Abstract: According to examples, an apparatus may include a processor that may identify activities of an entity on resources over a predetermined period of time, in which the entity is to use permissions assigned to the entity over the resources to perform the identified activities. The processor may also identify which of a plurality of groups of permissions includes the permissions the entity used to perform the identified activities and may determine permutations of the identified plurality of groups of permissions. The processor may further calculate respective scores for each of the determined permutations to identify permutations of the groups of permissions having the lowest scores and may output information pertaining to the determined permutations having the lowest scores.

Abstract: Techniques are described herein that are capable of using multiple factors to detect illicit enumeration. Object requests are parsed among request types such that each request type includes object request(s) that share a respective common attribute. Each object request requests information about an object. Scores are generated for the respective request types such that the score for each request type is based at least in part on a count of the object request(s) in the respective request type. The scores for the respective request types are aggregated to provide a malicious activity score that represents a likelihood that the illicit enumeration has occurred. The malicious activity score is compared to a score threshold. A remedial operation is selectively performed with regard to the illicit enumeration based at least in part on whether the malicious activity score is greater than or equal to the score threshold.

Abstract: According to examples, an apparatus may include a processor that may identify activities of an entity on resources over a predetermined period of time, in which the entity is to use permissions assigned to the entity over the resources to perform the identified activities. The processor may also identify which of a plurality of groups of permissions includes the permissions the entity used to perform the identified activities and may determine permutations of the identified plurality of groups of permissions. The processor may further calculate respective scores for each of the determined permutations to identify permutations of the groups of permissions having the lowest scores and may output information pertaining to the determined permutations having the lowest scores.

Abstract: According to examples, an apparatus may include a processor that may identify activities of an entity on resources over a predetermined period of time, in which the entity is to use permissions assigned to the entity over the resources to perform the identified activities. The processor may also identify which of a plurality of groups of permissions includes the permissions the entity used to perform the identified activities and may determine permutations of the identified plurality of groups of permissions. The processor may further calculate respective scores for each of the determined permutations to identify permutations of the groups of permissions having the lowest scores and may output information pertaining to the determined permutations having the lowest scores.

Abstract: Techniques are described herein that are capable of using security event correlation to describe an authentication process. Multiple events may describe a common (i.e., same) attempt to authenticate the user. For instance, a first event may include a first description of the attempt, a second event may include a second description of the attempt, and a third event may include a third description of the attempt. The first, second, and third events may be correlated based at least in part on the first, second, and third descriptions. The first, second, and third events may be aggregated to provide an aggregated event that includes an aggregation of the first, second, and third descriptions. An authentication report may be generated to include the aggregation of the first, second, and third descriptions to describe the authentication process.

Abstract: Lateral movement between networked computers is detected, and automatically and efficiently assessed by a detection tool to distinguish innocent activity from cyberattacks. By correlating log data about logins and network traffic, the detection tool produces network node sets corresponding to individual movements. If a chain can be built from node sets matching an event sequence pattern that tends to be used by attackers, then the detection tool reports the chain as an illicit lateral movement candidate. Detection patterns define illicitness grounds such as consistency of data transfer sizes, shortness of login intervals, use of suspect protocols, chain scope, and the presence or use of administrator credentials. Detection responses may then isolate computers, inspect them for malware or tampering, obtain forensic images for analysis, tighten exfiltration filtering, and otherwise mitigate against ongoing or future cyberattacks.

Abstract: Techniques are described herein that are capable of using multiple factors to detect illicit enumeration. Object requests are parsed among request types such that each request type includes object request(s) that share a respective common attribute. Each object request requests information about an object. Scores are generated for the respective request types such that the score for each request type is based at least in part on a count of the object request(s) in the respective request type. The scores for the respective request types are aggregated to provide a malicious activity score that represents a likelihood that the illicit enumeration has occurred. The malicious activity score is compared to a score threshold. A remedial operation is selectively performed with regard to the illicit enumeration based at least in part on whether the malicious activity score is greater than or equal to the score threshold.

Abstract: According to examples, an apparatus may include a processor that may identify activities of an entity on resources over a predetermined period of time, in which the entity is to use permissions assigned to the entity over the resources to perform the identified activities. The processor may also identify which of a plurality of groups of permissions includes the permissions the entity used to perform the identified activities and may determine permutations of the identified plurality of groups of permissions. The processor may further calculate respective scores for each of the determined permutations to identify permutations of the groups of permissions having the lowest scores and may output information pertaining to the determined permutations having the lowest scores.

Abstract: Unauthorized use of user credentials in a network implementing an authentication protocol is detected. Authentication certificates that are observed in the network are uniquely identified and monitored. A baseline profile of the authentication certificates is generated. For a new request to access a resource in the network, a unique identifier for the submitted authentication certificate is generated. If the identifier is new: the submitted authentication certificate is compared to the baseline profile and an alert is generated when the difference from the baseline profile exceeds a threshold. If the unique identifier for the submitted authentication certificate has previously been identified and is not included in the baseline profile, an alert is generated when the source computer associated with the unique identifier is not found in a chain of connection to the original source.

Abstract: Lateral movement between networked computers is detected, and automatically and efficiently assessed by a detection tool to distinguish innocent activity from cyberattacks. By correlating log data about logins and network traffic, the detection tool produces network node sets corresponding to individual movements. If a chain can be built from node sets matching an event sequence pattern that tends to be used by attackers, then the detection tool reports the chain as an illicit lateral movement candidate. Detection patterns define illicitness grounds such as consistency of data transfer sizes, shortness of login intervals, use of suspect protocols, chain scope, and the presence or use of administrator credentials. Detection responses may then isolate computers, inspect them for malware or tampering, obtain forensic images for analysis, tighten exfiltration filtering, and otherwise mitigate against ongoing or future cyberattacks.

Abstract: Techniques are described herein that are capable of using security event correlation to describe an authentication process. Multiple events may describe a common (i.e., same) attempt to authenticate the user. For instance, a first event may include a first description of the attempt, a second event may include a second description of the attempt, and a third event may include a third description of the attempt. The first, second, and third events may be correlated based at least in part on the first, second, and third descriptions. The first, second, and third events may be aggregated to provide an aggregated event that includes an aggregation of the first, second, and third descriptions. An authentication report may be generated to include the aggregation of the first, second, and third descriptions to describe the authentication process.