SYSTEMS, METHODS, AND DEVICES FOR PREVENTING CREDENTIAL PASSING ATTACKS
A system and method for the detection and mitigation of Kerberos golden ticket, silver ticket, and related identity-based cyberattacks by passively monitoring and analyzing Kerberos and authentication operations within the network. The system and method provide real-time detections of identity attacks using time-series data and data pipelines, and by transforming the stateless Kerberos protocol into stateful protocol. A packet capturing agent is deployed on the network where captured time-series Kerberos and related event and log information is processed in distributed computational graph (DCG) stages where declarative rules determine if an attack is being carried out and what type of attack it is.
1 . (canceled)
2 . A computer-implemented method for preventing credential passing attacks, the computer-implemented method comprising:
receiving, by a computer system, an input;
determining, by a credential passing mitigation module, whether the input is a credential access command, wherein the determination of whether the input is a credential access command comprises searching for occurrences of references to executables related to a credential in a user session;
if the input is determined to be a credential access command, performing, by an anomaly detection module, anomaly detection corresponding to the credential access command, wherein performing the anomaly detection comprises:
evaluating whether a user is a valid domain user to which the credential belongs;
evaluating whether an elapsed time of the credential is greater than a maximum lifetime of the credential; and
evaluating whether a privilege attribute certificate of the credential is valid;
determining that an anomaly exists; and
performing mitigation of the anomaly,
wherein the computer system comprises a processor and memory.
3 . The computer-implemented method of claim 1 , wherein the input comprises a console command and command parameters, an intercepted application programming interface (API) call, payload data in network packets, and/or a credential ticket.
4 . The computer-implemented method of claim 1 , wherein the input is a file transfer application programming interface (API) call that references a file to be transferred, and wherein the method further comprises:
determining whether the file to be transferred is an executable; and
if the file to be transferred is determined to be an executable, transmitting, by the computer system, a report to a security module, wherein the report includes a hash generated from the executable file.
5 . The computer-implemented method of claim 1 , further comprising:
receiving, by a security module, a report from one or more other computer systems;
performing, by the security module, pattern recognition, wherein the pattern recognition comprises comparing the report to a plurality of predetermined patterns; and
determining, by the security module, that an alert threshold has been met based on whether the report matches any one of the plurality of predetermined patterns.
6 . The computer-implemented method of claim 5 , further comprising:
generating an alert, wherein the alert includes data from the report; and
mitigating, by the computer system, the alert by deleting the executables.
7 . The computer-implemented method of claim 1 , wherein the input comprises network packet data, wherein the network packet data is determined by:
intercepting, by the computer system, network packets, wherein the network packets comprise incoming or outgoing packets relative to the computer system;
parsing, by the computer system, each packet of the network packets according to a protocol used to generate each packet, in order to obtain network packet data from each packet; and
decoding, by the computer system, each packet in order to obtain network packet data from each packet.
8 . The computer-implemented method of claim 1 , wherein performing mitigation of the anomaly comprises deleting the input, adding a representation of the input to an anti-virus software, restoring files modified by the input, and taking steps to reduce actions performed by the input.
9 . The computer-implemented method of claim 1 , wherein evaluating whether the user is a valid domain user to which the credential belong comprises querying a domain controller to determine whether the user is a member of the domain.
10 . The computer-implemented method of claim 1 , wherein evaluating whether the elapsed time of the credential is greater than a maximum lifetime of the credential comprises determining whether the elapsed time since the credential was issued is greater than the maximum lifetime for that type of credential according to a KERBEROS policy.
11 . The computer-implemented method of claim 1 , wherein evaluating whether a privilege attribute certificate of the credential is valid comprises evaluating logs of a logon server to determine existence of an issuance record of the credential to the user.
12 . A computer system for preventing credential passing attacks, the computer system comprising:
one or more non-transitory computer storage media configured to store computer-executable instructions that when executed by a central coordinating processing node and/or a plurality of processing nodes, cause the central coordinating processing node and/or the plurality of processing nodes to:
receive an input;
determine whether the input is a credential access command, wherein the determination of whether the input is a credential access command comprises searching for occurrences of references to executables related to a credential in a user session;
if the input is determined to be a credential access command, perform anomaly detection corresponding to the credential access command, wherein performing the anomaly detection comprises:
evaluating whether a user is a valid domain user to which the credential belongs;
evaluating whether an elapsed time of the credential is greater than a maximum lifetime of the credential; and
evaluating whether a privilege attribute certificate of the credential is valid;
determine that an anomaly exists; and
perform mitigation of the anomaly.
13 . The computer system of claim 12 , wherein the input comprises a console command and command parameters, an intercepted application programming interface (API) call, payload data in network packets, and/or a credential ticket.
14 . The computer system of claim 12 , wherein the input is a file transfer application programming interface (API) call that references a file to be transferred, and wherein the method further comprises:
determining whether the file to be transferred is an executable; and
if the file to be transferred is determined to be an executable, transmitting, by the computer system, a report to a security module, wherein the report includes a hash generated from the executable file.
15 . The computer system of claim 12 , further comprising:
receiving, by a security module, a report from one or more other computer systems;
performing, by the security module, pattern recognition, wherein the pattern recognition comprises comparing the report to a plurality of predetermined patterns; and
determining, by the security module, that an alert threshold has been met based on whether the report matches any one of the plurality of predetermined patterns.
16 . The computer system of claim 15 , further comprising:
generating an alert, wherein the alert includes data from the report; and
mitigating, by the computer system, the alert by deleting the executables.
17 . The computer system of claim 11 , wherein the input comprises network packet data, wherein the network packet data is determined by:
intercepting, by the computer system, network packets, wherein the network packets comprise incoming or outgoing packets relative to the computer system;
parsing, by the computer system, each packet of the network packets according to a protocol used to generate each packet, in order to obtain network packet data from each packet; and
decoding, by the computer system, each packet in order to obtain network packet data from each packet.
18 . The computer system of claim 11 , wherein performing mitigation of the anomaly comprises deleting the input, adding a representation of the input to an anti-virus software, restoring files modified by the input, and taking steps to reduce actions performed by the input.
19 . The computer system of claim 11 , wherein evaluating whether the user is a valid domain user to which the credential belong comprises querying a domain controller to determine whether the user is a member of the domain.
20 . The computer system of claim 11 , wherein evaluating whether the elapsed time of the credential is greater than a maximum lifetime of the credential comprises determining whether the elapsed time since the credential was issued is greater than the maximum lifetime for that type of credential according to a KERBEROS policy.
21 . The computer system of claim 11 , wherein evaluating whether a privilege attribute certificate of the credential is valid comprises evaluating logs of a logon server to determine existence of an issuance record of the credential to the user.