Systems and Methods for Detecting and Reacting to Malicious Activity in Computer Networks
Described herein are systems and methods for performing detection operations on secure ticket data to detect potentially malicious activity. Embodiments may involve obtaining encrypted data from an encrypted portion of a secure ticket, the obtained encrypted data having been communicated over a network; obtaining a decryption key corresponding to the encrypted data; decrypting the encrypted data using the obtained decryption key to generate decrypted data elements; comparing the decrypted data elements to at least one of known valid data elements and known invalid data elements; and generating an assessment based on the comparison, the assessment identifying whether the secure ticket is indicative of potentially malicious activity in the network.
1 . A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform detection operations on secure ticket data to detect potentially malicious activity, comprising:
obtaining encrypted data from an encrypted portion of a secure ticket, the obtained encrypted data having been communicated over a network;
obtaining a decryption key corresponding to the encrypted data;
decrypting the encrypted data using the obtained decryption key to generate decrypted data elements;
comparing the decrypted data elements to at least one of known valid data elements and known invalid data elements; and
generating an assessment based on the comparison, the assessment identifying whether the secure ticket is indicative of potentially malicious activity in the network.
2 . The non-transitory computer-readable medium of claim 1 , wherein the obtaining of the decryption key includes accessing a network resource to identify, from a plurality of detection keys, a suitable decryption key for decrypting the obtained encrypted data.
3 . The non-transitory computer-readable medium of claim 1 , wherein the obtaining of the decryption key includes accessing a local storage to identify, from a plurality of detection keys, a suitable decryption key for decrypting the obtained encrypted data.
4 . The non-transitory computer readable medium of claim 1 , wherein the decryption key is identified based on a metadata portion of the secure ticket.
5 . The non-transitory computer readable medium of claim 1 , wherein the comparing includes comparing a flag value from the decrypted data to a set of known and acceptable flag values.
6 . The non-transitory computer readable medium of claim 1 , wherein the comparing includes comparing domain data from the decrypted data to a set of known and acceptable domain data.
7 . The non-transitory computer readable medium of claim 1 , wherein the comparing includes comparing client name data from the decrypted data to a set of known and acceptable client name data.
8 . The non-transitory computer readable medium of claim 1 , wherein the comparing includes:
accessing a server to obtain updated data, the updated data corresponding to data in the decrypted data; and
comparing the updated data with the corresponding data in the decrypted data.
9 . The non-transitory computer readable medium of claim 1 , wherein the determining includes:
accessing a database storing previously received decrypted data from previously received secure tickets, the previously received decrypted data being treated as valid; and
comparing the previously received decrypted data with the decrypted data.
10 . The non-transitory computer readable medium of claim 1 , further including storing, for a future assessment, the decrypted data elements based on a category associated with the results of the assessment of whether the secure ticket is indicative of the potentially malicious activity in the network.
11 . The non-transitory computer readable medium of claim 1 , further including identifying an account associated with a sender of the secure ticket, and executing a responsive measure on the identified account.
12 . The non-transitory computer readable medium of claim 1 , wherein the comparing includes:
obtaining a cryptographic key;
calculating, based on the cryptographic key and the decrypted data elements, verification values; and
comparing the verification values to corresponding values associated with the secure ticket.
13 . A network system configured for performing detection operations on secure ticket data to detect potentially malicious activity, the network system comprising:
at least one computer-readable memory storing instructions; and
at least one processor configured to execute the instructions to:
obtain encrypted data from an encrypted portion of a secure ticket, the obtained encrypted data having been communicated over a network;
obtain a decryption key corresponding to the encrypted data;
decrypt the encrypted data using the obtained decryption key to generate decrypted data elements;
compare the decrypted data elements to at least one of known valid data elements and known invalid data elements; and
generate an assessment based on the comparison, the assessment identifying whether the secure ticket is indicative of potentially malicious activity in the network.
14 . The network system of claim 13 , wherein at least one processor is further configured to execute the instructions to access a network resource to identify, from a plurality of detection keys, a suitable decryption key for decrypting the obtained encrypted data.
15 . The network system of claim 13 , wherein at least one processor is further configured to execute the instructions to access a local storage to identify, from a plurality of detection keys, a suitable decryption key for decrypting the obtained encrypted data.
16 . The network system of claim 13 , wherein the decryption key is identified based on a metadata portion of the secure ticket.
17 . The network system of claim 13 , wherein the comparison includes a comparison of a flag value from the decrypted data to a set of known and acceptable flag values.
18 . The network system of claim 13 , wherein the comparison includes a comparison of domain data from the decrypted data to a set of known and acceptable domain data.
19 . The network system of claim 13 , wherein the comparison includes a comparison of client name data from the decrypted data to a set of known and acceptable client name data.
20 . The network system of claim 13 , wherein the instructions are further executable to:
access a server to obtain updated data, the updated data corresponding to data in the decrypted data; and
compare the updated data with the corresponding data in the decrypted data.
21 . The network system of claim 13 , wherein the instructions are further executable to:
access a database storing previously received decrypted data from previously received secure tickets, the previously received decrypted data being treated as valid; and
compare the previously received decrypted data with the decrypted data.
22 . The network system of claim 13 , wherein the instructions are further executable to store, for a future assessment, the decrypted data elements based on a category associated with the results of the assessment of whether the secure ticket is indicative of the potentially malicious activity in the network.
23 . The network system of claim 13 , wherein the instructions are further executable to identify an account associated with a sender of the secure ticket, and execute a responsive measure on the identified account.
24 . A computer-implemented method for performing detection operations on secure ticket data to detect potentially malicious activity, comprising:
obtaining encrypted data from an encrypted portion of a secure ticket, the obtained encrypted data having been communicated over a network;
obtaining a decryption key corresponding to the encrypted data;
decrypting the encrypted data using the obtained decryption key to generate decrypted data elements;
comparing the decrypted data elements to at least one of known valid data elements and known invalid data elements; and
generating an assessment based on the comparison, the assessment identifying whether the secure ticket is indicative of potentially malicious activity in the network.
25 . The computer-implemented method of claim 24 , wherein the comparing includes comparing a flag value from the decrypted data to a set of known and acceptable flag values.
26 . The computer-implemented method of claim 24 , wherein the comparing includes comparing domain data from the decrypted data to a set of known and acceptable domain data.
27 . The computer-implemented method of claim 24 , wherein the comparing includes comparing client name data from the decrypted data to a set of known and acceptable client name data.