advanced glossary of SOC terms, categorized by modern threat landscapes, detection engineering, and SOC leadership.

Table of Contents

Modern attackers rarely use noisy, easily detected malware. The SOC must be trained to spot subtle, sophisticated techniques.

Living off the Land (LotL) / Fileless Malware: Attackers use legitimate, built-in administrative tools (like PowerShell, WMI, PsExec, or native cloud CLI tools like AWS CLI) to execute attacks. Because these tools are signed by Microsoft/Amazon and trusted by the OS, traditional antivirus often misses them entirely.
Beaconing: The rhythmic, periodic communication from a compromised internal host to an external Command and Control (C2) server. SOCs look for this in network traffic (e.g., a host phoning home exactly every 60 seconds).
Process Injection / In-Memory Execution: Malware injects its malicious code into the memory space of a legitimate, running process (like explorer.exe or svchost.exe). The malicious code runs entirely in RAM, never touching the hard drive, evading traditional file-scanning.
Credential Dumping: The act of extracting password hashes or Kerberos tickets from the memory of a system (specifically the LSASS process in Windows). Tools like Mimikatz are famously used for this. (Highly relevant to your CyberArk/IAM background).
Pass-the-Hash (PtH) / Pass-the-Ticket (PtT): An advanced lateral movement technique where an attacker steals a cryptographic hash or Kerberos Ticket and uses it to authenticate to other systems without ever needing the plaintext password.

These terms describe the methodology of modern, proactive security operations.

Telemetry: The raw data collected from endpoints, networks, cloud, and identity systems. A mature SOC relies on high-fidelity telemetry. Types include Endpoint Telemetry (EDR), Network Telemetry (NDR/NetFlow), Identity Telemetry (IAM/AD logs), and Cloud Telemetry (API logs).
Pivoting: The investigative process of taking one piece of data (an IOC, like a malicious IP) and using it to search for other related data. (e.g., “Which other internal hosts talked to this IP?” -> “What user logged into those hosts?” -> “What other logins did that user do today?”)
Detection Engineering (DE): The specialized discipline of writing, testing, and maintaining the actual correlation rules and queries in the SIEM. A Detection Engineer translates threat intelligence into actionable SIEM queries (e.g., writing a Splunk SPL or Microsoft KQL query).
Hypothesis-Driven Threat Hunting: Instead of waiting for alerts, a Threat Hunter forms a hypothesis based on intelligence (e.g., “I hypothesize that an attacker is using WMI for lateral movement in our environment”). They then proactively query the telemetry to prove or disprove the hypothesis.
Purple Teaming: A collaborative exercise where the Red Team (attackers) and Blue Team (SOC/Defenders) work together in real-time. The Red Team executes an attack, and immediately tells the Blue Team, “Did you see my technique? No? Let’s write a detection for it right now.”

As a leader, these are the terms you will use to justify budgets, manage team health, and report to the board.

Alert Fatigue: The phenomenon where SOC analysts become desensitized to alerts because they receive too many False Positives. This leads to analysts accidentally ignoring or quickly closing True Positives. A primary KPI for a SOC leader is reducing alert fatigue through tuning.
Alert Tuning: The process of refining SIEM correlation rules to reduce False Positives. This might involve adding exclusions (e.g., “Exclude the vulnerability scanner’s IP from the port-scanning alert”).
Coverage Mapping (MITRE ATT&CK Navigator): The process of mapping your active SIEM use cases to the MITRE ATT&CK matrix. A SOC leader uses a heat map to visually show the board: “We have strong detection coverage for Credential Access, but zero visibility into Supply Chain Compromise.”
Tabletop Exercise (TTX): A discussion-based session where the SOC, IT, Legal, and PR teams walk through a hypothetical cyberattack scenario (e.g., “Ransomware has encrypted our primary Fintech database”) to test their Incident Response plan and communication flows without touching live systems.
Use Case Lifecycle Management: The formal process of requesting, developing, testing (in a non-production environment), deploying, and periodically reviewing SIEM detection rules to ensure they remain relevant as the business changes.

Given your focus on Identity and Cloud, these terms are critical for modern SOC operations.

Impossible Travel (Velocity Attack): An alert triggered when a single user account logs in from two geographically impossible locations within an unfeasible timeframe (e.g., logging in from New York and London 15 minutes apart). This almost always indicates a compromised credential.
Risk-Based / Adaptive Authentication: An IAM concept where the SOC/IAM system dynamically demands stronger MFA based on the risk context of the login (e.g., asking for a hardware token if the login is from a new device or an unusual country).
Cloud Control Plane Telemetry: Logs that record management actions in the cloud (e.g., “User X created a new S3 bucket and made it public”). In AWS, this is CloudTrail. In Azure, it’s the Activity Log. SOCs monitor this heavily to detect cloud misconfigurations and privilege escalation.

techyengineer