Knowledge-aware detection of attacks on a client device conducted with dual-use tools

1. A computer-implemented method for knowledge-aware detection of attacks on a client device conducted with dual-use tools, at least a portion of the method being performed by a computing device comprising one or more processors, the method comprising:

obtaining, by a computing device, dual-use tool data related to a plurality of dual-use tools;

collecting, by the computing device, user input on a client device related to the use of at least one of the plurality of dual-use tools;

determining, by the computing device, that the user input contains at least a feature of the dual-use tool data;

creating, by the computing device, a behavioral index of the user input associated with the dual-use tool, wherein the behavioral index is based at least in part on one or more user actions that are performed by a user independent of the dual-use tool to interact with the dual-use tool, and wherein the behavioral index is stored on the client device;

detecting, by the computing device, new input on the client device;

determining, by the computing device, a similarity level between any of the user input and the new input;

flagging, by the computing device, a malicious attack on the client device based on determining that the similarity level does not satisfy a pre-determined threshold; and

implementing, by the computing device, a security action on the client device based on flagging the malicious attack.

2. The method of claim 1 , wherein the implementing of the security action comprises one or more of blocking network connectivity to the client device, or quarantining the client device, or a combination thereof.

3. The method of claim 1 , further comprising:

training, by the computing device, a machine learning model on the user input;

updating the behavioral index by applying the machine learning model to the behavioral index; and

determining that the malicious attack should be flagged based on an output of the machine learning model.

4. The method of claim 1 , wherein the obtaining of the dual-use tool data further comprises:

obtaining a list of names of dual-use tools, signatures, hashes, elements, code, or comments, or a combination thereof, from a third-party software development platform.

5. The method of claim 1 , wherein the one or more user actions that are performed by the user independent of the dual-use tool to interact with the dual-use tool comprise at least one of one or more search actions to search for one or more commands associated with the dual-use tool to enter into the dual-use tool or one or more copying actions to copy the one or more commands associated with the dual-use tool to enter into the dual-use tool.

6. The method of claim 1 , wherein the collecting of the user input further comprises:

scraping one or more of a webpage, a document, a file, a command line, or a clipboard, or a combination thereof, associated with the client device, wherein the scraping further comprises:

automatically collecting the user input including one or more of a user search query, command line history input, data entry, or commands copied to a clipboard, or a combination thereof.

7. The method of claim 6 , further comprising:

extracting tokens from the user input by extracting command names, positional arguments, and named arguments from the user input.

8. The method of claim 1 , wherein the detecting of the new input further comprises:

determining that the user copied a command onto a clipboard associated with the client device.

9. The method of claim 1 , wherein the determining of the similarity level further comprises:

applying an edit-distance algorithm between the new input and the user input.

10. The method of claim 1 , wherein the determining of the similarity level further comprises:

determining that no bits are different between a string of the new input and a string of the user input; and

indexing the new input as legitimate input based on determining that no bits are different.

11. The method of claim 1 , wherein the determining of the similarity level further comprises:

determining that a change in bits between a string of the new input and a string of the user input satisfies a confirmation policy threshold; and

requesting confirmation from the user that the new input was entered by the user into the client device.

12. The method of claim 1 , wherein the determining of the similarity level further comprises:

determining that a change in bits between a string of the new input and a string of the user input satisfies a threat threshold; and

implementing the security action on the client device based on determining that the change in bits satisfies the threat threshold.

13. One or more non-transitory computer-readable media comprising one or more computer readable instructions that, when executed by one or more processors of a security computing device cause a computing device to perform a method for knowledge-aware detection of attacks on a client device conducted with dual-use tools, the method comprising:

obtaining, by a computing device, dual-use tool data related to a plurality of dual-use tools;

collecting, by the computing device, user input on a client device related to the use of at least one of the plurality of dual-use tools;

determining, by the computing device, that the user input contains at least a feature of the dual-use tool data;

creating, by the computing device, a behavioral index of the user input associated with the dual-use tool, wherein the behavioral index is based at least in part on one or more user actions that are performed by a user independent of the dual-use tool to interact with the dual-use tool, and wherein the behavioral index is stored on the client device;

detecting, by the computing device, new input on the client device;

determining, by the computing device, a similarity level between any of the user input and the new input;

flagging, by the computing device, a malicious attack on the client device based on determining that the similarity level does not satisfy a pre-determined threshold; and

implementing, by the computing device, a security action on the client device based on flagging the malicious attack.

14. The one or more non-transitory computer-readable media of claim 13 , wherein the implementing of the security action further comprises:

one or more of blocking network connectivity to the client device, or quarantining the client device, or a combination thereof.

15. The one or more non-transitory computer-readable media of claim 13 , wherein the obtaining the application data further comprises:

obtaining a list of names of dual-use tools, signatures, hashes, elements, code, or comments, or a combination thereof, from a third-party software development platform.

16. The one or more non-transitory computer-readable media of claim 13 , wherein the collecting of the user input further comprises:

scraping one or more of a webpage, a document, a file, a command line, or a clipboard, or a combination thereof, associated with the client device.

17. The one or more non-transitory computer-readable media of claim 16 , wherein the scraping further comprises:

automatically collecting the user input including one or more of a user search query, command line history input, data entry, or commands copied to a clipboard, or a combination thereof.

18. The one or more non-transitory computer-readable media of claim 17 , further comprising:

extracting tokens from the user input by extracting command names, positional arguments, and named arguments from the user input.

19. The one or more non-transitory computer-readable media of claim 13 , wherein the determining of the similarity further comprises:

applying an edit-distance algorithm between the new input and the user input.

20. A system for knowledge-aware detection of attacks on a client device conducted with dual-use tools, the system comprising:

a processor;

a memory in electronic communication with the processor; and

instructions stored in the memory, the instructions being executable by the processor to:

obtain, by a computing device, dual-use tool data related to a plurality of dual-use tools;

collect, by the computing device, user input on a client device related to the use of at least one of the plurality of dual-use tools;

determine, by the computing device, that the user input contains at least a feature of the dual-use tool data;

create, by the computing device, a behavioral index of the user input associated with the dual-use tool, wherein the behavioral index is based at least in part on one or more user actions that are performed by a user independent of the dual-use tool to interact with the dual-use tool, and wherein the behavioral index is stored on the client device;

detect, by the computing device, new input on the client device;

determine, by the computing device, a similarity level between any of the user input and the new input;

flag, by the computing device, a malicious attack on the client device based on determining that the similarity level does not satisfy a pre-determined threshold; and

implement, by the computing device, a security action on the client device based on flagging the malicious attack.