Wiz, Inc.

Udi Reitblat

Ami Luttwak

Yinon Costica

Roy Reznik

Alon Schindel

Aviel Fogel

Avihai Berkovitz

George Pisha

Yaniv Joseph Oliver

Daniel Hershko Shemesh

Yarin Miran

Gal De Leon

Eliad Peller

Shai Keren

Raaz Herzberg

Amir Lande Blau

Niv Roit Ben David

Osher Hazan

Or Heller

Itamar Gilad

Arik Nemtsov

Yonatan Doron

Shahar Yakov

Jonathan Doron

Michael Aminov

A system and method for detecting privilege escalation on a resource deployed in a computing environment is disclosed. The method includes: configuring the resource to deploy thereon a sensor, the sensor configured to listen on a data link layer of the resource for an event; receiving from the sensor a permission-based event based on a first actor, the permission-based event indicating a first permission set of the first actor; querying a database to detect a second permission set of the first actor; detecting that the first permission set includes a permission which is not in the second permission set; determining that the resource is involved in a privilege escalation event in response to detecting that the first permission set includes a permission which is not in the second permission set; and initiating a mitigation action in response to the determined privilege escalation event.

Techniques for utilizing a sensor in detecting privilege escalation

A system and method for cybersecurity threat detection using an activity baseline generated based on sensor-detected runtime execution data is presented. The method includes: receiving aggregated runtime data from a sensor deployed on a resource in a cloud computing environment; generating an event log based on the aggregated runtime data, each event in the event log generated by extracting data from the aggregated runtime data; generating an activity baseline for a process executed on the resource based on the event log; receiving a new event from the sensor; and determining that the new event is anomalous based on the generated activity baseline.

Cybersecurity threat detection utilizing sensor-based aggregated runtime execution data

A system and method for detecting effective permissions of a principal in a cloud computing environment, includes detecting a group of principal nodes, each principal node representing a principal in a cloud computing environment, in a security graph, the security graph storing therein a representation of the cloud computing environment; selecting a first principal node from the group of principal nodes; determining a permission between the first principal node and a resource node, wherein the resource node represents a resource deployed in the cloud computing environment; and associating the group of principal nodes with the determined permission.

Cybersecurity threat detection utilizing unified identity mapping and permission detection

A system and method for generating a security graph utilizing a unified model based on multiple cloud environments are provided. The method includes receiving data from a first cloud environment pertaining to: resources, principals, and permissions; generating for each resource a corresponding resource node in the security graph, the corresponding resource node including an identifier of the resource, wherein the resource is a cloud entity deployed in the first cloud environment; generating for each principal a corresponding principal node in the security graph, the corresponding principal node including an identifier of the principal, wherein the principal is a cloud entity in the first cloud environment that generates an operation request in the first cloud environment; and generating a connection between at least a principal node and at least a resource node in the security graph, in response to detecting a permission indicating that a principal can access a resource.

Efficient representation of multiple cloud computing environments through unified identity mapping

A system and method for improved endpoint detection and response (EDR) in a cloud computing environment initiates inspection based on data received from a sensor deployed on a workload. The method includes: configuring a resource, deployed in a cloud computing environment, to deploy thereon a sensor, the sensor configured to detect runtime data; detecting a potential cybersecurity threat on the resource based on detected runtime data received from the sensor; and initiating inspection of the resource for the potential cybersecurity threat.

System and method for cybersecurity threat detection utilizing static and runtime data

A system and method for detecting a permission escalation event in a computing environment is disclosed. The method includes: generating a cloned disk based on an original disk of a resource deployed in a computing environment; detecting an identifier of a first principal on the cloned disk; detecting a second principal in the computing environment, the first principal authorized to assume the first principal; storing a representation of the computing environment in a security database, including: a first principal node representing the first principal, and a second principal node representing the second principal, further associated with a permission; querying the representation to determine a permission of the first principal; determining that the second principal includes a permission which the first principal does not include based on a result of querying the representation; and generating a permission escalation event.

Techniques for cybersecurity identity risk detection utilizing disk cloning and unified identity mapping

A system and method for detecting cybersecurity risk on a resource in a computing environment utilizes static analysis of a cloned resource and runtime data from the live resource. The method includes: configuring a resource deployed in a computing environment to deploy thereon a sensor, the sensor configured to detect runtime data; detecting runtime data from the sensor of the resource; generating an inspectable disk based on an original disk of the resource; initiating inspection based on the detected runtime data for a cybersecurity object on the inspectable disk; detecting the cybersecurity object on an inspectable disk; and initiating a mitigation action on the resource.

Techniques for cybersecurity inspection based on runtime data and static analysis from cloned resources

A system and method for validating cybersecurity issues utilizing runtime data is disclosed. In an embodiment the method includes: inspecting a workload deployed in a computing environment for a cybersecurity issue; deploying a sensor on the workload, the sensor configured to collect runtime data from the workload; initiating a first mitigation action with a first priority in the computing environment in response to validating the cybersecurity issue from the collected runtime data; initiating a second mitigation action with a second priority, which is lower than the first priority, in response to failing to validate the cybersecurity issue from the collected runtime data.

Cybersecurity vulnerability validation techniques utilizing runtime data, static analysis and dynamic inspection

A system and method for improved endpoint detection and response (EDR) in a cloud computing environment configures a resource deployed in a cloud computing environment to deploy thereon a sensor, configured to listen on a data link layer for an event. The method further includes detecting a potential cybersecurity threat on the resource; sending a definition based on the cybersecurity threat to the sensor, wherein the definition includes a logical expression, which when applied to an event produces a binary outcome, and wherein the sensor is further configured to apply the definition to the event; determining that the potential cybersecurity threat is an actual cybersecurity threat in response to the produced binary outcome having a predetermined value; and generating an instruction to perform a mitigation action based on the actual cybersecurity threat.

Growing community of inventors

Tel Aviv, Israel

Udi Reitblat