# US 10,320,833 B2 · System and method for detecting creation of malicious new user accounts by an attacker > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,833 B2 - Document ID: US10320833B2 - Status: Granted - Kind: B2 - Application number: 15/488,154 - Filed: 2017-04-14 - Published: 2018-10-18 - Granted: 2019-06-11 - Earliest claimed: 2017-04-14 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Moshe Israel; Nir Gafni; Josef Weizman - Web page: https://patentgrep.com/patent/US10320833B2 ## CPC - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06Q 10/40: Business processes related to social networking or social networking services - H04L 63/105: {Multiple levels of security} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 2221/2117: User registration - H04L 2463/121: Timestamp - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system is provided for detecting creation of malicious user accounts. The system includes a processor, a memory, and an application including instructions configured to: collect data corresponding to creation of new user accounts, where the new user accounts are associated with at least two distinct organizations, at least two distinct subscriptions, or at least two distinct customers, and where each of the new user accounts has a user name; determine properties based on the data and for a group of similar ones of the user names; evaluate the properties of the new user accounts corresponding to the group of similar ones of the user names and determine whether a probability for the new user accounts to be created having the group of similar ones of the user names is less than a predetermined threshold, and generate an alert based on a result of the evaluation of the properties. ## Claims ### Claim 1 A system for detecting creation of malicious user accounts and for modifying computing access of those malicious user accounts, the system comprising: one or more processors; and one or more computer-readable hardware storage devices having stored thereon computer-executable instructions which, when executed by the one or more processors, cause the system to: collect data corresponding to a plurality of user accounts, wherein the collected data at least describes a corresponding username for each user account included in the plurality of user accounts, and wherein the collected data is collected based on a security event in which log data associated with each user account in the plurality of user accounts is logged in one or more active directories; generate a cluster of related user accounts by identifying a set of related usernames, wherein: each related username in the set of related usernames is selected from the usernames described by the collected data, and the related usernames in the set are selected as a result of said related usernames sharing one or more username similarities with one another; based both on the set of related usernames and on one or more other corresponding characteristics of each related user account in the cluster of related user accounts, determine that the related user accounts in the cluster of related user accounts are malicious accounts; and selectively modify computing access of any one or more of the malicious accounts. ### Claim 2 (depends on 1) The system of claim 1, wherein execution of the computer-executable instructions further causes the system to: determine if one or more of the usernames described by the collected data correspond to a plurality of predetermined names, wherein the plurality of predetermined names includes administrator usernames, guest usernames, or a standard username. ### Claim 3 (depends on 2) The system of claim 2, wherein: the collected data includes timestamps of creation of the user accounts in the plurality of user accounts, and the cluster of related user accounts is generated based on differences in the timestamps. ### Claim 4 (depends on 2) The system of claim 2, wherein the plurality of predetermined names includes user names having a security level higher than or equal to a predetermined security level. ### Claim 5 (depends on 2) The system of claim 2, wherein the collected data further includes data describing computing ports associated with the plurality of user accounts. ### Claim 6 (depends on 2) The system of claim 2, wherein execution of the computer-executable instructions further causes the system to: compare the usernames described by the collected data by determining distances between pairs of the usernames, wherein the related usernames in the set of related usernames are selected based on corresponding distances of said related usernames. ### Claim 7 (depends on 6) The system of claim 6, wherein particular usernames are selected for inclusion in the set of related usernames based on whether corresponding distances of said particular usernames are less than a predetermined value. ### Claim 8 (depends on 7) The system of claim 7, wherein the distances are Levenshtein distances. ### Claim 9 (depends on 1) The system of claim 1, wherein the plurality of user accounts includes a user account of a predetermined operating system, a service provider user account, or a domain controller user account. ### Claim 10 (depends on 1) The system of claim 1, wherein the collected data includes: user types or account types of the plurality of user accounts; identifiers of account domains of the plurality of user accounts; and security identifiers of the plurality of user accounts. ### Claim 11 (depends on 1) The system of claim 1, wherein the collected data includes: identifiers or Internet protocol addresses of machines on which the plurality of user accounts were created; and one or more identifiers or Internet protocol addresses of one or more machines causing creation of the plurality of user accounts. ### Claim 12 (depends on 1) The system of claim 1, wherein execution of the computer-executable instructions further causes the system to: generate and send an alert to inform one or more other computing systems regarding the malicious accounts. ### Claim 13 (depends on 1) The system of claim 1, wherein selectively modifying computing access of the any one or more of the malicious accounts includes preventing further activity of the any one or more of the malicious accounts. ### Claim 14 (depends on 1) The system of claim 1, wherein selectively modifying computing access of the any one or more of the malicious accounts includes limiting the computing access to only a safe operating mode having limited computing functions. ### Claim 15 (depends on 1) The system of claim 1, wherein execution of the computer-executable instructions further causes the system to: determine a size of the set of related usernames; and generate an alert if the size is greater than a predetermined size. ### Claim 16 (depends on 1) The system of claim 1, wherein execution of the computer-executable instructions further causes the system to: determine a uniqueness of the related usernames in the set of related usernames; and generate an alert based on the uniqueness. ### Claim 17 A method for detecting creation of malicious user accounts and for modifying computing access of those malicious user accounts, the method being performed by a computing system and comprising: collecting data corresponding to a plurality of user accounts, wherein the collected data at least describes a corresponding username for each user account included in the plurality of user accounts, and wherein the collected data is collected based on a security event in which log data associated with each user account in the plurality of user accounts is logged in one or more active directories; generating a cluster of related user accounts by identifying a set of related usernames, wherein: each related username in the set of related usernames is selected from the usernames described by the collected data, and the related usernames in the set are selected as a result of said related usernames sharing one or more username similarities with one another; based both on the set of related usernames and on one or more other corresponding characteristics of each related user account in the cluster of related user accounts, determining that the related user accounts in the cluster of related user accounts are malicious accounts; and selectively modifying computing access of any one or more of the malicious accounts. ### Claim 18 (depends on 17) The method of claim 17, wherein the method further includes: determining a probability that the related user accounts in the cluster of related user accounts are malicious accounts. ### Claim 19 (depends on 17) The method of claim 17, wherein the cluster of related user accounts is generated based on one or more timestamps associated with each related user account in the cluster of related user accounts. ### Claim 20 One or more hardware storage devices having stored thereon computer-executable instructions that, when executed by one or more processors of a computer system, cause the computer system to detect creation of malicious user accounts and to modify computing access of those malicious user accounts by causing the computer system to: collect data corresponding to a plurality of user accounts, wherein the collected data at least describes a corresponding username for each user account included in the plurality of user accounts, and wherein the collected data is collected based on a security event in which log data associated with each user account in the plurality of user accounts is logged in one or more active directories; generate a cluster of related user accounts by identifying a set of related usernames, wherein: each related username in the set of related usernames is selected from the usernames described by the collected data, and the related usernames in the set are selected as a result of said related usernames sharing one or more username similarities with one another; based both on the set of related usernames and on one or more other corresponding characteristics of each related user account in the cluster of related user accounts, determine that the related user accounts in the cluster of related user accounts are malicious accounts; and selectively modify computing access of any one or more of the malicious accounts. ### Claim 21 (depends on 20) The one or more hardware storage devices of claim 20, wherein execution of the computer-executable instructions further causes the computer system to: determine a probability that the related user accounts in the cluster of related user accounts are malicious accounts.