Microsoft Technology Licensing, LLC

Ram Haim Pliskin

Josef Weizman

Roy Levin

Dotan Patrich

Andrey Karpovsky

Omer Karin

Tomer Koren

Moshe Israel

Yotam Livny

Hani Hana Neuvirth

Ben Kliger

Michael Zeev Bargury

Mathias Abraham Marc Scherman

Evgeny Bogokovsky

Shalom Shay Shavit

Aharon Naftali Michaels

Ariel Brukman

Johnathan Samuel Simon

Daniel Davraev

Efim Hudis

Tamer Salman

Tomer Rotstein

Michael Makhlevich

Ilay Grossman

Coral Cohen

Lior Sonntag

Karl William Reinsch

Techniques are described herein that are capable of performing a security action regarding an access request using a cluster-based determination of malicious intent. Subsets of access requests are clustered into respective clusters, which correspond to respective requestor types, based at least on the access requests in the subsets having respective attributes that indicate the respective requestor types. A determination is made that a received access request, which is associated with a designated requestor type, is malicious based at least on a relationship between an access action, which is requested by the received access request using an access token, and an access behavior associated with a group of access requests in a designated cluster that use the access token. As a result of determining that the received access request is malicious, a security action is performed with regard to the received access request.

Performing a security action regarding an access request using a cluster-based determination of malicious intent

According to examples, an apparatus includes a processor that determines that an encryption operation has been requested or executed through a cloud control plane capability with respect to a cloud storage device. The processor also determines that the requested or executed encryption operation with respect to the cloud storage device is anomalous and, based on a determination that the requested or executed encryption operation with respect to the cloud storage device is anomalous, outputs an alert and/or performs a remedial action. By identifying anomalous encryption operation requests or executions on cloud storage devices, the processor is able to determine that ransomware attacks are or have occurred on the cloud storage devices. In some examples, the processor takes remedial actions to mitigate harm posed by or prevent the ransomware attacks.

Protection of cloud storage devices from anomalous encryption operations

Generally discussed herein are devices, systems, and methods for cloud resource security. A method can include receiving, at a monitor device and from a first cloud resource of cloud resources hosted by a cloud provider, a request for a token that uniquely identifies the first cloud resource, the request indicating a destination that is a metadata server. The method can include comparing, based on entries in an application programming interface (API) access log, the cloud provider associated with the first cloud resource and a cloud provider associated with the metadata server. The method can include responsive to the cloud provider of the first cloud resource being different from the cloud provider of the metadata server performing a security mitigation action.

Cloud attack detection via API access analysis

The techniques disclosed herein prevent a rogue resource from being created within a cloud computing environment. For example, a rogue serverless function may be prevented from integrating with a cloud-based database, thereby preventing the serverless function from performing malicious operations such as low-rate data exfiltration. The rogue serverless function is detected before it is installed, heading off the attack completely. In some configurations, a key retrieval request is received. Parameters of the key retrieval request are analyzed for anomalies, and anomalous key retrieval requests are stored in a pool. Then, when a request to create a resource is received, the pool of anomalous key retrieval requests is searched for a match. When a match is found, the resource creation request may be suspended pending a further security review.

Detecting suspicious data access by a rogue cloud resource

Systems and techniques for reduction of security detection false positives are described herein. Suspicious activity data is obtained for an operation. Operation data is obtained for the operation. It is determined that the operation is related to a parent operation that has not triggered an alert. The operation is cleared from the suspicious activity data.

Reduction of security detection false positives

A recovery instruction pertaining to a resource is detected. The recovery instruction is matched with a delete instruction that caused the resource to enter a soft-deleted. A mismatch between a first user account associated with the recovery instruction and a second user account associated with the delete instruction is determined. A mitigation action is performed based on determining the mismatch between the first user account and the second user account.

Methods, systems and computer programs for detecting potentially suspicious resource access events

A computing system is configured to access a cloud storage and make a copy of at least a portion of the cloud storage. The copy of the at least portion of the cloud storage to search for a data pattern associated with a credential. In response to finding the data pattern associated with the credential, the computing system extracts an identifier associated with the credential and a scope of permission that the identifier is granted to. The scope of permission is associated with a permission to access a cloud resource. Finally, a risk of potential exposure of the credential is mitigated, such as (but not limited to) notifying an owner of the cloud resource, deleting the credential from the cloud, or modifying or revoking the scope of permission associated with the credential.

