Abstract: A hardcoded credential attack detection and prevention system as disclosed herein distinguishes between legitimate uses and malicious uses to prevent attacks using hardcoded credentials without obstructing legitimate uses that still rely on hardcoded credentials. The system collects publicly disclosed hardcoded credentials and creates network traffic based signatures to detect login attempts corresponding to the publicly disclosed hardcoded credentials. The system then uses the created “login signatures” to detect login attempts corresponding to the hardcoded credentials. While detection with the login signatures occurs inline at individual network devices with visibility of the network traffic, the system obtains relevant network traffic from other network devices to analyze login behavior on a wider scale.

Abstract: Techniques for application identification for phishing detection are disclosed. In some embodiments, a system/process/computer program product for application identification for phishing detection includes monitoring network activity associated with a session to detect a request to access a site; determining advanced application identification associated with the site; and identifying the site as a phishing site based on the advanced application identification.