Centralized aggregation technique for detecting lateral movement of stealthy cyber-attacks

A method performed by an attack analyzer located on a private network comprising:

• receiving a first indicator of a stealthy cyber-attack (SC-attack), the first indicator determined by detecting a software tool operating at a first endpoint on the private network and identifying the software tool operating at a first location along the private network, the software tool downloaded from a public network to the private network, the software tool for at least obtaining legitimate credentials for unauthorized access to one or more servers on the private network;
• receiving a second indicator of the SC-attack, the second indicator determined at a first appliance on the private network at a location different than the first endpoint by at least detecting a first suspicious pattern of accesses emanating from the first endpoint to the one or more servers and indicating a likelihood of unauthorized use of legitimate credentials, the first suspicious pattern of accesses using the legitimate credentials to access the one or more servers on the private network;
• correlating the first indicator and the second indicator to determine a presence of the software tool that is obtaining legitimate credentials for unauthorized access to the one or more servers operating as part of the private network and to detect the SC-attack is in progress on the private network;
• and
• performing secondary operations upon detecting the SC-attack during the correlating of at least the first and second indicators, the secondary operations include at least limiting or remediating consequences of the attack by instructing the first endpoint to invoke protective measures to prevent the attack from continuing or blocking similar attacks from occurring.

A system comprising:

• a memory coupled to a network interface, the memory configured to store a one or more processes and modules, the network interface coupled to a private network;
• and
• a processor coupled to the memory and adapted to execute the one or more processes and modules, wherein the one or more processes and modules when executed are operable to:
• receive one or more first indicators of a cyber-attack on the private network, the one or more first indicators including results of analyses of content included within information received from a public network that are determined at a first network vantage point being at a first location proximate to a periphery of the private network and types of content include executable software downloaded to a first node on the private network;
• receive one or more second indicators of the cyber-attack, the one or more second indicators including results of analyses of accesses from the first node to one or more servers on the private network in which the one or more second indicators are determined at a second network vantage point being a second location within the private network different than the first location;
• correlate at least the one or more first indicators and the one or more second indicators to detect the cyber-attack is in progress on the private network and to track progress of the cyber-attack conducted by the executable software;
• and
• perform secondary operations upon detecting the cyber-attack during the correlating of at least the first and second indicators, the secondary operations include at least (i) issuing an administrative alert or (ii) limiting or remediating consequences of the cyber-attack by instructing the first node to invoke protective measures to prevent the cyber-attack from continuing or blocking similar cyber-attacks from occurring.