only NTFS reparse point tagged IO_REPARSE_TAG_MOUNT_POINT that redirects one path to another target. Creating one needs no SeCreateSymbolicLinkPrivilege, only write access to an empty directory, unlike a file symlink. Chained with an object manager symlink under \RPC Control, it aims a privileged service's write or delete at a chosen path.	Alternate data stream, Journal ($UsnJrnl:$J)
Junk byte insertion	Anti-disassembly padding: an unreachable byte sits on the fall- through side of a branch that is always taken, for instance a jz following xor eax,eax. A linear sweep decodes it as an opcode head and drifts out of phase with the real code. Variants hide the byte after a call whose callee pops the return address instead.	Opaque predicate, Obfuscation
Just-in-time debugger (AeDebug)	The postmortem debugger the OS launches when a process dies on an unhandled exception, named in the Debugger REG_SZ under the machine-wide Windows NT\CurrentVersion\AeDebug key, with Auto set to 1 to suppress the dialog. Writing that value takes admin and yields execution on the next crash of anything, with the faulting process id and an event handle as its %ld arguments.	Persistence, Application shim, Anti-debugging

Term	Definition	See also
kallsyms	Linux publishes its kernel symbol table at /proc/kallsyms, with pointer values zeroed for unprivileged readers whenever kptr_restrict is set. Module rootkits read it to locate unexported targets such as the syscall table. Since kallsyms_lookup_name stopped being exported in 5.7, implants recover the address by registering a kprobe on it.	Rootkit, Kprobe, Symbol table
KDBG	Windows keeps the _KDDEBUGGER_DATA64 block in kernel memory, holding the addresses of PsActiveProcessHead and PsLoadedModuleList plus build metadata. Memory forensics scans a raw dump for its signature to bootstrap process and module listing; on 64-bit builds since Windows 8 the block is stored encoded and its pointers are garbage until that transform is reversed.	Memory forensics, Memory dump, Rootkit
Kernel DMA Protection	An IOMMU-enforced limit on which physical memory a hot-plugged PCIe peripheral may address, aimed at drive-by DMA attacks on a locked machine. Devices whose drivers support DMA remapping are confined to assigned ranges; the rest stay unstarted until an authorised sign-in. The same gate blocks DMA-based memory acquisition.	Memory forensics, Memory dump
Kernel Patch Protection	A periodic integrity check in 64-bit Windows kernels covering the SSDT, the IDT and GDT, the loaded module list and kernel code sections; a mismatch bugchecks with 0x109 CRITICAL_STRUCTURE_CORRUPTION. Its arrival pushed kernel implants toward data-only tampering and toward loading signed but vulnerable drivers.	BYOVD, Rootkit, Direct syscall
Kernel Transaction Manager	The Windows transaction engine behind transactional NTFS, entered through CreateTransaction and CreateFileTransacted. A payload written inside a transaction can be mapped as a section and the transaction then rolled back, leaving an image in memory whose backing file never existed on disk; that gap is the doppelganging primitive.	Process hollowing, Fileless, Manual mapping
KernelCallbackTable	The PEB field pointing at the array of user-mode callbacks that win32k dispatches into when a GUI process handles window messages; it is filled in once user32.dll loads. Injection copies the table, repoints the fnCOPYDATA entry at shellcode, writes the copy back into the target PEB, then sends WM_COPYDATA to fire it.	PEB, Shellcode, Hooking
Keylogger	A keylogger records what is typed, either by asking the operating system for a copy of input events or by reading the state of the keyboard repeatedly. In a report the useful evidence is the capture mechanism and the file the captured text accumulates in.	Stealer, Hooking, Persistence
Kill chain	A kill chain is a model that breaks an intrusion into ordered stages, from reconnaissance through to action on the objective, so that observations can be placed relative to one another. It is a description of shape, and a single analysis usually shows only part of one.	MITRE ATT&CK, TTP, Process tree
Kill switch	A kill switch is a condition a sample checks that, when satisfied, makes it stop: a reachable domain, a present file, a particular keyboard layout. It is worth locating because it explains an analysis in which nothing happened, and because it is a fact about intent.	Environmental keying, DGA, Detonation
KiUserExceptionDispatcher	Every user-mode exception lands here first: the kernel points the faulting thread's context at this undocumented ntdll routine, which walks the registered handlers through RtlDispatchException. A hook on its opening bytes sees each exception before any handler, which works equally as a control- flow hijack and as an anti-debug tripwire.	Hooking, Anti-debugging, Hardware breakpoint
KnownDlls	An object manager directory holding section objects that the session manager creates at boot for the core system libraries listed under its KnownDLLs registry key. A load whose base name matches one is satisfied from the existing section, so the search path never runs and a section planted there outranks the file in System32.	DLL search order, DLL side-loading, Manual mapping
Kprobe	A Linux kernel instrumentation trap. Registration copies the probed instruction and overwrites its first byte with int3, so the handler runs before the original; a kretprobe adds a return hook by swapping the saved return address for a trampoline. Rootkits and eBPF implants attach here, and /sys/kernel/debug/kprobes/list is worth reading during triage.	Hooking, Rootkit, kallsyms
kthreadd	PID 2 on Linux and the parent of every kernel thread. Listings print those threads in brackets only because /proc/<pid>/cmdline is empty; the real test is PPID 2 plus an unreadable /proc/<pid>/exe and no mappings. A userland binary renamed to [kworker/0:1] passes the eye test and fails all three.	Rootkit, Process tree, kallsyms
KUSER_SHARED_DATA	A kernel structure mapped read-only into every user process at the fixed address 0x7FFE0000. Malware reads its fields directly instead of calling an API a monitor could hook: KdDebuggerEnabled at 0x7FFE02D4 betrays a kernel debugger, and the tick and time fields give a clock no user-mode hook can slow down.	Anti-debugging, Anti-VM, PEB

