Host-level ticket forgery detection and extension to network endpoints
A system and method for detection and prevention of ticket forgery cyberattacks by improving host-level analytics and monitoring and extending the improved host-level analytics and monitoring to endpoints of a network. The methodology described herein comprises the use of a ticket-granting log extension utility which stores every logon session on a network, queries the local ticket cache, and generates additional custom data as a part of an event log stream such as a start time, end time, renew time, and related session data. This comprehensive log extension data can be used to identify certain types of ticket forgery cyberattacks by comparing the user session name with the client name identified in the ticket presented for access to network resources and other means. This host-level ticket forgery detection can be extended to network endpoints for additional security.
1 . A cybersecurity system for host-level pass-the-ticket forgery detection, comprising:
a first computing device comprising a memory, a processor, and a non-volatile data storage device;
an authentication ticket log extension database stored on the non-volatile data storage device, the authentication ticket log extension database comprising additional log data for a ticket-granting-type cybersecurity protocol, the additional log data comprising a start time, an end time, and a renewal time for each ticket issued by the ticket-granting-type cybersecurity protocol;
a ticket granting security system comprising a first plurality of programming instructions stored in the memory which, when operating on the processor, causes the first computing device to:
install a ticket granting log extension utility on one or more second computing devices;
receive the additional log data generated by the ticket granting log extension utility;
monitor access requests by a client operating on a local host computer for access to resources on a network;
identify a ticket generated by the ticket-granting-type cybersecurity protocol associated with an attempted access of a network resource, the ticket comprising a client name;
retrieve a user session name for the attempted access;
compare the client name with the user session name; and
where there is a mismatch between the client name and user session name, send a destroy ticket command to a key distribution service using the ticket-granting-type cybersecurity protocol; and
the ticket granting log extension utility comprising a second plurality of programming instructions operating on the one or more second computing devices which causes each second computing device to:
enumerate every logon session on the second computing device;
query a local ticket cache of the second computing device to obtain a log data stream for the logon session;
generate the additional log data to supplement the log data stream; and
store the additional log data as part of the log data stream.
2 . The cybersecurity system of claim 1 , wherein the first computing device is the local host computer, and the ticket granting security system is operating on the local host computer.
3 . The cybersecurity system of claim 1 , wherein the first computing device is a cloud-based server separate from the local host computer, and the ticket granting security system is operating on the cloud-based server, monitoring access requests by the local host computer.
4 . The cybersecurity system of claim 1 , wherein the first plurality of programming instructions of the ticket granting security system further cause the first computing device to determine that the ticket is forged by comparing the start time for the ticket from the additional log data to an expected start time, and upon determining that the ticket is forged, sending a destroy ticket command to the key distribution service using the ticket-granting-type cybersecurity protocol.
5 . The cybersecurity system of claim 1 , wherein the first plurality of programming instructions of the ticket granting security system further cause the first computing device to determine that the ticket is forged by comparing the end time for the ticket from the additional log data to an expected end time, and upon determining that the ticket is forged, sending a destroy ticket command to the key distribution service using the ticket-granting-type cybersecurity protocol.
6 . The cybersecurity system of claim 1 , wherein the first plurality of programming instructions of the ticket granting security system further cause the first computing device to determine that the ticket is forged by comparing the renewal time for the ticket from the additional log data to an expected renewal time, and upon determining that the ticket is forged, sending a destroy ticket command to the key distribution service using the ticket-granting-type cybersecurity protocol.
7 . The cybersecurity system of claim 1 , wherein the additional log data is stored in a graph-based information storage service.
8 . The cybersecurity system of claim 1 , wherein the additional log data further comprises an encryption level for each ticket issued by the ticket-granting-type cybersecurity protocol.
9 . The cybersecurity system of claim 8 , wherein the first plurality of programming instructions of the ticket granting security system further cause the first computing device to determine that the ticket is forged by comparing the encryption level for the ticket from the additional log data to a current encryption level for the ticket to determine if the encryption level has been downgraded, and upon determining that the encryption level has been downgraded, sending a destroy ticket command to the key distribution service using the ticket-granting-type cybersecurity protocol.
10 . A cybersecurity method for host-level pass-the-ticket forgery detection, comprising the steps of:
storing an authentication ticket log extension database on a non-volatile data storage device of a first computing device comprising a memory, a processor, and the non-volatile data storage device, the authentication ticket log extension database comprising additional log data for a ticket-granting-type cybersecurity protocol, the additional log data comprising a start time, an end time, and a renewal time for each ticket issued by the ticket-granting-type cybersecurity protocol;
using a ticket granting security system operating on the first computing device to perform the steps of:
installing a ticket granting log extension utility on one or more second computing devices;
receiving the additional log data generated by the ticket granting log extension utility;
monitoring access requests by a client operating on a local host computer for access to resources on a network;
identifying a ticket generated by the ticket-granting-type cybersecurity protocol associated with an attempted access of a network resource, the ticket comprising a client name;
retrieving a user session name for the attempted access;
comparing the client name with the user session name; and
where there is a mismatch between the client name and user session name, sending a destroy ticket command to a key distribution service using the ticket-granting-type cybersecurity protocol; and
using the ticket granting log extension utility operating on the one or more second computing devices to perform the following steps for each second computing device:
enumerating every logon session on the second computing device;
querying a local ticket cache of the second computing device to obtain a log data stream for the logon session;
generating the additional log data to supplement the log data stream; and
storing the additional log data as part of the log data stream.
11 . The cybersecurity method of claim 10 , wherein the first computing device is the local host computer, and the ticket granting security system is operating on the local host computer.
12 . The cybersecurity method of claim 10 , wherein the first computing device is a cloud-based server separate from the local host computer, and the ticket granting security system is operating on the cloud-based server, monitoring access requests by the local host computer.
13 . The cybersecurity method of claim 10 , wherein the method is further configured to drop or block data packets associated with the ticket after the ticket destroy command has been sent.
14 . The cybersecurity method of claim 10 , wherein the ticket granting security system further determines that the ticket is forged by comparing the start time for the ticket from the additional log data to an expected start time, and upon determining that the ticket is forged, sending a destroy ticket command to the key distribution service using the ticket-granting-type cybersecurity protocol.
15 . The cybersecurity method of claim 10 , wherein the ticket granting security system further determines that the ticket is forged by comparing the end time for the ticket from the additional log data to an expected end time, and upon determining that the ticket is forged, sending a destroy ticket command to the key distribution service using the ticket-granting-type cybersecurity protocol.
16 . The cybersecurity method of claim 10 , wherein the ticket granting security system further determines that the ticket is forged by comparing the renewal time for the ticket from the additional log data to an expected renewal time, and upon determining that the ticket is forged, sending a destroy ticket command to the key distribution service using the ticket-granting-type cybersecurity protocol.
17 . The cybersecurity method of claim 10 , wherein the additional log data is stored in a graph-based information storage service.
18 . The cybersecurity method of claim 10 , wherein the additional log data further comprises an encryption level for each ticket issued by the ticket-granting-type cybersecurity protocol.
19 . The cybersecurity method of claim 18 , wherein the ticket granting security system further determines that the ticket is forged by comparing the encryption level for the ticket from the additional log data to a current encryption level for the ticket to determine if the encryption level has been downgraded, and upon determining that the encryption level has been downgraded, sending a destroy ticket command to the key distribution service using the ticket-granting-type cybersecurity protocol.
20 . The cybersecurity method of claim 10 , wherein the method is further configured to drop or block data packets associated with the ticket after the ticket destroy command has been sent.