Security glossary

ACE

Access control entry: one rule in an ACL describing access or auditing for a security principal.

Also written: ACEs

• Microsoft: Access control entries
  primary source · Access control entries

ACL

Access control list: a collection of entries describing access permissions or auditing rules for an object.

• Microsoft: Access control lists
  primary source · DACLs and SACLs

AD CS

Active Directory Certificate Services: Microsoft’s Windows Server role for issuing and managing public-key certificates.

Also written: ADCS

• Microsoft: Active Directory Certificate Services
  primary source · AD CS overview

AMSI

Antimalware Scan Interface: a Windows interface that lets applications submit content to a compatible antimalware provider for scanning.

• Microsoft: Antimalware Scan Interface
  primary source · AMSI overview

AppArmor

A Linux security module that uses application profiles to constrain programs’ permitted actions.

• Ubuntu: AppArmor
  primary source · Introduction; Discretionary Access Control vs. Mandatory Access Control

ARP

Address Resolution Protocol: a protocol for resolving a network-layer address to a link-layer address on a local network.

• RFC 826: Address Resolution Protocol
  primary source · Abstract and protocol description

AS-REP

The Kerberos authentication service reply message, carrying a ticket and an encrypted reply for the client.

• RFC 4120: Kerberos V5
  primary source · Sections 1.1, 1.7 and 3.1: protocol, definitions and the authentication exchange

AS-REP roasting

A credential attack involving offline password guessing against Kerberos authentication replies for accounts without preauthentication.

Also written: AS-REP roast

• MITRE ATT&CK: AS-REP Roasting
  taxonomy source · Description (concept definition only)

BloodHound

A graph-based tool for analyzing identity and access relationships, including Active Directory and Microsoft Entra ID.

• SpecterOps: BloodHound introduction
  primary source · Introduction

BYOVD

Bring Your Own Vulnerable Driver: abuse involving security flaws in legitimate drivers, including signed drivers.

• Microsoft: Recommended driver block rules
  primary source · Vulnerable driver blocklist

C2

Command and control: communication used by an adversary to direct compromised systems.

• MITRE ATT&CK: Command and Control
  taxonomy source · Description

capabilities

In Linux, separately controllable privileges that divide the authority traditionally associated with the superuser.

• Linux man-pages: capabilities
  primary source · DESCRIPTION

ccache

A store of Kerberos credentials, including tickets and session keys, whose form can be a file, memory, or another supported cache type.

• MIT: Credential cache
  primary source · Credential cache; ccache types

cgroup

Control group: a Linux mechanism for grouping processes to monitor and manage their resource use.

Also written: cgroups

• Linux man-pages: cgroups
  primary source · DESCRIPTION

channel binding

A way to associate authentication at one protocol layer with the secure channel underneath it.

• RFC 5056: Channel bindings
  primary source · Abstract and section 2: Definitions

coercion

In these notes, forced authentication: inducing another system to initiate an authentication exchange.

Also written: coerce, coerced

• MITRE ATT&CK: Forced Authentication
  taxonomy source · Opening conceptual definition only

cron

A background service that runs jobs according to configured schedules.

• Cronie manual: cron
  primary source · NAME; DESCRIPTION

DA

Domain Admins: an Active Directory group with extensive domain privileges and, by default, local administrator membership on domain-joined computers.

• Microsoft: Privileged accounts and groups
  primary source · Krbtgt and Domain Admins

DACL

Discretionary access control list: the ACL in an object’s security descriptor that specifies allowed or denied access.

• Microsoft: Access control lists
  primary source · DACLs and SACLs

DC

Domain controller: a server providing Active Directory Domain Services, including directory storage and domain authentication.

• Microsoft: Active Directory Domain Services overview
  primary source · Directory services and domain controllers
• Microsoft: Key Distribution Center
  primary source · Authentication service and ticket-granting service

DCOM

Distributed Component Object Model: an extension of COM that lets software components communicate across computers.

• Microsoft: COM and DCOM
  primary source · Network extensions and distributed COM

DCSync

A credential-theft technique that abuses Active Directory’s directory-replication interfaces.

• MITRE ATT&CK: DCSync
  taxonomy source · Description (concept definition only)

dMSA

Delegated managed service account: a Windows Server 2025 service-account type with managed credentials and authentication tied to authorized device identities.

• Microsoft: Delegated managed service accounts
  primary source · Overview

DPAPI

Data Protection API: Windows facilities for protecting application data, normally within a user or computer context.