Term	Definition	See also
Landing pad	Under CET Indirect Branch Tracking, the ENDBR64 or ENDBR32 instruction that must sit at the target of every indirect call or jump; a branch landing elsewhere raises a control-protection (#CP) exception. Gadget hunting narrows to sequences starting on an existing ENDBR, with returns constrained separately by shadow stacks.	ROP, Control Flow Guard, Shellcode
Lazy binding	ELF symbol resolution deferred until a symbol is first called. The PLT stub jumps through a GOT slot that initially points back into the dynamic linker, whose _dl_runtime_resolve looks the symbol up and writes the real address into that slot. Under a BIND_NOW link everything resolves at load instead, and an early GOT dump shows filled slots rather than linker stubs.	Import address table, Export table, Hooking
LD_AUDIT	Environment variable naming a shared object that ld.so loads into its rtld-audit interface, where la_objopen observes every image loaded and la_symbind32 or la_symbind64 may return a different address for a symbol binding. Interception placed here sits under detections written around LD_PRELOAD.	Hooking, Lazy binding, Injector
Length disassembler engine	A minimal x86/x64 decoder that returns instruction length and nothing about semantics. Inline hooking needs one to copy whole instructions into a trampoline before a prologue is overwritten with a jump; a trampoline that ends mid-instruction executes garbage the first time the hook returns into it.	Hooking, Unhooking, Code cave
Live memory snapshot	A live memory snapshot is a saved copy of a running virtual machine's RAM and CPU state, so the machine can be resumed exactly where it was rather than booted again. That is how a sandbox can have a warm, logged-in desktop ready in about three seconds.	Snapshot, Sandbox, Detonation
Load command	A variable-size record following the Mach-O header that tells the dynamic loader how to map and start an image: LC_SEGMENT_64 for layout, LC_LOAD_DYLIB for each dependency, LC_CODE_SIGNATURE for the signature blob. An appended LC_LOAD_DYLIB entry loads a foreign library at launch and voids the existing signature.	Magic bytes, Import address table
Load configuration directory	IMAGE_LOAD_CONFIG_DIRECTORY, a PE data directory the loader reads before the image runs. It carries the /GS SecurityCookie, the x86 SafeSEH SEHandlerTable and the CFG fields GuardCFFunctionTable and GuardFlags, so its contents show which mitigations a binary was actually built with.	Control Flow Guard, PE file, Debug directory
Loader	A loader is the component that prepares a payload to run, decrypting it, mapping it into memory and transferring control, and it is frequently the only part written to disk. Families are often tracked by their loader, because that is the part that is reused while payloads change.	Dropper, Reflective loading, Unpacking
Loader lock	The per-process lock ntdll!LdrpLoaderLock serializes changes to the module list and is held for the whole of DllMain. Injected code that calls LoadLibrary from DllMain, or waits there on a thread that does, deadlocks the process. Manual mappers resolve imports outside the callback for exactly that reason.	Manual mapping, Reflective loading, DLL side-loading
LOLBin	A LOLBin, from living off the land binary, is a legitimate program already shipped with the operating system, such as powershell, certutil, mshta or rundll32, that an attacker uses to do their work so that nothing unfamiliar ever has to be installed.	BYOVD, Process tree, MITRE ATT&CK
Lookaside list	A cache of fixed-size kernel pool blocks. ExAllocateFromNPagedLookasideList pops the first entry and reaches the pool allocator only when the list is empty, and a freed entry returns to the list rather than to the pool, keeping its old contents until reuse. A memory image can therefore still yield objects the live lists no longer reference.	Memory forensics, VAD
Low Fragmentation Heap	The Windows user-mode heap front end, enabled for a size bucket after 18 consecutive allocations of that size and then served out of a UserBlocks region; requests above 16 KB never reach it. Exploit work grooms it because placement inside a UserBlock is predictable enough to seat a target object next to an overflow.	Heap spray, NOP sled, ROP
LSA protection	Running lsass.exe as a Protected Process Light at signer level PsProtectedSignerLsa-Light, turned on by the RunAsPPL value under HKLM\SYSTEM\CurrentControlSet\Control\Lsa. The kernel then strips memory read rights from handles opened by unprotected callers, pushing credential dumping toward a signed kernel driver.	BYOVD, LSA secrets
LSA secrets	Encrypted values under HKLM\SECURITY\Policy\Secrets: service account passwords in _SC_<name>, the NL$KM key protecting cached domain logons, and DPAPI_SYSTEM. Reachable as SYSTEM on a live host or offline from the SECURITY and SYSTEM hives, and many decrypt to cleartext rather than to a hash.	Registry hive, LSA protection, Stealer
LZNT1	The LZ77 variant selected by COMPRESSION_FORMAT_LZNT1 in RtlCompressBuffer and RtlDecompressBuffer, and the algorithm behind NTFS file compression. Packed samples call the same pair to unfold an embedded stage, so a high-entropy blob sitting beside those imports is worth decompressing during static triage.	Packer, Unpacking, Shellcode
LZXPRESS Huffman	Compression applied to prefetch files from Windows 10 onward. Such a file opens with the four bytes MAM\x04, signature plus algorithm byte, then a 4-byte uncompressed size; the SCCA record starts only after that. A parser written for the older format reads the header as garbage unless RtlDecompressBufferEx runs first.	Prefetch, File carving, Memory forensics

Term	Definition	See also
Macro	A macro is code embedded in an office document that the application can run when the file is opened, which is what makes a document that looks like a page of text able to behave like a program.	OLE, Dropper, Static analysis
Magic bytes	Magic bytes are the short, fixed sequence at the start of a file format that identifies it regardless of the file's name. File type in analysis is determined from content for exactly this reason: an extension is a claim by whoever named the file.	File carving, Detect It Easy, Static analysis
Maldoc	A maldoc is a document whose purpose is to start something other than the reading of a document, whether through an embedded macro, an object it links to or a feature of the format that fetches remote content. It is analysed as a container first: what is inside it and what it reaches for.	Macro, OLE, VBA stomping
Manual mapping	Manual mapping is loading a module into a process without asking the operating system loader, by performing the mapping, relocation and import resolution in the program's own code. Because the loader never ran, the module does not appear in the process's list of loaded modules, and it is found by scanning memory instead.	Reflective loading, Memory forensics, Injector
Mark of the Web	The mark of the web is a small piece of metadata that records that a file arrived from a network location, which is what makes an application open it more cautiously. Its presence or absence on a delivered file is a useful fact, because a delivery route that avoids setting it is a deliberate choice.	Alternate data stream, Maldoc, Decoy document
Memory dump	A memory dump is a copy of the memory of one process, or of the whole machine, taken at a point in time. It is where an unpacked payload, a decrypted configuration and injected code that has no file behind it are recovered from.	Memory forensics, Volatility, Unpacking
Memory forensics	Memory forensics is the examination of a machine's RAM rather than its disk, which is where injected code, unpacked payloads, live network connections and hidden processes are visible even when nothing malicious was ever written to a file.	Volatility, Packer, Dynamic analysis
Metamorphic	Metamorphic describes code that rewrites its own instructions each time it propagates, so that two copies differ in their code and not only in a layer wrapped around it. It is rarer than the polymorphic case and matters because pattern matching on instructions is a weaker identity for it.	Polymorphic, YARA, TLSH
MISP	MISP is a widely used open-source threat intelligence sharing platform, and a MISP event is the package format it reads: a set of attributes describing one incident or sample that other teams can import directly.	STIX, IOC, Defanging
MITRE ATT&CK	MITRE ATT&CK is a public catalogue of the tactics and techniques attackers actually use, each with a stable identifier such as T1055, which gives analysts a shared vocabulary for describing behaviour across different tools and reports.	TTP, Sigma, capa
Module stomping	Module stomping is overwriting the code of a legitimate library that has already been loaded, so that the memory holding the payload still belongs to a file on disk and still looks like a mapped module. It is detected by comparing what is in memory against the file it claims to come from.	Memory forensics, Manual mapping, Hooking
Mutex	A mutex is a named operating system object used to guarantee that only one copy of something runs at a time, and malware families often create one with a distinctive fixed name, which makes it a reliable indicator.	IOC, Dynamic analysis, Persistence

