Microsoft Technology Licensing, LLC

Itai Grady Ashkenazy

Tal Joseph Maor

Marina Simakov

Gal Zeev Bruchim

Tal Arieh Be'ery

Sivan Krigsman

Michael Dubinsky

Jonathan Moshe Monsonego

Chaim Menachem Hoch

Lior Schindler

Igal Gofman

A system for detecting directory reconnaissance in a directory service includes a sensor and a directory reconnaissance detector, each of which is executing on one or more computing devices. The sensor determines whether a query that is submitted to a directory server is a suspicious query and, if the query is determined to be a suspicious query, transmits the suspicious query to the directory reconnaissance detector. The director reconnaissance detector includes a receiver, a context obtainer, an alert determiner and an alert transmitter. The receiver receives the suspicious query from the sensor and the context obtainer obtains context information associated with the suspicious query. The alert determiner determines whether a security alert should be generated based at least on the suspicious query and the context information. The alert transmitter generates the security alert responsive to a determination that the security alert should be generated.

Detecting directory reconnaissance in a directory service

Cybersecurity is enhanced to detect credential spray attacks. Accounts with access failure events are divided into buckets B. . . BN based on access failure count ranges R. . . RN. For instance, accounts with one logon failure may go in B, accounts with two failures in B, etc. Buckets will thus have account involvement extents E. . . EN, which are compared to thresholds T. . . TN. An intrusion detection tool generates an alert when some Ei hits its Ti. Detection may spot any credential sprays, not merely password sprays. False positives may be reduced by excluding items from consideration, such as logon attempts using old passwords. False positives and false negatives may be balanced by tuning threshold parameters. Breached accounts may be found. Detection may also permit other responses, such as attack disruption, harm mitigation, and attacker identification. Credential spray attack detection may be combined with other security mechanisms for defense in depth of cloud and other network accounts.

Credential spray attack detection

Embodiments are directed to monitoring local users' activity without installing an agent on a monitored machine. Periodic scans of the local users' directory using the standard protocol messages and APIs of a remote admin interface provide access to local machine data. Using the remote admin interface, defenders gain visibility to local users' logons, group membership, password changes, and other parameters. Security applications enabled by this visibility include, but are not limited to, abnormal logons detection, abnormal group addition and removal detection, and abnormal password changes detection.

Detecting local user security-related anomalies using active scans

The network logon protocol used in a pass-through authentication request embedded in an encrypted network packet is identified. A protocol detection engine correlates events and network requests received at a domain controller in order to use the data contained in a correlated pair to determine a size of a challenge response in the encrypted network packet. The size of the response is used to identify the network logon protocol used in the pass-through authentication request.

Detection of the network logon protocol used in pass-through authentication

Growing community of inventors

Ramat Hasharon, Israel

Itai Grady Ashkenazy