Systems and methods for monitoring bait to protect users from security threats

1. A computer-implemented method for monitoring bait to protect users from security threats, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

monitoring a bait computing resource to detect attempts to access the bait computing resource, the bait computing resource comprising a registry key;

virtualizing, using a system filter driver, the bait computing resource to prevent a false positive by hiding the bait computing resource from at least one trusted application that has been categorized as safe, the filter driver hiding the bait computing resource by preventing the registry key from being revealed to the trusted application;

detecting an attempt by a different application to access the virtualized bait computing resource; and

performing a security action to protect a trusted user by reporting the attempt to access the virtualized bait computing resource by the different application;

wherein virtualizing the bait computing resource enables the bait computing resource to deceive attackers into interacting with the bait computing resource while the bait computing resource remains unseen by legitimate users to avoid false positives.

2. The computer-implemented method of claim 1 , wherein the virtualized bait computing resource further comprises a file.

3. The computer-implemented method of claim 1 , wherein virtualizing the bait computing resource is performed by an operating system filter driver.

4. The computer-implemented method of claim 1 , wherein virtualizing the bait computing resource to prevent the false positive comprises:

generating a list of trusted applications; and

virtualizing the bait computing resource to hide the bait computing resource from each application on the list of trusted applications.

5. The computer-implemented method of claim 4 , wherein generating the list of trusted applications comprises identifying applications that are used by the trusted user.

6. The computer-implemented method of claim 1 , wherein virtualizing the bait computing resource renders the bait computing resource invisible to the trusted user.

7. The computer-implemented method of claim 1 , wherein the attempt to access the virtualized bait computing resource by the different application is reported to an administrator to enable the administrator to investigate whether the attempt constitutes an attempted security breach.

8. The computer-implemented method of claim 1 , wherein the bait computing resource is deployed across a network from a management service to an endpoint agent on the computing device.

9. The computer-implemented method of claim 1 , wherein the method is performed through an EPDRP platform that is executing on the computing device.

10. The computer-implemented method of claim 9 , wherein the EPDRP platform deploys the bait computing resource by leveraging an existing deployment function that was previously used to deploy non-bait computing resources.

11. A system for monitoring bait to protect users from security threats, the system comprising:

a monitoring module, stored in memory, that monitors a bait computing resource to detect attempts to access the bait computing resource, the bait computing resource comprising a registry key;

a virtualization module, stored in memory, that virtualizes, using a system filter driver, the bait computing resource to prevent a false positive by hiding the bait computing resource from at least one trusted application that has been categorized as safe, the filter driver hiding the bait computing resource by preventing the registry key from being revealed to the trusted application;

a detection module, stored in memory, that detects an attempt by a different application to access the virtualized bait computing resource;

a performance module, stored in memory, that performs a security action to protect a trusted user by reporting the attempt to access the virtualized bait computing resource by the different application; and

at least one physical processor configured to execute the monitoring module, the virtualization module, the detection module, and the performance module;

wherein the virtualization module virtualizing the bait computing resource enables the bait computing resource to deceive attackers into interacting with the bait computing resource while the bait computing resource remains unseen by legitimate users to avoid false positives.

12. The system of claim 11 , wherein the virtualized bait computing resource further comprises a file.

13. The system of claim 11 , wherein the virtualization module virtualizes the bait computing resource using an operating system filter driver.

14. The system of claim 11 , wherein the virtualization module virtualizes the bait computing resource to prevent the false positive at least in part by:

generating a list of trusted applications; and

virtualizing the bait computing resource to hide the bait computing resource from each application on the list of trusted applications.

15. The system of claim 14 , wherein the virtualization module generates the list of trusted applications by identifying applications that are used by the trusted user.

16. The system of claim 11 , wherein the virtualization module virtualizes the bait computing resource in a manner that renders the bait computing resource invisible to the trusted user.

17. The system of claim 11 , wherein the performance module reports the attempt to access the virtualized bait computing resource by the different application to an administrator to enable the administrator to investigate whether the attempt constitutes an attempted security breach.

18. The system of claim 11 , wherein the monitoring module receives the bait computing resource from a management service that deploys the bait computing resource across a network to the monitoring module.

19. The system of claim 11 , wherein the system comprises an EPDRP platform.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

monitor a bait computing resource to detect attempts to access the bait computing resource, the bait computing resource comprising a registry key;

virtualize, using a system filter driver, the bait computing resource to prevent a false positive by hiding the bait computing resource from at least one trusted application that has been categorized as safe, the filter driver hiding the bait computing resource by preventing the registry key from being revealed to the trusted application;

detect an attempt by a different application to access the virtualized bait computing resource; and

perform a security action to protect a trusted user by reporting the attempt to access the virtualized bait computing resource by the different application;

wherein virtualizing the bait computing resource enables the bait computing resource to deceive attackers into interacting with the bait computing resource while the bait computing resource remains unseen by legitimate users to avoid false positives.