System and method for detecting creation of malicious new user accounts by an attacker

A method for detecting creation of malicious user accounts and for modifying computing access of those malicious user accounts, the method being performed by a computing system and comprising:

• collecting data corresponding to a plurality of user accounts, wherein the collected data at least describes a corresponding username for each user account included in the plurality of user accounts, and wherein the collected data is collected based on a security event in which log data associated with each user account in the plurality of user accounts is logged in one or more active directories;
• generating a cluster of related user accounts by identifying a set of related usernames, wherein:
• each related username in the set of related usernames is selected from the usernames described by the collected data, and
• the related usernames in the set are selected as a result of said related usernames sharing one or more username similarities with one another;
• based both on the set of related usernames and on one or more other corresponding characteristics of each related user account in the cluster of related user accounts, determining that the related user accounts in the cluster of related user accounts are malicious accounts;
• and
• selectively modifying computing access of any one or more of the malicious accounts.

One or more hardware storage devices having stored thereon computer-executable instructions that, when executed by one or more processors of a computer system, cause the computer system to detect creation of malicious user accounts and to modify computing access of those malicious user accounts by causing the computer system to:

• collect data corresponding to a plurality of user accounts, wherein the collected data at least describes a corresponding username for each user account included in the plurality of user accounts, and wherein the collected data is collected based on a security event in which log data associated with each user account in the plurality of user accounts is logged in one or more active directories;
• generate a cluster of related user accounts by identifying a set of related usernames, wherein:
• each related username in the set of related usernames is selected from the usernames described by the collected data, and
• the related usernames in the set are selected as a result of said related usernames sharing one or more username similarities with one another;
• based both on the set of related usernames and on one or more other corresponding characteristics of each related user account in the cluster of related user accounts, determine that the related user accounts in the cluster of related user accounts are malicious accounts;
• and
• selectively modify computing access of any one or more of the malicious accounts.