Abstract: A method is described. The method includes monitoring a request to access one or more files via a shadow copy on a computing device. The method also includes preventing unauthorized access to the shadow copy based on a shadow copy access policy. Monitoring the request to access a shadow copy may include using a filter driver to intercept a request for a previously created shadow copy or a request to create a shadow copy.

Abstract: An authenticating device configured for network authentication is described. The authenticating device includes a processor. The authenticating device also includes memory in electronic communication with the processor. The authenticating device further includes instructions stored in the memory. The instructions are executable to intercept an authentication request sent to an authentication application program interface (API). The instructions are also executable to send the authentication request to a central server to identify malicious activity patterns based on authentication activity of a plurality of authenticating devices in a network environment. The instructions are further executable to determine whether to block an invocation of the authentication API based on blocking rules received from the central server.

Abstract: A computing device configured for replacing a target method in intermediate language code is described. The computing device includes a processor. The computing device also includes memory in electronic communication with the processor. The computing device further includes instructions stored in the memory. The instructions are executable to import a hook method and hook type into a caller method module. The instructions are also executable to replace, in intermediate language code, any call to the target method in a caller method body with a call to the hook method. The instructions are further executable to compile the intermediate language code to assembly language code. The instructions are additionally executable to call the hook method in place of the target method.