Microsoft Technology Licensing, LLC

Mara Beth Fortini

Jason Joseph Weber

Abhishek Sagar

Charles Strempler

Brian Keith Catlin

Richard Joseph Murillo

Christian Stockwell

Michael David Mccormack

Sinclaire Renee Hamilton

Daniel Paul Costenaro

Jonathan Seth Kaufthal

Margaret Cui Liu

Maya Rodrig

Gregory Alan Howard

Christian Seifert

Brian Daniel Meersma

Sophia Isabel Vennix

Kyle David Ryan

Cosmin Catrinescu

Ali Alabbas

Fredric W Pullen, Iii

Eric Paul Douglas

Robert G Lefferts

Rupo Zhang

David Simon Carpenter

Paresh Maisuria

Nerses Ghevondyan

Devanshi M Gajjar

Millen May T Angeles

Cristian C Berejan

Shreya Salikram Chowdhary

Nimisha Gupta

Svetoslav G Paregov

Embodiments of the technology described herein identify and mitigate phishing attempts by analyzing user input received at the operating system level. Initially, a credential, such as a username or password, is registered with the threat detection system. The technology described herein intercepts user input at the operating system level, generates a hash of the input, and compares it with a hash of a credential being monitored. The technology described herein will perform a threat assessment when a secret entry is detected. The threat assessment may use the application context and the network context as inputs to the assessment. When the threat assessment results in an unknown classification or when the snapshot is otherwise requested, a snapshot is captured to supplement the threat assessment. Based on user settings, the snapshot is consumed by a snapshot phishing machine learning model. Various mitigation actions may be taken when a threat is detected.

Snapshot phishing detection and threat analysis

The technology described herein identifies and mitigates phishing attempts by analyzing user input received at the operating system level. Initially, a credential, such as a username or password, is registered with the threat detection system. The technology described herein intercepts user input at the operating system level, generates a hash of the input, and compares it with a hash of a credential being monitored. A credential entry is detected when a hash for the character string entered matches a hash for a credential being monitored. The technology described herein will perform a threat assessment when a secret entry is detected. The threat assessment may use the application context and the network context as inputs to the assessment. Various mitigation actions may be taken when a threat is detected.

Credential input detection and threat analysis

Non-limiting examples of the present disclosure enable creation and management of representations of content through the execution of copy actions, paste actions or a combination thereof. An indication of a copy action is received that copies a content portion. The copy action is analyzed to generate a (live) representation of the content portion. Other examples of representations are also generatable including a static representation and/or a live non-editable representation. As an example, a live representation is an editable and synchronized representation of the content portion that is synchronized with original source content. The live representation comprises a selectable data link that links back to the original source content and an editable representation of the content portion. In response to receiving an indication of a paste action, the live representation of the content portion is automatically rendered inline within a graphical user interface of a host application/service endpoint.

Creation and management of live representations of content through intelligent copy paste actions

Growing community of inventors

Sammamish, WA, United States of America

Mara Beth Fortini