Cyberark Software Ltd.

Tenable, Inc.

Matan Hart

Andrey Dulkin

Yair Sade

Lavi Lazarovitz

Yona Hollander

Omer Benedict

Itamar Yaakov Mizrahi

Jessica Stanford

System, device, and method of determining cyber-attack vectors and mitigating cyber-attacks. A method includes: scanning and mapping a network, and collecting data about network elements; generating a Permissions Directed-Graph, which indicates permissions that each network element has; generating a Network Connectivity Directed-Graph, which indicates accessible direct-communication routes between network elements; obtaining a list of attack techniques; applying a Static Verification process on the list of attack techniques, to generate an initial version of an Attacks Directed-Graph which maps particular attacks to network elements that are represented in the Permissions Directed-Graph and in the Network Connectivity Directed-Graph; performing a Dynamic Verification process, and constructing an updated list of dynamically-verified Attack Vectors that were verified as available within a particular operational context; generating a ranking for each dynamically-verified Attack Vector; prioritizing the dynamically-verified Attack Vectors, and prioritizing threat mitigation resources; activating threat mitigation resources based on the prioritization outputs.

System, device, and method of determining cyber attack vectors and mitigating cyber attacks

Described herein are systems and methods for detecting potentially malicious activity in a network session. Embodiments may involve identifying a requested network session between a first computer device and a second computer device, wherein the requested network session includes at least one security access message having an encrypted portion, obtaining a decryption key suitable for decrypting the encrypted portion of the security access message, decrypting the encrypted portion of the security access message with the decryption key, identifying a session key within the decrypted portion of the security access message, decrypting an application message that has been transmitted between the first computer device and the second computer device in the requested network session using the session key, and determining whether the decrypted application message includes an indicia of potentially malicious activity.

Detecting and reacting to malicious activity in decrypted application data

Described herein are systems and methods for performing detection operations on secure ticket data to detect potentially malicious activity. Embodiments may involve obtaining encrypted data from an encrypted portion of a secure ticket, the obtained encrypted data having been communicated over a network; obtaining a decryption key corresponding to the encrypted data; decrypting the encrypted data using the obtained decryption key to generate decrypted data elements; comparing the decrypted data elements to at least one of known valid data elements and known invalid data elements; and generating an assessment based on the comparison, the assessment identifying whether the secure ticket is indicative of potentially malicious activity in the network.

Systems and methods for detecting and reacting to malicious activity in computer networks

Growing community of inventors

Savyon, Israel

Matan Hart