Skip to content
Permalink
Fetching contributors…
Cannot retrieve contributors at this time
53 lines (45 sloc) 6.08 KB

REFERENCE TAXONOMY INCIDENT Taxonomy (human readable version)

This is the Reference Security Incident Classification Taxonomy.

See the machine readable version as well. It should have an identical contents to the human readable version. Note that the 1st column is mandatory, the 2nd colum is an optional but desired field.

Version: 1.1 Generated from machine readable version. Please do not edit this file directly in github, rather use the machinev1 file.

CLASSIFICATION (1ST COLUMN) INCIDENT EXAMPLES (2ND COLUMN) Description / Examples
Abusive Content Spam Or 'Unsolicited Bulk Email', this means that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having a functionally comparable content.
Abusive Content Harmful Speech Discreditation or discrimination of somebody, e.g. cyber stalking, racism or threats against one or more individuals.
Abusive Content (Child) Sexual Exploitation/Sexual/Violent Content Child Sexual Exploitation (CSE), Sexual content, glorification of violence, etc.
Malicious Code Infected System System infected with malware, e.g. PC, smartphone or server infected with a rootkit.
Malicious Code C2 Server Command-and-control server contacted by malware on infected systems.
Malicious Code Malware Distribution URI used for malware distribution, e.g. a download URL included in fake invoice malware spam.
Malicious Code Malware Configuration URI hosting a malware configuration file, e.g. webinjects for a banking trojan.
Information Gathering Scanning Attacks that send requests to a system to discover weaknesses. This also includes testing processes to gather information on hosts, services and accounts. Examples: fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT, ...), port scanning.
Information Gathering Sniffing Observing and recording of network traffic (wiretapping).
Information Gathering Social Engineering Gathering information from a human being in a non-technical way (e.g. lies, tricks, bribes, or threats).
Intrusion Attempts Exploitation of known Vulnerabilities An attempt to compromise a system or to disrupt any service by exploiting vulnerabilities with a standardised identifier such as CVE name (e.g. buffer overflow, backdoor, cross site scripting, etc.)
Intrusion Attempts Login attempts Multiple login attempts (Guessing / cracking of passwords, brute force).
Intrusion Attempts New attack signature An attack using an unknown exploit.
Intrusions Privileged Account Compromise Compromise of a system where the attacker gained administrative privileges.
Intrusions Unprivileged Account Compromise Compromise of a system using an unprivileged (user/service) account.
Intrusions Application Compromise Compromise of an application by exploiting (un)known software vulnerabilities, e.g. SQL injection.
Intrusions Burglary Physical intrusion, e.g. into corporate building or data center.
Availability Denial of Service Denial of Service attack, e.g. sending specially crafted requests to a web application which causes the application to crash or slow down.
Availability Distributed Denial of Service Distributed Denial of Service attack, e.g. SYN-Flood or UDP-based reflection/amplification attacks.
Availability Misconfiguration Software misconfiguration resulting in service availability issues, e.g. DNS server with outdated DNSSEC Root Zone KSK.
Availability Sabotage Physical sabotage, e.g cutting wires or malicious arson.
Availability Outage Outage caused e.g. by air condition failure or natural disaster.
Information Content Security Unauthorised access to information Unauthorized access to information, e.g. by abusing stolen login credentials for a system or application, intercepting traffic or gaining access to physical documents.
Information Content Security Unauthorised modification of information Unauthorised modification of information, e.g. by an attacker abusing stolen login credentials for a system or application or a ransomware encrypting data.
Information Content Security Data Loss Loss of data, e.g. caused by harddisk failure or physical theft.
Fraud Unauthorized use of resources Using resources for unauthorized purposes including profit-making ventures, e.g. the use of e-mail to participate in illegal profit chain letters or pyramid schemes.
Fraud Copyright Offering or Installing copies of unlicensed commercial software or other copyright protected materials (Warez).
Fraud Masquerade Type of attack in which one entity illegitimately impersonates the identity of another in order to benefit from it.
Fraud Phishing Masquerading as another entity in order to persuade the user to reveal private credentials.
Vulnerable Weak crypto Publicly accessible services offering weak crypto, e.g. web servers susceptible to POODLE/FREAK attacks.
Vulnerable DDoS amplifier Publicly accessible services that can be abused for conducting DDoS reflection/amplification attacks, e.g. DNS open-resolvers or NTP servers with monlist enabled.
Vulnerable Potentially unwanted accessible services Potentially unwanted publicly accessible services, e.g. Telnet, RDP or VNC.
Vulnerable Information disclosure Publicly accessible services potentially disclosing sensitive information, e.g. SNMP or Redis.
Vulnerable Vulnerable system A system which is vulnerable to certain attacks. Example: misconfigured client proxy settings (example: WPAD), outdated operating system version, etc.
Other Other unclassified All incidents which don't fit in one of the given categories should be put into this class or the incident is not classified.
Other Undetermined The classification of the incident is unknown/undetermined.
Test Test Meant for testing.
You can’t perform that action at this time.