Agentless extraction of cloud credentials

Methods, systems, apparatuses, and computer-readable storage mediums described herein are configured to detect mass control plane operations, which may be indicative of anomalous (or malicious) behavior. For example, one or more logs that specify a plurality of access enablement operations performed with respect to an entity is received. The log(s) are analyzed to identify a number of access enablement operations that occurred in a particular time period. A determination is made as to whether the identified number of access enablement operations meets a threshold condition (e.g., to determine whether an unusually high number of such operations occurred in a given time period). Based on the threshold condition being met, a determination is made that anomalous behavior has occurred with respect to the entity. Responsive to determining that the potentially behavior has occurred, a mitigation action may be performed that mitigates the behavior.

Detecting mass control plane operations

Generally discussed herein are devices, systems, and methods for improving cloud resource security. A method can include obtaining a cloud resource management log that details actions performed by users of cloud resources in a cloud portal, the actions including entries comprising at least two of a user identification (ID) of a user of the users, an operation of operations performed on the cloud resource, a uniform resource identifier (URI) of a cloud resource of the cloud resources that is a target of the operation, or a time the operation was performed. The method can include determining a respective score for each action in the cloud resource management log, comparing the respective score to a specified criterion, and providing an indication of anomalous action in response to determining the respective score satisfies the specified criterion.

Threat detection using cloud resource management logs

According to examples, an apparatus may include a memory on which is stored machine-readable instructions that may cause a processor to receive a request to upload a file to a directory and determine whether the request is a request to upload a predefined type of file to the directory. In addition, based on a determination that the request is a request to upload the predefined type of file to the directory, the processor may determine, through application of a predictive model, whether the directory is a user content directory and based on a determination that the application of the predictive model indicates that the directory is a user content directory, block the request and/or output a notification regarding the receipt of the request.

Predictive model application for file upload blocking determinations

A machine compromised by malicious activity is detected by identifying an anomalous port opened on an entity of a network. The anomalous port is detected through collaborative filtering using usage patterns derived from normal network traffic using open ports of entities on the network. The collaborative filtering employs single value decomposition with alternating least squares to generate a recommendation score identifying whether an entity having a newly-opened port is likely to be used for malicious activity.

Real-time detection of malicious activity through collaborative filtering

Techniques are described herein that are capable of detecting potential malicious use of a resource management agent using a resource management log. The resource management log is analyzed. The resource management log logs API requests that request that a resource management system cause the resource management agent to perform respective operations. An anomalous operation is detected among the operations based at least in part on an identified API request satisfying one or more criteria associated with anomalous behavior. The identified API request requests that the resource management system cause the resource management agent, which is loaded on a machine and which enables the resource management system to remotely manage resources associated with the machine, to perform the anomalous operation. An alert is generated to notify a user of the potential malicious use of the resource management agent based at least in part on detection of the anomalous operation.

Detecting potential malicious use of a resource management agent using a resource management log

Embodiments detect risky situations in which a domain name record remains viable after the target it identified is not. Such dangling records create various risks because substitute targets, such as fraudulent websites, may be installed without the knowledge of the original target's owner. By obtaining and correlating data from multiple tenants, a cloud service provider detects dangling structures and any attempts to exploit them. Dangling records may specify a custom domain name, for example, or a static IP address that can be misused. In response, the provider's security infrastructure can alert the original target's owner, block the attempted exploit, or otherwise mitigate the risks. Traffic monitoring, control plane API invocations, and domain name server queries may be employed by the security infrastructure to detect resource deletion, resource creation, and resource access attempts that correspond with vulnerable records or suspect activity involving them.

Dangling domain detection and access mitigation

Mitigation of attack vectors that persist elevated permissions within a computing environment. Mitigated attack vectors may be configured to respond to a trigger by generating computing resources with a built-in vulnerability. Mitigated attack vectors may elevate permissions of the computing resources to some heightened level which the malicious actor had previously gained. For example, if the malicious actor had breached a user account having administrator privileges, the attack vector may respond to the trigger by creating the virtual machine and then linking the virtual machine to a service principal having the administrator-level permissions. Left unmitigated the attack vector would enable the malicious actor to regain 'administrator-level' privileges even after access to the user account is halted. The disclosed techniques facilitate identifying and preventing the execution of attack vectors having these characteristics to prevent malicious actors from being able to persist previously obtained heightened privileges which have since been revoked.

Growing community of inventors

Rishon Lezion, Israel

Ram Haim Pliskin