• Microsoft: CryptProtectData and data protection
  primary source · Remarks and protection scope

EDR

Endpoint detection and response: security capabilities for detecting, investigating, and responding to suspicious activity on devices.

• Microsoft: Endpoint detection and response
  primary source · Overview

EPA

Extended Protection for Authentication: Windows protections using channel binding and service binding to strengthen authentication.

• Microsoft: Extended Protection for Authentication
  primary source · What is EPA?; Service Binding

EUID

Effective user identifier: the user identity a Unix-like process uses for many permission checks.

• Linux man-pages: process credentials
  primary source · User and group identifiers

GID

Group identifier: a numeric identity used by Unix-like systems to represent a group.

• Linux man-pages: process credentials
  primary source · User and group identifiers

gMSA

Group managed service account: an Active Directory service identity with automatic password management that can be shared across multiple servers.

• Microsoft: Group managed service accounts
  primary source · Feature description

Golden Ticket

A forged Kerberos ticket-granting ticket associated with compromise of the domain’s krbtgt credentials.

• MITRE ATT&CK: Golden Ticket
  taxonomy source · Description (concept definition only)

GPO

Group Policy Object: a collection of policy settings for users and computers.

Also written: GPOs

• Microsoft: Group Policy overview
  primary source · Group Policy objects

HVCI

Hypervisor-protected code integrity, also called memory integrity: a Windows protection that isolates kernel code-integrity checks using virtualization.

• Microsoft: Memory integrity
  primary source · Memory integrity overview

KDC

Key Distribution Center: a trusted Kerberos service that issues tickets and session keys.

• RFC 4120: Kerberos V5
  primary source · Sections 1.1, 1.7 and 3.1: protocol, definitions and the authentication exchange

Kerberoasting

A credential attack involving offline password guessing against Kerberos service-ticket data.

Also written: Kerberoast

• MITRE ATT&CK: Kerberoasting
  taxonomy source · Description (concept definition only)

Kerberos

A ticket-based network authentication protocol used by Active Directory and many other systems.

• MIT: What is Kerberos?
  primary source · What is Kerberos?

keytab

A Kerberos key table containing long-term keys for one or more identities, usually stored in a file.

Also written: keytabs

• MIT: Keytab
  primary source · Keytab

krbtgt

The Active Directory account used by the domain’s Kerberos Key Distribution Center.

• Microsoft: Privileged accounts and groups
  primary source · Krbtgt and Domain Admins

LAPS

Local Administrator Password Solution: Windows LAPS manages local administrator passwords and backs them up to Active Directory or Microsoft Entra ID.

• Microsoft: Windows LAPS overview
  primary source · Windows LAPS; supported backup directories

LDAP

Lightweight Directory Access Protocol: a standard protocol for accessing directory services.

• RFC 4511: LDAP
  primary source · Abstract; section 1

LDAPS

LDAP over TLS: LDAP communication protected by an encrypted transport connection.

• Microsoft: LDAP over SSL
  primary source · LDAP over SSL/TLS overview

LLMNR

Link-Local Multicast Name Resolution: a protocol for resolving names on the local network link when conventional DNS is unavailable.

• RFC 4795: LLMNR
  primary source · Sections 1 and 2: Introduction and name resolution

LOLBAS

Living Off The Land Binaries, Scripts and Libraries: a project cataloguing security-relevant uses of legitimate Windows components.

• LOLBAS project: About
  primary source · Goals and criteria

LOLBIN

Living-off-the-land binary: a legitimate program whose existing features can be misused for security-relevant actions.

Also written: LOLBin, LOLBins

• LOLBAS project: About
  primary source · Goals and criteria

LSA

Local Security Authority: the Windows security subsystem responsible for authentication and local security policy.

• Microsoft: Credentials processes
  primary source · Local Security Authority; Security Accounts Manager database

LSASS

Local Security Authority Subsystem Service: a Windows process involved in authentication, local security policy, and credential handling.

• Microsoft: Credentials processes
  primary source · Local Security Authority; Security Accounts Manager database

mDNS

Multicast DNS: a protocol for DNS-style name lookup on the local network link without a conventional DNS server.

• RFC 6762: Multicast DNS
  primary source · Abstract and section 1

MITM

Man-in-the-middle: an attacker’s position between communicating parties, potentially allowing traffic interception or alteration.