Term	Definition	See also
Named pipe	A named pipe is a Windows communication channel between processes that has a name and can be connected to like a file. It appears in analysis both as a legitimate mechanism and as a way for separate components of the same operation to talk without opening a network socket.	Mutex, Process tree, C2
Nanomite	Protector technique that strips conditional branches out of the code and leaves an INT3 byte in each slot. The packed process runs as a debugged child, and its parent catches each breakpoint exception, looks the fault address up in an encrypted table and rewrites the thread context to the real target. An ordinary debugger displaces the parent and the program dies.	Anti-debugging, Packer, Unpacking
NDIS filter driver	Network stack module attached between the miniport driver and the protocol drivers, seeing every frame through FilterSendNetBufferLists and FilterReceiveNetBufferLists. Capture and firewall software occupies that slot legitimately; hostile code lower in the same stack can strip its own frames before a capture filter above it sees them.	Rootkit, PCAP, BYOVD
Nested page tables	Second-level address translation done in hardware, where guest- physical addresses walk page tables the hypervisor owns before they reach host-physical memory. Introspection tooling maps a single guest page twice at that level, unmodified bytes for reads and patched bytes for execution. A hook placed this way survives code that inspects its own memory.	VMI, Hypervisor, Anti-VM
Netsh helper DLL	Persistence riding the netsh.exe extension mechanism. A DLL listed under the machine-wide Netsh key in the SOFTWARE hive loads into the netsh process on every run of the tool, and that DLL exports InitHelperDll, which calls RegisterHelper. Execution then follows any administrator or script that later runs netsh.	Persistence, LOLBin, Run key
Non-resident attribute	NTFS attribute whose content sits outside the MFT record, typically 1 KB, described instead by a run list of cluster extents. Small $DATA streams stay resident inside the record, so a short script or config can be carved from $MFT alone, while non-resident content means following the data runs across the volume.	File carving, Slack space, Alternate data stream
Nonpaged pool	Kernel heap that stays resident in physical memory so allocations can be touched at raised IRQL. Each allocation opens with a _POOL_HEADER carrying a four-character tag, and pool tag scanning walks those tags across a memory image to recover _EPROCESS and _FILE_OBJECT allocations that DKOM unlinking removed from the kernel lists.	Memory forensics, Big pool, VAD
NOP sled	A sled is a run of instructions that do nothing, placed before a payload so that control arriving anywhere in the run slides forward into it. It is a recognisable shape in memory and is one of the things a scan of a process image looks for.	Shellcode, Heap spray, Memory forensics
Notify routine	Kernel callback a driver registers to be told about process, thread and image-load events, for example through PsSetCreateProcessNotifyRoutineEx. The pointers live in arrays such as PspCreateProcessNotifyRoutine, and kernel write access from a vulnerable signed driver can zero one entry to blind that telemetry source without unloading anything.	BYOVD, ETW tampering, Rootkit
NT path	Object manager form of a file path, written \Device\HarddiskVolume3\Windows\System32\cmd.exe or with the \??\ prefix that resolves through DOS device symbolic links. Kernel telemetry, minifilter logs and ETW file events carry NT paths, so a rule matching on C:\ misses them until the volume link is resolved.	ETW, Notify routine
NtGlobalFlag	DWORD field in the PEB, at offset 0x68 on x86 and 0xBC on x64, holding process-wide debug heap flags. Creation under a debugger sets FLG_HEAP_ENABLE_TAIL_CHECK, FLG_HEAP_ENABLE_FREE_CHECK and FLG_HEAP_VALIDATE_PARAMETERS, so a test for mask 0x70 catches the debugger in two instructions with no API call left to hook.	PEB, Anti-debugging
NtQueryInformationProcess	Native ntdll routine reading process information classes, three of which leak debugger state: ProcessDebugPort (7) comes back non-zero, ProcessDebugObjectHandle (0x1E) yields a debug object handle, and ProcessDebugFlags (0x1F) returns 0 because it inverts the EPROCESS NoDebugInherit bit. Called directly, it steps over hooks placed on IsDebuggerPresent.	Anti-debugging, Direct syscall, Hooking
Null DACL	Security descriptor whose DACL pointer is NULL, which skips access checking and grants full control to any requester, the inverse of an empty DACL that is allocated with zero ACEs and denies everyone. On files, mutexes and services it makes them reachable from any token; on a writable system object it is an escalation path.	Mutex, Token impersonation, BaseNamedObjects

Term	Definition	See also
Obfuscation	Obfuscation is any transformation that keeps a program's behaviour while making it harder to read, from renaming and string encoding through to rewriting its control flow. It is not by itself evidence of malice, since commercial software uses it too, but it is a cost that has to be paid before static analysis says much.	Packer, Control flow flattening, String stacking
Object header (_OBJECT_HEADER)	Bookkeeping the object manager places immediately before every executive object body: PointerCount, HandleCount, TypeIndex and InfoMask. Set bits in InfoMask index nt!ObpInfoMaskToOffset to find the optional name, quota, process and creator headers in front of it, and TypeIndex is stored XORed with nt!ObHeaderCookie and the second byte of the header's own address.	Memory forensics, FILE_OBJECT, Big pool
ObRegisterCallbacks	Kernel routine that registers pre- and post-operation callbacks fired when a handle to a process, thread or desktop object is created or duplicated. A pre-operation callback can clear bits such as PROCESS_VM_WRITE out of DesiredAccess before the handle is granted, so unlinking its _CALLBACK_ENTRY_ITEM from the object type CallbackList quietly removes that guard.	BYOVD, Rootkit, ETW tampering
OLE	OLE is the Microsoft container format that lets one document embed another object inside it, and it is abused to carry an executable, a script or a second document hidden inside an ordinary looking file.	Macro, Dropper, Static analysis
One-gadget	A single address inside one specific libc build where a call to execve("/bin/sh", NULL, NULL) is already assembled, reachable in one control-flow transfer whenever its constraints hold, usually a register or a stack slot that must be NULL. An exploit that wins one jump and no chain aims there instead of building a ROP sequence.	ROP, Shellcode, Global Offset Table (GOT)
OOXML	The packaging behind .docx, .xlsx and .pptx: a ZIP of XML parts wired together by _rels/*.rels files, each relationship carrying a target and a TargetMode. Unzipping the package and reading those relationships comes first in triage, because a target marked External is a URL the application fetches when the document opens.	Maldoc, OLE, Macro
Opaque predicate	An opaque predicate is a condition whose outcome is fixed but not obviously so, inserted to make a reader or a tool believe both branches are reachable. Its purpose is to waste analysis effort on code that never runs.	Control flow flattening, Obfuscation, Static analysis
Operational Relay Box (ORB)	Mesh of compromised routers, cameras and other edge devices plus short-lease virtual servers that proxies operator traffic on its way to victims. Nodes rotate constantly and are shared between unrelated intrusions, so an egress address in a victim log names the relay, not the source, and blocking it ages out within days.	C2, Fast flux, Domain fronting
Opnum	Integer identifying one method inside an RPC interface, assigned by declaration order in the IDL rather than by name. A request carries the interface UUID and the opnum and nothing more, which leaves detection work dependent on a lookup table; opnum 3 of the directory replication interface is IDL_DRSGetNCChanges, the call behind credential replication abuse.	Named pipe, ETW, Sigma
Option ROM	Firmware stored on a PCI or PCIe device such as a network, storage or video adapter. Platform firmware maps and executes it during bus enumeration, while POST is still running and long before any OS loader. Code at that point sees an unrestricted machine, and Secure Boot answers by refusing unsigned legacy option ROMs.	Bootkit, Firmware volume, Rootkit
Ordinal import	Import bound by its index in the target library's export table instead of by name. The top bit of IMAGE_THUNK_DATA carries IMAGE_ORDINAL_FLAG and the low 16 bits hold the ordinal, leaving no IMAGE_IMPORT_BY_NAME string on disk. Triage tools substitute names from per-library ordinal tables, and imphash depends on that mapping being right.	Import address table, Export table, Imphash
Original entry point	The original entry point is where the real program starts once an unpacking layer has finished and handed control over. Finding it is the goal of unpacking, because the file dumped from that moment is the program the packer was hiding.	Entry point, Unpacking, Packer
Overlay	An overlay is data appended to an executable after the last part the loader maps, so it travels with the file and is never mapped as code. It is a common place for a configuration, a second file or a large encrypted payload, and it is extracted by size rather than parsed.	PE file, Entropy, File carving
OverlayFS	Linux union filesystem that stacks a read-only lowerdir under a writable upperdir and presents the merge as a single tree, copying a file up on first write. Container images are assembled this way, so the upperdir by itself is a diff of what a container wrote, and a deleted path appears as a whiteout, a 0/0 character device.	File carving, Memory forensics, Golden image

