Systems and methods for detecting credential theft

1. A computer-implemented method for detecting credential theft, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

monitoring a secured computing system's credential store that comprises at least one sensitive credential that is used to facilitate authentication of a user that is attempting to access the secured computing system;

gathering, while monitoring the credential store, primary evidence of a possible attempted theft of the sensitive credential from the credential store, wherein:

the primary evidence comprises evidence of a suspicious access of the sensitive credential from the credential store by a computer process that is not known to perform any part of a legitimate procedure of authenticating users; and

the primary evidence is not alone sufficient to show, above a predetermined confidence level, actual theft of the sensitive credential;

tracking usage of the sensitive credential to gather, in response to the primary evidence, corroborating evidence of the possible attempted theft of the sensitive credential by performing at least one of:

detecting an attempt to exfiltrate the sensitive credential from the secured computing system;

detecting a use of the secure credential in attempting to launch a computer process within the secured computing system; or

detecting an attempt to access the secured computing system using the secure credential, wherein the corroborating evidence is, alone or in combination with the primary evidence, sufficient to show, above the predetermined confidence level, actual theft of the sensitive credential; and

automatically performing a security action in response to gathering the primary evidence and the corroborating evidence of the possible attempted theft.

2. The computer-implemented method of claim 1 , wherein tracking usage of the sensitive credential to gather the corroborating evidence of the possible attempted theft of the sensitive credential comprises detecting the attempt to exfiltrate the sensitive credential from the secured computing system.

3. The computer-implemented method of claim 2 , wherein performing the security action comprises blocking the attempt to exfiltrate the sensitive credential from the secured computing system.

4. The computer-implemented method of claim 2 , wherein:

the suspicious access of the sensitive credential from the credential store

generates a copy of the sensitive credential within the secured computing system;

detecting the attempt to exfiltrate the sensitive credential from the secured computing system comprises:

tracking, in response to gathering the primary evidence of the possible attempted theft, additional copies of the sensitive credential that are derived from the copy of the sensitive credential as the additional copies are propagated throughout the secured computing system; and

detecting an attempt to exfiltrate one of the additional copies from the secured computing system.

5. The computer-implemented method of claim 1 , wherein tracking usage of the sensitive credential to gather the corroborating evidence of the possible attempted theft of the sensitive credential comprises detecting the use of the secure credential in attempting to launch the computer process within the secured computing system.

6. The computer-implemented method of claim 5 , wherein performing the security action comprises preventing the computer process from performing any malicious action within the secured computing system.

7. The computer-implemented method of claim 1 , wherein tracking usage of the sensitive credential to gather the corroborating evidence of the possible attempted theft of the sensitive credential comprises detecting the attempt to access the secured computing system using the secure credential.

8. The computer-implemented method of claim 7 , wherein performing the security action comprises blocking the attempt to access the secured computing system.

9. The computer-implemented method of claim 1 , wherein performing the security action comprises blocking the possible attempted theft of the sensitive credential.

10. The computer-implemented method of claim 1 , wherein performing the security action comprises alerting an interested party of the possible attempted theft.

11. The computer-implemented method of claim 1 , wherein performing the security action comprises revoking access rights associated with the sensitive credential.

12. The computer-implemented method of claim 1 , wherein performing the security action comprises alerting an interested party of a breach of the secured computing system.

13. A system for detecting credential theft, the system comprising:

a monitoring module, stored in memory, that:

monitors a secured computing system's credential store that comprises at least one sensitive credential that is used to facilitate authentication of a user that is attempting to access the secured computing system;

gathers, while monitoring the credential store, primary evidence of a possible attempted theft of the sensitive credential from the credential store, wherein:

the primary evidence comprises evidence of a suspicious access of the sensitive credential from the credential store by a computer process that is not known to perform any part of a legitimate procedure of authenticating users; and

the primary evidence is not alone sufficient to show, above a predetermined confidence level, actual theft of the sensitive credential;

a corroborating module, stored in memory, that tracks usage of the sensitive credential to gather, in response to the primary evidence, corroborating evidence of the possible attempted theft of the sensitive credential by performing at least one of:

detecting an attempt to exfiltrate the sensitive credential from the secured computing system;

detecting a use of the secure credential in attempting to launch a computer process within the secured computing system; or

detecting an attempt to access the secured computing system using the secure credential, wherein the corroborating evidence is, alone or in combination with the primary evidence, sufficient to show, above the predetermined confidence level, actual theft of the sensitive credential;

a security module, stored in memory, that automatically performs a security action in response to the primary evidence and the corroborating evidence of the possible attempted theft; and

at least one physical processor that executes the monitoring module, the corroborating module, and the security module.

14. The system of claim 13 , wherein the corroborating module tracks usage of the sensitive credential to gather the corroborating evidence of the possible attempted theft of the sensitive credential by detecting the attempt to exfiltrate the sensitive credential from the secured computing system.

15. The system of claim 14 , wherein the security module performs the security action by blocking the attempt to exfiltrate the sensitive credential from the secured computing system.

16. The system of claim 13 , wherein the corroborating module tracks usage of the sensitive credential to gather the corroborating evidence of the possible attempted theft of the sensitive credential by detecting the use of the secure credential in attempting to launch the computer process within the secured computing system.

17. The system of claim 16 , wherein the security module performs the security action by preventing the computer process from performing any malicious action within the secured computing system.

18. The system of claim 13 , wherein the corroborating module tracks usage of the sensitive credential to gather the corroborating evidence of the possible attempted theft of the sensitive credential by detecting the attempt to access the secured computing system using the secure credential.

19. The system of claim 18 , wherein the security module performs the security action by blocking the attempt to access the secured computing system.

20. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

monitor a secured computing system's credential store that comprises at least one sensitive credential that is used to facilitate authentication of a user that is attempting to access the secured computing system;

gather, while monitoring the credential store, primary evidence of a possible attempted theft of the sensitive credential from the credential store, wherein:

the primary evidence comprises evidence of a suspicious access of the sensitive credential from the credential store by a computer process that is not known to perform any part of a legitimate procedure of authenticating users; and

the primary evidence is not alone sufficient to show, above a predetermined confidence level, actual theft of the sensitive credential;

track usage of the sensitive credential to gather, in response to the primary evidence, corroborating evidence of the possible attempted theft of the sensitive credential by performing at least one of:

detecting an attempt to exfiltrate the sensitive credential from the secured computing system;

detecting a use of the secure credential in attempting to launch a computer process within the secured computing system; or

detecting an attempt to access the secured computing system using the secure credential, wherein the corroborating evidence is, alone or in combination with the primary evidence, sufficient to show, above the predetermined confidence level, actual theft of the sensitive credential; and

automatically perform a security action in response to gathering the primary evidence and the corroborating evidence of the possible attempted theft.