Also written: man-in-the-middle

• MITRE ATT&CK: Adversary-in-the-Middle
  taxonomy source · Description (concept definition only)

namespace

In Linux, an abstraction giving a group of processes its own view of a system resource.

Also written: namespaces

• Linux man-pages: namespaces
  primary source · DESCRIPTION

NBT-NS

NetBIOS Name Service: a name-registration and lookup mechanism that can use broadcasts or a name server.

Also written: NBNS

• RFC 1001: NetBIOS over TCP/UDP
  primary source · Section 15: NetBIOS name service

NetNTLM

A community name for NTLM challenge-response material, distinct from the stored NT password hash.

Also written: NetNTLMv2, NetNTLMv1

• Hashcat: documented format names
  primary source · Options: format names NetNTLMv1 and NetNTLMv2 (names only)
• Microsoft: NTLM
  primary source · NTLM authentication

NFS

Network File System: a protocol that lets computers share files over a network.

• Linux NFS manual
  primary source · DESCRIPTION

NT hash

An unsalted password hash used by Windows authentication, distinct from an NTLM network response.

• Microsoft: Passwords technical overview
  primary source · Passwords stored as OWF; Passwords stored in Active Directory
• Microsoft: NTLM
  primary source · NTLM authentication

NTAuth

A forest-wide Active Directory store of CA certificates trusted for particular authentication uses, including smart-card logon.

• Microsoft: Enterprise NTAuth store
  primary source · More information

NTDS

In these notes, the Active Directory database, stored in ntds.dit and including directory objects and protected credential data.

Also written: ntds.dit, NTDS.dit

• Microsoft: Active Directory Domain Services overview
  primary source · Directory services and domain controllers
• Microsoft: Passwords technical overview
  primary source · Passwords stored as OWF; Passwords stored in Active Directory

NTLM

A family of Windows authentication protocols that use a challenge-response exchange.

• Microsoft: NTLM
  primary source · NTLM authentication

NTLM relay

An authentication-forwarding attack that misuses another party’s NTLM exchange.

• MITRE ATT&CK: Name Resolution Poisoning and SMB Relay
  taxonomy source · Description (concept definition only)

OU

Organizational unit: an Active Directory container used to organize objects, delegate administration, and scope Group Policy.

• Microsoft: Designing organizational units
  primary source · OU owner role; Account OUs and resource OUs

Overpass-the-Hash

A credential-abuse technique involving password-derived keys and Kerberos authentication.

Also written: overpass-the-hash, OverPass-the-Hash, OPtH

• MITRE ATT&CK: Pass the Hash
  taxonomy source · Description (concept definition only)

Pass-the-Hash

An authentication-abuse technique involving a password hash instead of the account’s plaintext password.

Also written: pass-the-hash, PtH

• MITRE ATT&CK: Pass the Hash
  taxonomy source · Description (concept definition only)

Pass-the-Ticket

An authentication-abuse technique involving stolen or forged Kerberos tickets.

Also written: pass-the-ticket, PtT

• MITRE ATT&CK: Pass the Ticket
  taxonomy source · Description (concept definition only)

PATH

An environment variable listing directories used to search for executable programs named without a directory path.

• Linux man-pages: environment
  primary source · DESCRIPTION: PATH

PKINIT

A Kerberos extension that uses public-key cryptography during initial authentication, commonly with certificates.

• RFC 4556: PKINIT
  primary source · Section 1: Introduction

Potato

In these notes, an informal label for Windows privilege-escalation tools with “Potato” in their names.

• MITRE ATT&CK: Access Token Manipulation
  taxonomy source · Procedure Examples: JuicyPotato and BADPOTATO names only

RBCD

Resource-based constrained delegation: a Kerberos delegation model in which the destination service’s account specifies which services may act on users’ behalf.

• Microsoft: Kerberos constrained delegation
  primary source · Resource-based constrained delegation and S4U extensions

RDP

Remote Desktop Protocol: a protocol for presenting a remote graphical session and carrying user input.

• Microsoft: Remote Desktop Protocol
  primary source · Understanding RDP

RID

Relative identifier: the final component of a SID that distinguishes an account or group within its issuing domain or computer.

• Microsoft: Security identifiers
  primary source · Security identifiers; components of a SID

RPC

Remote procedure call: a mechanism that lets software request work from another process, including one on another computer.

• Microsoft: Remote Procedure Call
  primary source · Purpose

S4U

Service for User: Kerberos extensions that support a service acting on a user’s behalf.