Term	Definition	See also
P-code	P-code is the compiled form an office macro is stored in alongside the source text a user would see. The two can disagree, which is why analysis reads the compiled form rather than trusting the readable source.	VBA stomping, Macro, Maldoc
Packer	A packer is a tool that compresses or encrypts a program and wraps it in a small stub that unpacks the original into memory at startup, which hides the real code from anyone reading the file on disk.	Entropy, Detect It Easy, Memory forensics
Parent process spoofing	Parent process spoofing is starting a process while telling Windows to record a different process as its parent, so that the resulting tree does not describe what actually happened. It is why a process tree built from kernel events is corroborated with the timing and the command lines rather than read as literal truth.	Process tree, LOLBin, Detonation
PCAP	A PCAP is a capture file holding the raw network packets recorded during a run, which can be replayed through detection engines or opened in a protocol analyser long after the sandbox is gone.	Suricata, DNS query, JA3
PDB path	The PDB path is the location of the symbol file recorded inside a compiled binary when it was built. It frequently survives into shipped malware and carries the build machine's folder structure, the project's internal name and sometimes the account it was built under.	Debug directory, Rich header, Static analysis
PE file	A PE file is a Windows executable image built to the Portable Executable format, an .exe, .dll, .sys or .ocx, whose headers, sections, imports, resources and signature are the raw material of Windows static analysis.	Imphash, Authenticode, Static analysis
PE section	A section is one contiguous, named region of a Windows executable with its own permissions, such as code, initialised data or resources. Section names, sizes and permissions are among the first things triage reads, because a section that is both writable and executable is unusual in ordinary software.	PE file, Entropy, Packer
PEB	The Process Environment Block is a structure in a process's own memory that holds facts about it: the command line, the loaded module list, the current directory and a flag saying whether a debugger is attached. It is read by analysis tools and by samples, which is why the values in it are treated as claims rather than as ground truth.	Anti-debugging, Memory forensics, Manual mapping
Persistence	Persistence is whatever a piece of malware does to survive a reboot: a registry Run key, a scheduled task, a service, a startup folder shortcut or a WMI subscription. It is usually the single most useful thing to find, because it is what has to be removed.	Run key, MITRE ATT&CK, Dynamic analysis
Polymorphic	Polymorphic describes a sample that changes its outward form on every copy, usually by re-encrypting the same payload under a new key with a freshly generated decryption routine. The payload underneath is constant, which is why memory is where it is identified.	Metamorphic, Cryptor, Unpacking
Prefetch	Prefetch files are records Windows keeps to speed up the launching of programs, and as a side effect they record that a program ran, roughly when, and some of what it touched. They are a forensic artifact rather than an analysis output, and they are useful precisely because nothing intended them as evidence.	Persistence, Memory forensics, Process tree
Process dump	A process dump is a copy of one running process's memory written out for later examination. It is the standard way to recover a payload that only ever exists after unpacking, because the file on disk never contained it in that form.	Memory dump, Unpacking, Volatility
Process hollowing	Hollowing is starting a legitimate program in a suspended state, replacing the code that was mapped for it with different code, and then letting it run. The result is a process whose name, path and signature belong to one program and whose behaviour belongs to another.	Injector, Image base, Process tree
Process tree	A process tree is the parent-and-child map of everything a sample started, directly or indirectly, which is what turns a flat list of events into a readable story of what launched what and with which command line.	Dynamic analysis, LOLBin, ETW

Term	Definition	See also
qcow2	Copy-on-write disk image format whose header magic is QFI followed by 0xfb, mapping 64 KB clusters through two levels of tables and optionally naming a backing file. Analysis VMs run as thin overlays over a golden base image. A revert throws away one layer, and the overlay read on its own yields only the clusters a run wrote.	Snapshot, Live memory snapshot, Golden image
qdisc	Linux attaches a queueing discipline to each interface through tc, and the clsact qdisc adds ingress and egress hooks where BPF_PROG_TYPE_SCHED_CLS programs run. Code sitting there reads and rewrites packets outside netfilter, so iptables and nftables dumps stay clean; hunting means listing tc filters and pinned objects under /sys/fs/bpf.	Rootkit, C2, Persistence
QNAME minimisation	Resolver behaviour standardised in RFC 9156: instead of forwarding the whole query name upstream, a recursive sends the root and TLD servers only one label past the delegation it already knows. The full encoded labels of a tunnel or a generated domain therefore reach only the authoritative server for the deepest matching zone.	DNS query, DGA, Sinkhole
QueryDosDevice	Translation from a DOS device name such as C: to the object manager symbolic link behind it, typically \Device\HarddiskVolume3. Passing NULL instead enumerates every DOS device name in the session. Kernel, ETW and minifilter telemetry record paths in NT form, and normalising them back to drive letters runs through this call.	ETW, Rootkit, Named pipe
QueryPerformanceCounter	Win32 high-resolution timer read that anti-analysis code uses in place of RDTSC. Two calls bracketing a short block expose the delay added by a single-stepping debugger or an instrumented hypervisor. Current builds answer it in user mode from the TSC and the scaling fields in KUSER_SHARED_DATA, leaving no syscall for a breakpoint to catch.	Anti-debugging, Anti-VM, Hardware breakpoint
QueryWorkingSetEx	Per-page working set state, returned in PSAPI_WORKING_SET_EX_INFORMATION with VirtualAttributes bits for Valid, Shared, ShareCount and Locked. A debugger writing 0xCC into an image page forces copy-on-write, so the page loses Shared and a sample can read its own breakpoints; an untouched decoy page that turns Valid says something outside the process read it.	Anti-debugging, Process dump, Unpacking
QUIC Initial packet	A QUIC handshake opens with a long-header Initial packet carrying the ClientHello inside CRYPTO frames. Its protection keys come from HKDF over a salt published per QUIC version and the cleartext Destination Connection ID, so a passive observer can decrypt the payload and read SNI, ALPN and cipher order out of opaque UDP 443 traffic.	TLS key log, PCAP
QuickLook cache	Preview generation on macOS records every previewed file in a thumbnail cache under a randomised /private/var/folders path, an index.sqlite with files and thumbnails tables alongside a raw thumbnails.data blob. Rows outlive the original file and prove a document was present, even on a volume that has since been unmounted.	Prefetch, File carving, Timestomping

