Cybersecurity Threats Infographic, 10 Advanced Attack Techniques

Key points

• The graphic is a one-page reference for security operations centre (SOC) analysts, made by CyberMaterial. It lists ten advanced attack techniques with a one-line description of each.
• Four are about running code or hiding in memory: DLL injection, heap spraying, fileless malware and kernel exploits.
• Two are about gaining or reusing access: privilege escalation and pass-the-hash.
• Three are about controlling a system or getting data out without being seen: command and control (C2) channels, DNS exfiltration and side-channel attacks.
• One, the homograph attack, tricks people with look-alike web addresses.

The cybersecurity threats infographic in text

Title: Advanced Cybersecurity Threats. Subtitle: SOC Guide. Logo: CyberMaterial. The ten entries, as printed:

How the techniques are described by MITRE ATT&CK

MITRE ATT&CK is a public knowledge base of attacker behaviour that security teams use to describe and detect attacks. Several of the graphic’s entries match its techniques.

• DLL injection (T1055.001). Attackers inject dynamic-link libraries into running processes to avoid process-based defences and possibly gain higher privileges. It is a way of running arbitrary code inside the address space of a separate live process [1].
• Privilege escalation and kernel exploits (T1068). Attackers exploit software bugs to raise their privileges, for example moving from user-level permissions to SYSTEM or root. MITRE notes that the vulnerable component may be the operating system kernel itself [2].
• DNS as a channel (T1071.004 and T1048.003). Attackers may use the Domain Name System to communicate with compromised systems while blending in with normal traffic, a method often called DNS tunnelling [3]. They may also steal data over unencrypted protocols such as DNS, hiding it in protocol fields [4].
• Pass the hash (T1550.002). Attackers use stolen password hashes to authenticate as a user without knowing the plain-text password, often to move across a network [5].
• Command and control (TA0011). MITRE lists command and control as a whole tactic, covering the ways attackers communicate with systems under their control [6].

The other four techniques

Heap spraying places large amounts of attacker data in a program’s memory heap to make another bug easier to exploit. On its own it does not break any security boundary, and a separate vulnerability is needed [7].

Side-channel attacks use information a system leaks by accident, such as timing, power use or electromagnetic or acoustic emissions, to get at sensitive data [8]. The graphic’s example is extracting encryption keys.

Fileless malware runs in system memory and does not write files to disk during its operation, which is why it is harder to find with tools that scan files [9].

Homograph attacks use characters from different scripts that look the same, such as Latin, Cyrillic and Greek letters, to make a fake web address look like a real one [10].

Notes on this infographic

• The homograph example reads “a” instead of “a”, with two characters that look identical. It is meant to show a Latin letter swapped for a look-alike from another script, such as Cyrillic, which is how these attacks work [10]. The difference does not survive in the image.
• “Leaving no trace on disk” is broadly right but not the whole picture. Wikipedia says fileless malware aims to reside in volatile areas such as the system registry, in-memory processes and service areas, and gives the example of PowerShell scripts stored in the Windows Registry [9].
• Heap spraying is described as a “memory exploitation technique”. Strictly, it helps another exploit to work and is not a vulnerability in its own right [7].
• The graphic has no date or sources. It is a list of definitions, not a ranking by how common or dangerous each technique is.

Questions about advanced cyber threats

What is an advanced persistent threat?

NIST defines an advanced persistent threat as an adversary with sophisticated expertise and significant resources that uses several attack routes, such as cyber, physical and deception, to establish a lasting presence in an organisation’s systems. It pursues its goals over a long period, adapts to defenders and keeps trying [11].

Which attacks are on this cybersecurity threats infographic?

DLL injection, heap spraying, privilege escalation, side-channel attacks, fileless malware, DNS exfiltration, C2 channels, kernel exploits, pass-the-hash attacks and homograph attacks.

What is DNS exfiltration?

DNS exfiltration is the use of DNS queries to smuggle sensitive data out of a network covertly, as the CyberMaterial graphic describes it. MITRE ATT&CK covers stealing data over unencrypted protocols such as DNS, with the data hidden in protocol fields, as technique T1048.003 [4]. Attackers may also use DNS to communicate with compromised systems while blending in with normal traffic, a method often called DNS tunnelling [3].

Does fileless malware leave any trace on disk?

Fileless malware runs in system memory and does not write files to disk during its operation, which makes it harder to find with tools that scan files [9]. The graphic's phrase "leaving no trace on disk" is broadly right but not the whole picture. Wikipedia says fileless malware aims to reside in volatile areas such as the system registry, in-memory processes and service areas, for example PowerShell scripts stored in the Windows Registry [9].

Sources

1. MITRE ATT&CK, Process Injection, Dynamic-link Library Injection (T1055.001).
2. MITRE ATT&CK, Exploitation for Privilege Escalation (T1068).
3. MITRE ATT&CK, Application Layer Protocol, DNS (T1071.004).
4. MITRE ATT&CK, Exfiltration Over Unencrypted Non-C2 Protocol (T1048.003).
5. MITRE ATT&CK, Use Alternate Authentication Material, Pass the Hash (T1550.002).
6. MITRE ATT&CK, Command and Control (TA0011).
7. Wikipedia, Heap spraying.
8. Wikipedia, Side-channel attack.
9. Wikipedia, Fileless malware.
10. Wikipedia, IDN homograph attack.
11. NIST Computer Security Resource Center, Advanced persistent threat (glossary).
12. CyberMaterial, creator of the graphic.

Last reviewed 30 October 2026