Crowdstrike, Inc.

Microsoft Technology Licensing, LLC

Yaron Zinar

Efim Hudis

Yuri Gurevich

Marina Simakov

Gad Peleg

Yifat Orlin

Gal Novik

Eyal Karni

Sagi Sheinfeld

Avraham Kama

A security agent configured to initiate multifactor authentication (MFA) in response to security triggers occurring on a computing device. Upon occurrence of a security trigger, the security agent delays action associated with a process on the computing device and provides, to a display of a user of the computing device, a prompt asking if the security trigger resulted from an action of the user. The security agent then initiates MFA with an MFA provider to authenticate the user and, based at least on a result of the MFA and the user answer to the prompt, takes further action. The user answer may be provided separately from the MFA or through successful completion of the MFA.

Use of multifactor authentication in assessing suspicious activity

Methods and systems for detecting and preventing malicious software activity are presented. In one embodiment, a method is presented that includes monitoring network communications on a network. The method may also include detect a suspect network communication associated with a suspect network activity and, in response, determine an originating machine based on the suspect network activity. The method may further suspend network communications for the originating machine. A forensics software agent may then be selected based on the suspect network activity. Then, the forensics software agent may be deployed on the originating machine. After deployment, the forensics software agent may fetch computer forensics data from the originating machine. Once the computer forensics data is fetched, a response action may be selected and executed based on said computer forensics data.

Method and apparatus for combining a firewall and a forensics agent to detect and prevent malicious software activity

A method is provided for verifying an authentication request to a computer network. The method may include receiving a network packet and extracting an authentication request from the network packet. The authentication request may be encrypted to store attribute-value pairs, and the method may further include decrypting the authentication request to access the attribute-value pairs. The method may also include extracting a target name and a device name from the attribute-value pairs, wherein the device name indicates an identified target device, and determining whether the target name refers to the identified target device identified by the device name.

Network-based NT LAN manager (NTLM) relay attack detection and prevention

The present invention extends to methods, systems, and computer program products for selecting candidate records for deduplication from a table. A table can be processed to compute an inverse index for each field of the table. A deduplication algorithm can traverse the inverse indices in accordance with a flexible user-defined policy to identify candidate records for deduplication. Both exact matches and approximate matches can be found.

Selecting candidate rows for deduplication

Growing community of inventors

Petah Tikva, Israel

Yaron Zinar