Term	Definition	See also
Ransom note	A ransom note is the file or screen left behind to tell the person at the keyboard what has happened and what is being demanded. In analysis it is treated as an artifact to record and quote from carefully, and it is not evidence that the data is recoverable.	Wiper, Decoy document, IOC
RAT	A remote access tool gives an operator interactive control of a machine, covering files, screen, input and shell, rather than performing one fixed task. Analytically it is recognised by a persistent channel and a command dispatcher rather than by any single action.	C2, Beacon, Keylogger
Reflective loading	Reflective loading is a module loading itself from a buffer already in memory, performing its own mapping and import resolution, so that nothing is written to disk and the operating system loader is never involved. It is one of the main reasons memory is examined separately from files.	Manual mapping, Fileless, Memory forensics
Registry hive	A hive is one of the files the Windows registry is actually stored in, each holding a subtree of keys and values. Analysis reads hives directly, offline, because that shows what is on disk rather than what a running system chooses to report.	Run key, Persistence, COM hijacking
Relocation table	The relocation table lists the places in a compiled file that hold an address and therefore have to be adjusted if the file is not loaded where it was built to load. A file stripped of it can only run at one address, which is itself a fact worth recording.	Image base, PE file, Manual mapping
Resource section	The resource section is the part of a Windows executable that carries non-code items: icons, version information, dialogs, manifests and arbitrary embedded blobs. It is a common hiding place for a second file, and its version information is often the most human-readable thing in a sample.	PE file, Application manifest, Overlay
Retro-hunt	A retro-hunt is running a detection rule backwards over samples already stored, to find the ones that would have matched it. It is how you discover that a family you learned about today has been in your collection for months.	YARA, SHA-256, Static analysis
Rich header	The Rich header is an undocumented block Microsoft's linker leaves in a Windows executable recording the tools and versions that built it, which makes it useful both for grouping builds and for spotting a file whose header and code disagree about their origin.	PE file, Imphash, Static analysis
Rootkit	A rootkit is code that changes what the system reports about itself so that files, processes, keys or connections are not listed to the tools that ask. Because the answer cannot be trusted from inside, the counter-measure is to measure from outside the machine.	Bootkit, VMI, Agentless
ROP	Return-oriented programming builds a computation out of short sequences that already exist in the loaded code, chained by return instructions, instead of introducing new instructions. It matters here mainly as an explanation for execution that reaches no memory a scanner would call injected.	Shellcode, Control Flow Guard, Memory forensics
Run key	A Run key is one of the Windows registry locations, such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run, whose values are launched automatically at every logon, making it the oldest and most common place for malware to install itself.	Persistence, IOC, Dynamic analysis

Term	Definition	See also
Sandbox	A sandbox is an isolated, disposable environment built to run untrusted code away from the host. It records what the code does, and is thrown away and rebuilt afterwards so that nothing carries over to the next sample.	Detonation, Hypervisor, Snapshot
Scheduled task	A scheduled task is a Windows job registered to run at a time, at an interval or on an event such as logon. It is one of the most common persistence mechanisms and is examined by reading the registered definition, not only the fact that a task exists.	Persistence, Run key, COM hijacking
Score	A score is the numeric weight a platform assigns to a scan by adding up the severity of what each layer found, and it exists to rank and triage samples rather than to be a truth in itself.	Verdict, Sigma, YARA
SHA-256	SHA-256 is a cryptographic hash function that reduces a file of any size to a 64-character hexadecimal digest, and it is the standard way to name an exact sample: the same file always gives the same digest, and a changed file gives a different one.	Imphash, ssdeep, IOC
Shellcode	Shellcode is position-independent machine code written to run without being loaded as a file, resolving whatever it needs at run time. It appears in analysis as executable memory with no file behind it, and it is recovered from a memory image rather than from disk.	Memory forensics, NOP sled, API hashing
Sigma	Sigma is an open, vendor-neutral rule format for describing suspicious patterns in log and telemetry data, so that one written rule can be translated into the query language of whichever SIEM a team happens to run.	YARA, Suricata, MITRE ATT&CK
Sinkhole	A sinkhole is a server that has been made to receive traffic intended for a malicious destination, usually by redirecting the name, so that the traffic can be counted and the operator cannot use it. A destination that resolves to one is not evidence that the sample is inert, only that this route is.	DNS query, C2, IOC
Slack space	Slack space is the unused remainder of the last block allocated to a file, and it can still contain whatever occupied that block previously. It is examined in forensic work because content there survives deletion of the file it belonged to.	File carving, Alternate data stream, Memory forensics
Sleep evasion	Sleep evasion is malware stalling on purpose, through long sleeps, timing checks, or waiting for a reboot or for user activity, on the assumption that an automated sandbox will give up and stop recording before anything interesting happens.	Detonation, Dynamic analysis, Sandbox
Snapshot	A snapshot is a saved state of a virtual machine that it can be returned to on demand, which is how a sandbox puts every sample on an identically clean machine.	Live memory snapshot, Sandbox, Hypervisor
ssdeep	ssdeep is a fuzzy hash: unlike SHA-256 it produces similar values for similar files, so two builds of one family that differ in a few bytes can be recognised as related instead of as strangers.	TLSH, SHA-256, Imphash
Stager	A stager is a very small first payload whose only purpose is to fetch and run a larger second one, keeping the part that has to fit in a constrained space as short as possible. What it retrieves is usually more informative than the stager itself.	Downloader, Loader, Shellcode
Static analysis	Static analysis is the study of a sample without running it, by parsing its headers and sections, extracting its strings, matching rules against its bytes, checking its signature and disassembling its code.	Dynamic analysis, YARA, PE file
Stealer	A stealer collects credentials, tokens, browser data and wallet files and sends them out, typically in one pass rather than by staying resident. Its shape in a report is a burst of reads across many application directories followed by a single upload.	Keylogger, C2, IOC
STIX	STIX, currently at version 2.1, is a standard JSON format for expressing threat intelligence, covering indicators, observed data, malware and the relationships between them, so that tools from different vendors can exchange findings without a custom importer.	MISP, IOC, Defanging
String stacking	String stacking builds a string one character at a time in code instead of storing it, so that extracting text from the file finds nothing. It is the reason a static string extractor is paired with a tool that recovers strings a program constructs while running.	FLOSS, Obfuscation, API hashing
Suricata	Suricata is an open-source network intrusion detection engine that reads live traffic or a stored capture and raises alerts from a signature ruleset, which is how sandbox network traffic is turned into named findings.	PCAP, Sigma, C2
Symbol table	A symbol table maps addresses to names, and it is what turns a memory analysis of an operating system kernel from raw offsets into structures with meaning. Each build of a kernel needs its own, which is why memory tooling is version-specific in a way file tooling is not.	Volatility, Memory forensics, PDB path
Syscall	A system call is the transition from a program into the kernel to ask for something only the kernel can do. It is the narrowest useful place to observe behaviour, because every file, process and network operation eventually passes through one.	Direct syscall, Indirect syscall, ETW

Term	Definition	See also
Thread hijacking	Thread hijacking is suspending a thread that already exists in another process, changing where it will resume, and letting it continue. No new thread is created, which is why detections that watch for remote thread creation alone do not see it.	Injector, APC injection, Process hollowing
Timestomping	Timestomping is altering a file's recorded timestamps so that it appears older or appears to have arrived at a different moment. It is detected by comparing the timestamps a filesystem keeps in more than one place, because the alteration usually reaches only one of them.	Persistence, Memory forensics, Prefetch
TLS callback	A thread local storage callback is a function a Windows executable can register to run before its declared entry point, for every thread. It is worth reading during triage because code placed there executes before a debugger set to stop at the entry point ever gets control.	Entry point, Anti-debugging, PE file
TLS key log	A TLS key log is a file into which a program writes the session secrets of the encrypted connections it makes, which allows a capture of its own HTTPS traffic to be decrypted and read, with no interception proxy in front of it to give the game away.	JA3, JA4, PCAP
TLSH	TLSH, Trend Micro Locality Sensitive Hash, is a fuzzy hash designed so that the distance between two values is a usable measure of how similar the two files are, which makes it well suited to clustering large collections.	ssdeep, Imphash, SHA-256
Token impersonation	A token is the object Windows uses to carry an account's identity and privileges, and impersonation is a thread adopting another token so that its actions are checked against that identity. It is legitimate and common in service software, so what matters in a report is which token was adopted and by what.	UAC bypass, Process tree, Persistence
TTP	TTP stands for tactics, techniques and procedures: the description of how an adversary operates rather than which files they happened to use, which is the part of their behaviour that is expensive for them to change.	MITRE ATT&CK, Sigma, IOC
Typosquatting	Typosquatting is registering a name that is a near miss for a popular one, a domain or a package differing by a letter, a hyphen or a swapped pair, so that ordinary typing mistakes deliver victims.	Dropper, C2, IOC

