Techniques for utilizing a sensor in detecting privilege escalation
A system and method for detecting privilege escalation on a resource deployed in a computing environment is disclosed. The method includes: configuring the resource to deploy thereon a sensor, the sensor configured to listen on a data link layer of the resource for an event; receiving from the sensor a permission-based event based on a first actor, the permission-based event indicating a first permission set of the first actor; querying a database to detect a second permission set of the first actor; detecting that the first permission set includes a permission which is not in the second permission set; determining that the resource is involved in a privilege escalation event in response to detecting that the first permission set includes a permission which is not in the second permission set; and initiating a mitigation action in response to the determined privilege escalation event.
1 . A method for detecting privilege escalation on a resource deployed in a computing environment, comprising:
configuring the resource to deploy thereon a sensor, the sensor configured to listen on a data link layer of the resource for an event;
receiving from the sensor a permission-based event based on a first actor, the permission-based event indicating a first permission set of the first actor;
querying a database to detect a second permission set of the first actor;
detecting that the first permission set includes a permission which is not in the second permission set;
determining that the resource is involved in a privilege escalation event in response to detecting that the first permission set includes a permission which is not in the second permission set;
configuring the sensor to transmit an event of a second type, in response to determining the privilege escalation event;
receiving an event of the second type;
determining that the resource is a compromised resource in response to receiving the event of the second type; and
initiating a mitigation action in response to the determined privilege escalation event.
2 . The method of claim 1 , further comprising:
detecting in the database a parent actor of the first actor, wherein the parent actor is associated with a third permission set; and
determining that the resource is involved in a privilege escalation event in response to detecting that the first permission set includes a permission which is not in the third permission set.
3 . The method of claim 1 , further comprising:
configuring the sensor to perform any one of: detect an additional event, detect an additional event type, transmit an additional event, transmit an additional event type, and any combination thereof.
4 . The method of claim 1 , further comprising:
detecting an event indicating generation of the first actor in the resource.
5 . The method of claim 1 , further comprising:
generating an instruction to inspect the resource for a cybersecurity object.
6 . The method of claim 1 , wherein the mitigation action includes any one of: generating an alert, assigning a severity score to an alert, modifying a severity score of an alert, and any combination thereof.
7 . The method of claim 1 , wherein the permission-based event includes any one of: an event which indicates generating a new actor, an event indicating updating permissions of an existing actor, an event indicating generating a new process, an event indicating updating permissions of an existing process, and any combination thereof.
8 . A non-transitory computer-readable medium storing a set of instructions for detecting privilege escalation on a resource deployed in a computing environment, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
configure the resource to deploy thereon a sensor, the sensor configured to listen on a data link layer of the resource for an event;
receive from the sensor a permission-based event based on a first actor, the permission-based event indicating a first permission set of the first actor;
query a database to detect a second permission set of the first actor;
detect that the first permission set includes a permission which is not in the second permission set;
determine that the resource is involved in a privilege escalation event in response to detecting that the first permission set includes a permission which is not in the second permission set;
configure the sensor to transmit an event of a second type, in response to determining the privilege escalation event;
receive an event of the second type;
determine that the resource is a compromised resource in response to receiving the event of the second type; and
initiate a mitigation action in response to the determined privilege escalation event.
9 . A system for detecting privilege escalation on a resource deployed in a computing environment comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
configure the resource to deploy thereon a sensor, the sensor configured to listen on a data link layer of the resource for an event;
receive from the sensor a permission-based event based on a first actor, the permission-based event indicating a first permission set of the first actor;
query a database to detect a second permission set of the first actor;
detect that the first permission set includes a permission which is not in the second permission set;
determine that the resource is involved in a privilege escalation event in response to detecting that the first permission set includes a permission which is not in the second permission set;
configure the sensor to transmit an event of a second type, in response to determining the privilege escalation event;
receive an event of the second type;
determine that the resource is a compromised resource in response to receiving the event of the second type; and
initiate a mitigation action in response to the determined privilege escalation event.
10 . The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect in the database a parent actor of the first actor, wherein the parent actor is associated with a third permission set; and
determine that the resource is involved in a privilege escalation event in response to detecting that the first permission set includes a permission which is not in the third permission set.
11 . The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: configure the sensor to perform any one of: detect an additional event, detect an additional event type, transmit an additional event, transmit an additional event type, and any combination thereof.
12 . The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
detect an event indicating generation of the first actor in the resource.
13 . The system of claim 9 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:
generate an instruction to inspect the resource for a cybersecurity object.
14 . The system of claim 9 , wherein the mitigation action includes any one of:
generating an alert, assigning a severity score to an alert, modifying a severity score of an alert, and any combination thereof.
15 . The system of claim 9 , wherein the permission-based event includes any one of:
an event which indicates generating a new actor, an event indicating updating permissions of an existing actor, an event indicating generating a new process, an event indicating updating permissions of an existing process, and any combination thereof.