• Microsoft: Kerberos constrained delegation
  primary source · Resource-based constrained delegation and S4U extensions

SAM

Security Accounts Manager: the Windows database of local user accounts and groups.

• Microsoft: Credentials processes
  primary source · Local Security Authority; Security Accounts Manager database

SeImpersonatePrivilege

The Windows user right that permits a process to impersonate an authenticated client.

• Microsoft: Impersonate a client after authentication
  primary source · Reference

SELinux

Security-Enhanced Linux: a Linux security architecture for applying mandatory access-control policies.

• SELinux manual
  primary source · DESCRIPTION

SGID

Set-group-ID: a file mode bit that, when honored during program execution, sets the process’s effective group ID to the file’s group ID.

• Linux man-pages: execve
  primary source · DESCRIPTION: set-user-ID and set-group-ID bits

SID

Security identifier: a value Windows uses to identify a security principal, such as a user, group, or computer account.

• Microsoft: Security identifiers
  primary source · Security identifiers; components of a SID

Silver Ticket

A forged Kerberos service ticket associated with compromise of the service account’s credentials.

• MITRE ATT&CK: Silver Ticket
  taxonomy source · Description (concept definition only)

SMB

Server Message Block: a network protocol for accessing shared files and other services.

• Microsoft: SMB overview
  primary source · Feature description

SMB signing

Cryptographic integrity protection for SMB messages that lets a receiver detect tampering.

• Microsoft: SMB signing overview
  primary source · How signing works

SPN

Service principal name: an identifier for a service instance that Kerberos associates with its service account.

Also written: SPNs

• Microsoft: Service principal names
  primary source · Service principal names

sudo

A program that lets an authorized user run a command as another user according to a configured security policy.

• Sudo manual
  primary source · DESCRIPTION

SUID

Set-user-ID: a file mode bit that, when honored during program execution, sets the process’s effective user ID to the file owner’s ID.

• Linux man-pages: execve
  primary source · DESCRIPTION: set-user-ID and set-group-ID bits

SYSTEM

The built-in Windows LocalSystem service account, which has extensive local privileges and uses the computer’s identity on the network.

Also written: NT AUTHORITY\SYSTEM

• Microsoft: LocalSystem account
  primary source · LocalSystem account

systemd

A Linux system and service manager that can manage system-wide services and services for individual users.

• systemd manual
  primary source · DESCRIPTION

TGS

Ticket-granting service: the part of a Kerberos KDC that issues tickets for services.

• Microsoft: Key Distribution Center
  primary source · Authentication service and ticket-granting service

TGT

Ticket-granting ticket: a Kerberos ticket used to request further tickets from the ticket-granting service.

• Microsoft: Key Distribution Center
  primary source · Authentication service and ticket-granting service

tier-0

The identity-control tier in the legacy Active Directory administration model, expanded into the control plane in Microsoft’s enterprise access model.

Also written: tier 0

• Microsoft: Enterprise access model
  primary source · Evolution from the legacy AD tier model; Tier 0 scope expansion

UAC

User Account Control: a Windows mechanism that separates ordinary application use from tasks requiring administrator approval or credentials.

• Microsoft: How User Account Control works
  primary source · Administrator access tokens; consent and credential prompts

UID

User identifier: a numeric identity used by Unix-like systems to represent a user.

• Linux man-pages: process credentials
  primary source · User and group identifiers

UPN

User principal name: a sign-in name written as a prefix and domain suffix joined by @, which need not be a mailbox address.

• Microsoft: User naming attributes
  primary source · userPrincipalName

WDAC

Windows Defender Application Control, now called App Control for Business: policy-based control over which applications and drivers may run.

• Microsoft: App Control for Business
  primary source · App Control for Business
• Microsoft: Windows 11 24H2, App Control for Business
  primary source · App Control for Business

WinRM

Windows Remote Management: Microsoft’s implementation of WS-Management for exchanging management information with systems.

• Microsoft: Windows Remote Management
  primary source · Purpose

WMI

Windows Management Instrumentation: Windows infrastructure for management information and administrative operations.

• Microsoft: WMI
  primary source · Purpose

WPAD

Web Proxy Auto-Discovery: a mechanism for automatically locating a client’s web-proxy configuration.

• Microsoft: WinHTTP AutoProxy support
  primary source · WPAD and proxy auto-configuration