Term	Definition	See also
UAC bypass	User Account Control is the Windows prompt that separates an administrator's ordinary work from actions that need elevation, and a bypass is any route that reaches the elevated state without producing that prompt. Analysis records that it happened and by which mechanism, because the loss of the prompt is the part that matters to a defender.	Application manifest, Token impersonation, LOLBin
UEFI variable	Firmware configuration lives in named, GUID-scoped NVRAM entries in SPI flash, reached through the GetVariable and SetVariable runtime services and exposed on Linux under /sys/firmware/efi/efivars. Boot order plus the Secure Boot key and revocation databases sit there, which puts persistence below the OS.	Bootkit, Persistence, Authenticode
Unbacked memory	Committed RX pages that no image file backs, the normal home of reflective loaders and shellcode. The VAD entry holds no file object, which marks the region MEM_PRIVATE rather than a section view of a DLL on disk. Thread start addresses and return addresses landing in such a region are a standard hunt.	Reflective loading, VAD, Shellcode
Unhandled exception filter	Top-level handler registered with SetUnhandledExceptionFilter, and a long-standing debugger oracle. A sample installs one, raises a deliberate fault, and puts its real code in the filter: UnhandledExceptionFilter queries ProcessDebugPort through NtQueryInformationProcess, so with a debugger attached the exception goes to the debugger and the filter never runs.	Anti-debugging, Hardware breakpoint, PEB
Unhooking	Unhooking is restoring a library in memory to the contents of the file it came from, which removes any monitoring that had been installed by rewriting those functions. It is one of the clearest arguments for recording from outside the machine, since the thing being removed lives inside it.	Hooking, Direct syscall, VMI
UNICODE_STRING	Counted-string structure used throughout the Windows native API: USHORT Length and MaximumLength in bytes, plus a Buffer that need not be NUL terminated. Analysts meet it in OBJECT_ATTRIBUTES passed to NtCreateFile and in the PEB loader entries malware walks to resolve modules.	PEB, Direct syscall, Syscall
Unmanaged PowerShell	Running PowerShell inside an arbitrary process by hosting the CLR through ICLRMetaHost and loading the System.Management.Automation assembly, instead of spawning powershell.exe. Rules keyed on process name or command line see nothing; the tell is that assembly loading into an odd host.	AMSI, Fileless, Encoded command
Unpacking	Unpacking is recovering the original program from a file that carries it compressed or encrypted, either by reversing the transformation or by letting it run and capturing memory once it has done the work itself. The output is a new file that is then analysed on its own terms.	Packer, Original entry point, Process dump
Unprivileged user namespace	Namespace created by an ordinary uid with unshare(CLONE_NEWUSER), inside which that uid holds a full capability set mapped back to unprivileged ids on the host via uid_map. It opens kernel subsystems otherwise closed to the caller and gates a long list of local escalation bugs.	Userland exec, uprobe, Sandbox
Unwind information	Exception-unwind metadata in a 64-bit PE, an array of RUNTIME_FUNCTION entries in .pdata pointing at UNWIND_INFO in .xdata. RtlVirtualUnwind consumes it to walk a stack, which truncates the walk when allocated shellcode has no entry at all. Forged tables go the other way and make injected frames read as ntdll.	Call stack, Shellcode, PE section
uprobe	Dynamic tracepoint attached at a byte offset inside a userspace binary or shared library; the kernel writes a breakpoint there and runs an eBPF or ftrace handler on each hit. A return probe, uretprobe, on SSL_write reads plaintext before encryption, which is how host agents see TLS content without a proxy.	ETW, TLS key log, Dynamic analysis
UPX	UPX is a widely used, open-source executable compressor, and because it is trivially reversible its presence is not itself suspicious. It matters because a file that says UPX in its section names but does not unpack with the standard tool has been modified, and that is worth noting.	Packer, Unpacking, PE section
UserAssist	Per-user registry keys recording GUI program launches, kept in NTUSER.DAT under the Explorer\UserAssist subkey and split into GUID-named Count subkeys. Value names are ROT13-encoded paths, and each binary value holds a run count, a focus count, focus time in milliseconds and a last-execution FILETIME.	Registry hive, Prefetch, Timestomping
Userland exec	Linux method for replacing a running process image without execve: unmap the current mappings, map the target ELF PT_LOAD segments and the dynamic linker, rebuild stack, argv, envp and auxv, then jump to the entry point. The name in /proc never changes and nothing is written to disk.	Fileless, Reflective loading, Loader
USN journal ($UsnJrnl:$J)	NTFS appends a record for every metadata change to the sparse alternate data stream \$Extend\$UsnJrnl:$J. Each record carries a file reference number, the parent reference, a name and accumulated reason bits such as USN_REASON_FILE_DELETE (0x200). Records outlive the MFT entries they name, so files a dropper made and removed still surface.	Timestomping, File carving, Alternate data stream
utmp / wtmp	Three fixed-record binary files hold Linux session accounting, /var/run/utmp for live sessions, /var/log/wtmp for login history and /var/log/btmp for failures, all read with utmpdump or last. Cleaners rewrite single records rather than truncate, leaving nulled ut_user fields or an mtime past the last logged session. Carving recovers deleted entries.	Timestomping, File carving, USN journal ($UsnJrnl:$J)
UUID shellcode obfuscation	A loader keeps its payload as an array of UUID strings, sixteen bytes to each, and calls UuidFromStringA from RPCRT4 to decode them one after another into an executable heap made with HeapCreate. Control reaches the result through a callback-taking API such as EnumSystemLocalesA. Nowhere in the file does the payload sit contiguous.	Shellcode, Obfuscation, API hashing

