Detecting lateral movement by malicious applications
Attempts at lateral movement are detected by monitoring failed login attempts across a number of endpoints in a network. By configuring endpoints across the network to report unsuccessful login attempts and monitoring these login attempts at a central location, patterns of attempts and failures may advantageously be detected and used to identify malicious attempts at lateral movement within the network before any unauthorized lateral movement is achieved.
1. A computer program product for detecting malicious lateral movement in a network, the computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
collecting notifications from each of a plurality of endpoints relating to a number of failed login attempts with other ones of the plurality of endpoints in the network;
analyzing the notifications to identify a compromised endpoint among the plurality of endpoints based on a pattern in the notifications including a number of failed login attempts consecutively at a number of different ones of the plurality of endpoints, wherein one or more of the number of failed login attempts exceeds a rate of ordinary manual login activity; and
when the pattern indicates a presence of malware on the compromised endpoint engaging in attempts at malicious lateral movement from the compromised endpoint, remediating the compromised endpoint by isolating the compromised endpoint from other ones of the plurality of endpoints.
2. The computer program product of claim 1 wherein remediating the compromised endpoint includes removing a malware component associated with the malware.
3. The computer program product of claim 1 wherein remediating includes killing a process associated with a malware component associated with the malware.
4. The computer program product of claim 1 wherein remediating includes terminating a user session associated with a malware component associated with the malware.
5. A method comprising:
collecting notifications from each of a plurality of endpoints relating to activity with other ones of the plurality of endpoints in a network;
analyzing the notifications to identify a malicious attempt at lateral movement from a compromised endpoint of the plurality of endpoints based on a pattern in the notifications including a number of failed login attempts consecutively at a number of different ones of the plurality of endpoints, wherein one or more of a number of failed login attempts exceeds ordinary manual login activity; and
when the pattern indicates a presence of an attack including a malicious attempt at lateral movement from the compromised endpoint, remediating the compromised endpoint by isolating the compromised endpoint from other ones of the plurality of endpoints.
6. The method of claim 5 wherein remediating the compromised endpoint includes removing a malware component associated with the attack.
7. The method of claim 5 wherein remediating the compromised endpoint includes at least one of killing a process associated with the attack, killing an application associated with the attack, initiating a root cause analysis, terminating a user session associated with the attack, revoking user credentials, requiring a step-up authentication for the endpoint, and notifying a security resource of the attack.
8. The method of claim 5 wherein collecting notifications includes collecting notifications at a cloud resource configured to identify patterns of malicious login behavior.
9. The method of claim 5 wherein the malicious attempt at lateral movement is associated with malware executing on the compromised endpoint.
10. The method of claim 5 wherein the malicious attempt at lateral movement is associated with at least one of a compromised application on the compromised endpoint or a malicious use of a user identity on the compromised endpoint.
11. The method of claim 5 wherein the notifications are based on authentication logs of the plurality of endpoints.
12. The method of claim 11 wherein the notifications are based on at least one of a network protocol or a failure pattern for each of a number of authentication attempts.
13. A system comprising:
a plurality of endpoints instrumented to transmit notifications of failed login attempts; and
a device coupled to the plurality of endpoints through a network, the device configured to receive the notifications from each of the plurality of endpoints over the network, and to identify a malicious lateral movement attempt from a compromised endpoint of the plurality of endpoints to another one of the plurality of endpoints based on a pattern in the notifications including a number of failed login attempts consecutively at a number of different ones of the plurality of endpoints, wherein one or more of the failed login attempts exceeds a rate of ordinary manual login activity.
14. The system of claim 13 wherein the device includes a firewall.
15. The system of claim 13 wherein the notifications are transmitted from recipients of the failed login attempts.
16. The system of claim 13 wherein the notifications are transmitted from originators of the failed login attempts.
17. The system of claim 13 wherein the pattern includes a number of login attempt failures at a receiving one of the plurality of endpoints.
18. The system of claim 13 wherein the pattern indicates a spray attack in which the compromised endpoint attempts a small number of logins consecutively at a number of different ones of the plurality of endpoints.
19. The system of claim 18 wherein each of the small number of logins uses a weak password.
20. The system of claim 13 wherein the pattern indicates a machine-initiated sequence of login attempts.