Detecting and reacting to malicious activity in decrypted application data
Described herein are systems and methods for detecting potentially malicious activity in a network session. Embodiments may involve identifying a requested network session between a first computer device and a second computer device, wherein the requested network session includes at least one security access message having an encrypted portion, obtaining a decryption key suitable for decrypting the encrypted portion of the security access message, decrypting the encrypted portion of the security access message with the decryption key, identifying a session key within the decrypted portion of the security access message, decrypting an application message that has been transmitted between the first computer device and the second computer device in the requested network session using the session key, and determining whether the decrypted application message includes an indicia of potentially malicious activity.
1. A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for detecting potentially malicious activity in a network session, comprising:
identifying a requested network session between a first computer device and a second computer device, wherein the requested network session includes at least one security access message having an encrypted portion;
obtaining, from a key distribution center, a decryption key suitable for decrypting the encrypted portion of the security access message, the decryption key being a secret key;
decrypting the encrypted portion of the security access message with the decryption key;
identifying a session key within the decrypted portion of the security access message; decrypting an application message that has been transmitted between the first computer device and the second computer device in the requested network session using the session key; and
determining whether the decrypted application message includes an indicia of potentially malicious activity, wherein the indicia of potentially malicious activity is determined based on at least one of:
comparing a pattern of expected network communications with observed network communications in the requested network session,
a potentially malicious command in the decrypted application message,
an execution of potentially malicious code identified from the decrypted application message,
a potentially malicious hash value identified from the decrypted application message,
a network address with which the first computer device or second computer device will attempt to communicate, identified from the decrypted application message,
a particular machine with which the first computer device or second computer device will attempt to communicate, identified from the decrypted application message, or
an identified pattern of network communications in a plurality of decrypted application messages.
2. The computer readable medium of claim 1 , wherein identifying the requested network session includes identifying an initial request for the network session before the network session is established.
3. The computer readable medium of claim 1 , wherein identifying the requested network session includes identifying an already-established network session.
4. The computer readable medium of claim 1 , wherein the security access message is a Kerberos ticket.
5. The computer readable medium of claim 1 , wherein the security access message is an authentication message used to authenticate the first computer device or the second computer device.
6. The computer readable medium of claim 1 , wherein the indicia of potentially malicious activity is based on comparing a pattern of expected network communications with observed network communications in the requested network session.
7. The computer readable medium of claim 1 , wherein the indicia of potentially malicious activity is based on a potentially malicious command in the decrypted application message.
8. The computer readable medium of claim 1 , wherein the indicia of potentially malicious activity is based on an execution of potentially malicious code identified from the decrypted application message.
9. The computer readable medium of claim 1 , wherein the indicia of potentially malicious activity is based on a signature of a potentially malicious file identified from the decrypted application message.
10. The computer readable medium of claim 1 , wherein the indicia of potentially malicious activity is based on a potentially malicious hash value identified from the decrypted application message.
11. The computer readable medium of claim 1 , wherein the indicia of potentially malicious activity is based on a network address with which the first computer device or second computer device will attempt to communicate, and is identified from the decrypted application message.
12. The computer readable medium of claim 1 , wherein the indicia of potentially malicious activity is based on a particular machine with which the first computer device or second computer device will attempt to communicate, and is identified from the decrypted application message.
13. The computer readable medium of claim 1 , wherein the indicia of potentially malicious activity is based on a result of a machine learning analysis that identifies potentially malicious activity in relation to the decrypted application message.
14. The computer readable medium of claim 1 , wherein the decryption key is obtained from an operating system directory service.
15. The computer readable medium of claim 1 , wherein the decryption key is obtained based on metadata included in the security access message.
16. The computer readable medium of claim 1 , further comprising:
decrypting the plurality of application messages that have been transmitted between the first computer device and the second computer device in the requested network session using the session key; and
determining whether the plurality of decrypted application messages include the indicia of potentially malicious activity.
17. The computer readable medium of claim 16 , wherein the indicia of potentially malicious activity is determined based on an identified pattern of network communications in the plurality of decrypted application messages.
18. A method for detecting potentially malicious activity in a network session, the method comprising:
identifying a requested network session between a first computer device and a second computer device, wherein the requested network session includes at least one security access message having an encrypted portion;
obtaining, from a key distribution center, a decryption key suitable for decrypting the encrypted portion of the security access message, the decryption key being a secret key;
decrypting the encrypted portion of the security access message with the decryption key;
identifying a session key within the decrypted portion of the security access message;
decrypting an application message that has been transmitted between the first computer device and the second computer device in the requested network session using the session key; and
determining whether the decrypted application message includes an indicia of potentially malicious activity, wherein the indicia of potentially malicious activity is determined based on at least one of:
comparing a pattern of expected network communications with observed network communications in the requested network session,
a potentially malicious command in the decrypted application message,
an execution of potentially malicious code identified from the decrypted application message,
a potentially malicious hash value identified from the decrypted application message,
a network address with which the first computer device or second computer device will attempt to communicate, identified from the decrypted application message,
a particular machine with which the first computer device or second computer device will attempt to communicate, identified from the decrypted application message, or
an identified pattern of network communications in a plurality of decrypted application messages.
19. The method of claim 18 , wherein the indicia of potentially malicious activity is based on comparing a pattern of expected network communications with observed network communications in the requested network session.
20. The method of claim 18 , wherein the indicia of potentially malicious activity is based on a potentially malicious command in the decrypted application message.
21. The method of claim 18 , wherein the indicia of potentially malicious activity is based on an execution of potentially malicious code identified from the decrypted application message.
22. The method of claim 18 , wherein the indicia of potentially malicious activity is based on a signature of a potentially malicious file identified from the decrypted application message.
23. The method of claim 18 , wherein the indicia of potentially malicious activity is based on a potentially malicious hash value identified from the decrypted application message.
24. The method of claim 18 , wherein the indicia of potentially malicious activity is based on a network address with which the first computer device or second computer device will attempt to communicate, and is identified from the decrypted application message.
25. The method of claim 18 , wherein the indicia of potentially malicious activity is based on a result of a machine learning analysis that identifies potentially malicious activity in relation to the decrypted application message.