Term	Definition	See also
VAD	The Virtual Address Descriptor tree is the kernel's own record of which ranges of a process's address space are reserved, what permissions they carry and which file, if any, they came from. Memory analysis walks it to find executable regions that are backed by no file at all.	Memory forensics, Volatility, Shellcode
VBA stomping	VBA stomping is leaving a document's readable macro source in place while replacing the compiled form that actually runs, so that reading the source describes something the document will not do. It is the reason macro analysis reads the compiled stream and compares the two.	P-code, Macro, Maldoc
vbaProject.bin	Inside an OOXML zip, the OLE compound file holding the document's VBA project. Its compressed dir stream names each module and a MODULEOFFSET; the module stream keeps compiled p-code below that offset and compressed source above it. An editor shows the source, the engine runs the p-code, which is how the two come to disagree.	OLE, VBA stomping, P-code
vDSO hijacking	Redirection of the syscall stubs in the virtual dynamic shared object, the ELF image the kernel maps into every Linux process. An attacker with write access remaps the page and patches a stub, so the next call lands in their code from a mapping the process already carried, adding nothing to the loader's module list.	Hooking, vsyscall page
Vectored exception handler	A process-wide exception callback registered with AddVectoredExceptionHandler. Dispatch is not frame-based: it runs after the debugger's first-chance notification and before the stack unwinds into any SEH frame. That ordering makes it both a debugger oracle and a hook engine driven by Dr0-Dr3 breakpoints instead of patched bytes.	Anti-debugging, Hardware breakpoint, Hooking
Verdict	A verdict is the single summarising judgement a platform puts on a finished scan, one of clean, suspicious, malicious or unknown, derived from what every analysis layer contributed.	Score, Static analysis, Dynamic analysis
VerifierDlls	A REG_SZ value under an image's Image File Execution Options key naming DLLs to load into every instance of that executable, honoured when GlobalFlag on the same key sets 0x100. Ntdll maps them during process init, ahead of the normal imports, and they must sit in System32, so it is an admin-level injection and persistence path.	Persistence, Injector
Virtual Trust Level	Hypervisor-enforced privilege tiers sitting underneath the normal Windows kernel. VTL0 runs that kernel and user mode while VTL1 runs the secure kernel and isolated user mode, and pages and registers belonging to the higher tier stay unreachable from VTL0 even at ring 0. Kernel code-integrity checks outlive a compromised driver on that basis.	Hypervisor, BYOVD, Rootkit
Virtualization obfuscation	Protection that rewrites native code into bytecode for a custom interpreter shipped inside the binary, with a virtual program counter, a dispatch loop and one handler per virtual instruction. No original code survives anywhere to dump. Recovery means reversing every handler and writing a disassembler for an instruction set randomised per build.	Packer, Control flow flattening, Unpacking
VMCS	The 4 KB naturally aligned region x86 hardware virtualization keeps for each virtual CPU, holding guest-state and host-state areas plus the controls that decide which guest events force a VM exit. Because the processor may cache it in an undocumented layout, fields answer only to VMREAD and VMWRITE by field encoding, never to a plain memory load.	Hypervisor, Anti-VM
VMI	VMI, virtual machine introspection, is reading a running guest's memory and state from the hypervisor underneath it, which gives a view of the guest without installing anything in it that the sample could detect.	Hypervisor, Agentless, Memory forensics
Volatility	Volatility 3 is the open-source memory forensics framework used to parse a RAM capture into processes, loaded modules, injected regions, hooks, handles and network connections.	Memory forensics, Packer, Dynamic analysis
Volume boot record	First sector of a partition, carrying the BIOS parameter block and the bootstrap that loads the initial program loader from the sectors behind it. Changing a BPB field such as HiddenSectors, or hooking the IPL, hands a bootkit control before the kernel while the MBR still verifies clean. Detection is a diff against known-good boot sectors.	Bootkit, Persistence
VS_VERSIONINFO	Root structure of a version resource (RT_VERSION) in a PE, holding VS_FIXEDFILEINFO plus a StringFileInfo to StringTable to String chain that carries CompanyName, ProductName and OriginalFilename. Hunting pivots on those strings for forged identities; an szKey other than VS_VERSION_INFO makes strict parsers report nothing at all.	PE file, Resource section
vsyscall page	Legacy x86-64 Linux mapping at the fixed address 0xffffffffff600000, the predecessor of the vDSO. Its address never moves under ASLR, which made it a dependable source of gadget bytes and a fixed call target. Current kernels emulate the page or leave it out entirely with vsyscall=none.	ROP, vDSO hijacking

Term	Definition	See also
WebCacheV01.dat	An ESE database in the per-user WebCache folder that indexes history, cache entries, cookies and downloads for the legacy browser stack and anything else calling WinINet. A running task keeps it open, so acquisition needs a shadow copy plus the V01*.log transaction logs. Cleared history often survives as deleted records.	File carving, Prefetch, WER report
WebClient service	The service behind davclnt.dll that maps WebDAV shares into the UNC namespace, so \\host@SSL\DavWWWRoot\ paths pull files over HTTPS. Delivery chains start it deliberately with .url, .lnk or search-ms links; the payload runs straight off the remote share, leaving no downloaded copy and no Zone.Identifier mark to inspect.	Mark of the Web, Alternate data stream, LOLBin
WER report	A .wer text file, sometimes paired with a minidump, written into the ReportArchive and ReportQueue folders when a process crashes or hangs. Each report names the faulting image, its version and full path along with every loaded module, so it proves execution of a binary that has since been deleted.	Prefetch, Memory dump, Process dump
WIN_CERTIFICATE	Structure that wraps an Authenticode signature in a PE, made of dwLength, wRevision, wCertificateType and a PKCS#7 SignedData blob. Its data directory entry stores a raw file offset rather than an RVA, and the region is hashed around rather than over. Bytes parked inside it keep the signature valid unless the optional padding check is enabled.	Authenticode, Overlay, PE file
Windows Filtering Platform	The kernel network filtering stack that firewalls and inspection drivers attach to through the Base Filtering Engine. A high- weight blocking filter aimed at a security agent's binary silences its uplink without touching the process, while a callout driver can veto or rewrite packets outright. Event 5157 records the blocked connections.	ETW tampering, BYOVD, Unhooking
Wiper	A wiper destroys data rather than holding it for payment, by overwriting files, the partition table or the boot record. It is distinguished from ransomware by the absence of any recovery path, which is a conclusion about the code and not about a note it may display.	Ransom note, Bootkit, Detonation
WMI event subscription	Persistence built from three repository objects: an __EventFilter holding a WQL trigger, an event consumer holding the command, and a __FilterToConsumerBinding joining the two. Compiled into OBJECTS.DATA under root\subscription, it fires from the WMI service with no autorun key and no dropped loader to find.	Persistence, Run key, Fileless
WNF	The Windows Notification Facility, an undocumented publish/subscribe mechanism reached through NtUpdateWnfStateData and NtQueryWnfStateData. State names are 64-bit values XOR- encoded with 0x41C64E6DA3BC0074. Implants use a state name as a quiet cross-process signal, and overwriting the callback pointer in a target's subscription turns a state update into code execution.	Named pipe, APC injection, Direct syscall
WOW64	WOW64 is the subsystem that lets 32-bit programs run on 64-bit Windows, giving them a redirected view of parts of the filesystem and the registry. It matters in analysis because the path a 32-bit sample writes to is not always the path that ends up on disk.	Heaven's Gate, Registry hive, Process tree
WPAD	Web Proxy Auto-Discovery, the client-side hunt for a wpad.dat configuration script via DHCP option 252, DNS suffix walking and LLMNR or NBNS name lookups. Any host on the segment can answer the unanswered broadcast lookup, and the PAC file it returns routes the victim's HTTP traffic through a proxy the attacker controls.	DNS query, C2, WebClient service
WPBT	An ACPI firmware table carrying a native PE that the session manager, smss.exe, writes to system32\wpbbin.exe and executes on every boot. Because the firmware republishes it after a disk wipe and reinstall, it is a pre-OS persistence slot; the DisableWpbtExecution value under Session Manager stops the launch.	Bootkit, Persistence, PE file
WPP tracing	Windows software trace preprocessor logging, in which a driver emits binary trace records with the format strings stripped out of the binary. Those strings, along with source file names, line numbers and enclosing C function names, live in a TMF file extracted from the matching PDB. A shipped symbol file lays a signed driver's internals open.	ETW, PDB path, Symbol table
Write-what-where	An exploit primitive giving control of both the value written and the address it lands on, catalogued as CWE-123. Kernel bugs get escalated by aiming one at a token pointer or at a function pointer dereferenced later. Constrained forms, where only a fixed value or a single byte lands, are still chained into full execution.	ROP, Heap spray, BYOVD

Term	Definition	See also
xattr	Extended attributes, key-value metadata bound to an inode and read with getxattr rather than read(). Linux divides them into the user., security., trusted. and system. namespaces, and the download quarantine flag on macOS is one of them. A payload parked in user.* changes neither file size nor hash, which leaves getfattr as the way to see it.	Alternate data stream, Mark of the Web, Fileless
XDG autostart entry	Desktop Entry files under ~/.config/autostart or /etc/xdg/autostart, executed by the session manager at graphical login, with the Exec= key naming the command. NoDisplay=true keeps an entry out of the startup-applications list while it still runs; Hidden=true means deleted and is skipped. The parent of the child process is the session, not a shell.	Persistence, Run key, Scheduled task
XDP	An eBPF hook in the NIC driver receive path, running on the raw frame before the kernel allocates an sk_buff; the program returns XDP_PASS, XDP_DROP, XDP_TX or XDP_REDIRECT. Traffic dropped or rewritten there never reaches AF_PACKET, so an on- host capture of a covert channel comes back empty.	Rootkit, C2, PCAP
XFG	eXtended Flow Guard, an indirect-call check that matches function prototypes instead of consulting one flat table of valid targets. The compiler writes an 8-byte type hash immediately before each entry point; the call site loads the expected hash into r10, and the dispatch stub compares it with the qword at target-8 before jumping.	Control Flow Guard, ROP, Shellcode
XLL	Native DLL given the .xll extension and loaded through LoadLibrary by a spreadsheet add-in manager. The add-in contract requires an exported xlAutoOpen, which runs the moment the add- in activates, putting native code on the path with no macro engine involved. Triage it as a PE: exports, imports, TLS callbacks.	Maldoc, Macro, Dropper
XN bit	The execute-never bit in ARM translation table descriptors, the ARM spelling of the x86 NX flag, present since ARMv6. A separate privileged bit, PXN, arrived with the ARMv7 Large Physical Address Extension, and AArch64 descriptors carry both UXN and PXN; PXN on user mappings is what stops a kernel-mode branch into user-controlled text.	ROP, NOP sled, Heap spray
XPC	macOS inter-process messaging over Mach ports, published by daemons as launchd MachServices entries in a LaunchDaemon plist. Privilege escalation usually comes from a root listener that never pins the caller's code signature, or that identifies the client by pid rather than audit token, since a pid can be recycled through exec before the check lands.	Named pipe, Token impersonation, COM hijacking
XSL script processing	Public name for hiding executable code inside an XSLT stylesheet. A script element in the transform carries JScript or VBScript that the XSLT engine runs while it formats output, and a signed system utility performs the transform. The /FORMAT: switch on the WMI command-line tool accepts a local path or a URL, which puts the execution on that binary's account.	LOLBin, Encoded command, Obfuscation

Term	Definition	See also
YAFFS2	Log-structured file system for raw NAND flash. Every write appends a new chunk whose metadata lives in that page's out-of- band spare area rather than in a central table, and the write- once rule means nothing is edited in place: the chunk with the higher block sequence number wins. Superseded copies stay readable in a dump until garbage collection erases the whole block.	File carving, Slack space, Timestomping
Yama ptrace_scope	Attach policy for ptrace, exposed by a Linux Security Module as the sysctl /proc/sys/kernel/yama/ptrace_scope. 0 keeps classic same-uid rules, 1 allows only descendants unless the target calls prctl(PR_SET_PTRACER), 2 demands CAP_SYS_PTRACE, 3 forbids attach and PTRACE_TRACEME and cannot be lowered again. Debuggers, injectors and live memory dumpers all stall here.	Anti-debugging, Memory dump, Injector
YAML deserialization	Object construction driven by YAML type tags instead of plain scalars. An unsafe loader honours tags such as !!python/object/apply and !!python/name and calls the named function while it parses, where a safe loader accepts standard tags only. Config files, pipeline definitions and manifests read that way are executable input.	Typosquatting, Encoded command, Maldoc
YARA	YARA is a rule language for describing patterns of strings and bytes that identify a malware family, and a YARA rule can be matched against files on disk, against extracted artifacts and against memory.	Sigma, Retro-hunt, Static analysis
yescrypt	Memory-hard password hash built on scrypt, written into /etc/shadow behind the $y$ tag with its cost parameters encoded in the field that follows. Current Linux distributions ship it in place of sha512crypt ($6$), so a shadow file taken during an intrusion often starts $y$ and cracks at a very different cost.	SHA-256, Stealer
YMM register	256-bit AVX register whose low half is the matching XMM register, giving SSE and AVX code shared storage; x86-64 exposes sixteen. On Windows the upper 128 bits live in the XSAVE area outside the base CONTEXT. A capture that never sets CONTEXT_XSTATE and calls LocateXStateFeature misses them, and bytes parked up there survive the dump.	Emulation, Anti-debugging, Process dump
YMODEM	Serial file transfer protocol built on XMODEM. A 128-byte block 0 carries the file name and size, CRC-16 replaces the optional checksum, and data packets may be 1024 bytes, flagged with STX instead of SOH. Boot consoles on embedded boards still implement it, which makes loady over a UART header the usual way onto a board with no network and no JTAG.	Bootkit, Magic bytes, Entropy

Term	Definition	See also
Zero-day	A zero-day is a vulnerability being exploited before a fix is available from the party responsible for the software. The label describes the state of the world at a moment in time rather than a property of the code, so it stops being accurate once a fix ships.	TTP, MITRE ATT&CK, Kill chain
Zip Slip	Extraction itself is the write primitive: an entry name carrying ../ sequences escapes the output directory when the extractor joins name to destination without checking, landing a file on a startup script or a web root. zip, tar, jar, war, cpio, apk and 7z all share it; resolve the final path and reject anything outside the target.	Dropper, Persistence, ZIP64
ZIP64	Archives past 4 GiB or 65535 entries need this extension: true sizes and offsets move into a 0x0001 extra field, an end of central directory record with signature 0x06064b50 and its locator 0x07064b50. The 32-bit fields stay at 0xFFFFFFFF (0xFFFF for counts) as sentinels, and a parser reading them literally misreports the file.	Zip Slip, ZipCrypto, File carving
ZipCrypto	The ZIP format's legacy password scheme, a stream cipher keyed by three 32-bit words that update per byte and produce the keystream XORed over each entry. Twelve known plaintext bytes, eight of them contiguous, recover those words, and they then decrypt every entry sharing the password without ever revealing it.	Mark of the Web, Maldoc, Zip Slip
Zw prefix	Kernel-mode form of a native API call. The Zw stub sets the calling thread's PreviousMode to KernelMode, invokes the Nt implementation, then restores the old value, which makes buffers and handles count as trusted and skips the ProbeForRead and ProbeForWrite checks. Inside ntdll the two prefixes are aliases; only in the kernel do they diverge.	Direct syscall, Syscall, BYOVD
ZwQuerySystemInformation	Class SystemKernelDebuggerInformation (0x23) turns this system- wide query routine into a kernel-debugger check, filling the two BOOLEANs of SYSTEM_KERNEL_DEBUGGER_INFORMATION: KernelDebuggerEnabled and KernelDebuggerNotPresent. Enabled set with not-present clear means one is attached. No privilege is needed, and the answer covers the machine, not one process.	Anti-debugging, Anti-VM, Zw prefix
ZwSetInformationThread	Setting the undocumented ThreadHideFromDebugger class (0x11) through this routine stops the kernel delivering that thread's debug events, so a debugger sees nothing the thread does and a breakpoint inside it wedges the session. Hiding the main thread crashes the process, which is the usual tell.	Anti-debugging, Hardware breakpoint, Zw prefix
Zygote	Android's init starts this process at boot with framework classes and resources already loaded, then the system server asks it over a Unix domain socket to fork each new app process, which inherits those pages copy-on-write. Anything planted in the parent is inherited by every app forked after it.	Process tree, Hooking, Persistence