Security system for detection and mitigation of malicious communications

A method for detecting and mitigating malicious communications, wherein the method is configured to deliver indicators of compromise in response to identifying and isolating malicious communication, the method comprising:

• receiving, via a first operative communication channel, an electronic communication from a first networked device of a plurality of networked devices;
• analyzing the electronic communication (i) to determine whether the electronic communication comprises a malicious attachment, (ii) to determine whether the electronic communication comprises a malicious Uniform Resource Locator (URL), and/or (iii) to determine whether the electronic communication is malicious;
• based on determining that (i) the electronic communication comprises a malicious attachment, (ii) the electronic communication comprises a malicious URL, and/or (iii) the electronic communication is malicious, determining an indicator of compromise (IOC) associated with the electronic communication;
• constructing an indicator package configured for a threat prevention system of the first networked device, wherein the indicator package comprises the IOC;
• transmitting, via the first operative communication channel, the indicator package to the first networked device;
• and
• transmitting a second indicator package to the first networked device, wherein the second indicator package comprises one or more IOCs extracted from one or more electronic communications received from one or more entities not associated with the first networked device;
• analyzing a prior electronic communication stored at a first storage location;
• comparing the electronic communication to the prior electronic communication stored at the first storage location, wherein comparing comprises comparing unstructured data of the electronic communication with prior unstructured data of the prior electronic communication;
• based on determining that at a predetermined portion of the unstructured data of the electronic communication matches a corresponding predetermined portion of the prior unstructured data of the prior electronic communication, logging the electronic communication at a log memory location;
• and
• based on determining that at the predetermined portion of the unstructured data of the electronic communication does not match the corresponding predetermined portion of the prior unstructured data of the prior electronic communication, storing the electronic communication at the first storage location.

A computerized system for detecting and mitigating malicious communications, wherein the computerized system is configured to simulate malicious communications, the computerized system comprising:

• a memory device with computer-readable program code stored thereon;
• a communication device, wherein the communication device is configured to establish operative communication with a plurality of networked devices via a communication network;
• one or more processing devices operatively coupled to the memory device and the communication device, wherein the one or more processing devices are configured to execute the computer-readable program code to:
• receive, via a first operative communication channel, an electronic communication from one of the plurality of networked devices;
• analyze the electronic communication to determine whether the electronic communication comprises a malicious simulation signature;
• in response to determining that the electronic communication does not comprise the malicious simulation signature, analyze the electronic communication (i) to determine whether the electronic communication comprises a malicious attachment, (ii) to determine whether the electronic communication comprises a malicious Uniform Resource Locator (URL), and/or (iii) to determine whether the electronic communication is malicious;
• based on determining that (i) the electronic communication comprises a malicious attachment, (ii) the electronic communication comprises a malicious URL, and/or (iii) the electronic communication is malicious, construct a simulated malicious electronic communication based on the electronic communication;
• transmit the simulated malicious electronic communication to a first networked device of plurality of networked devices;
• transmit a user training communication to the first networked device, wherein the user training communication is configured to provide training to a user of the first networked device for reporting malicious electronic communications, wherein the user training communication is transmitted (i) at a predetermined time period, or (ii) in response to determining a predetermined user action associated with the simulated electronic communication;
• receive, via a second operative communication channel, the simulated electronic communication from the user of the first networked device;
• analyze the simulated electronic communication to determine whether the user correctly identified the simulated electronic communication as malicious;
• and
• in response to determining that the user correctly identified the simulated electronic communication as malicious, transmit a notification to the first networked device indicating the successful identification of the simulated electronic communication by the user.

A computerized system for detecting and mitigating malicious communications, wherein the computerized system is configured to deliver indicators of compromise in response to identifying and isolating malicious communication, the computerized system comprising:

• a memory device with computer-readable program code stored thereon;
• a communication device, wherein the communication device is configured to establish operative communication with a plurality of networked devices via a communication network;
• one or more processing devices operatively coupled to the memory device and the communication device, wherein the one or more processing devices are configured to execute the computer-readable program code to:
• receive, via a first operative communication channel, an electronic communication from a first networked device of the plurality of networked devices;
• analyze the electronic communication (i) to determine whether the electronic communication comprises a malicious attachment, (ii) to determine whether the electronic communication comprises a malicious Uniform Resource Locator (URL), and/or (iii) to determine whether the electronic communication is malicious;
• based on determining that (i) the electronic communication comprises a malicious attachment, (ii) the electronic communication comprises a malicious URL, and/or (iii) the electronic communication is malicious, determine an indicator of compromise (IOC) associated with the electronic communication;
• construct an indicator package configured for a threat prevention system of the first networked device, wherein the indicator package comprises the IOC;
• transmit, via the first operative communication channel, the indicator package to the first networked device;
• transmit a second indicator package to the first networked device, wherein the second indicator package comprises one or more IOCs extracted from one or more electronic communications received from one or more entities not associated with the first networked device;
• construct a simulated malicious electronic communication based on the electronic communication;
• transmit the simulated malicious electronic communication to the first networked device;
• transmit a user training communication to the first networked device, wherein the user training communication is configured to provide training to a user of the first networked device for reporting malicious electronic communications, wherein the user training communication is transmitted (i) at a predetermined time period, or (ii) in response to determining a predetermined user action associated with the simulated electronic communication;
• receive, via the first operative communication channel, the simulated electronic communication from the user of the first networked device;
• analyze the simulated electronic communication to determine whether the user correctly identified the simulated electronic communication as malicious;
• and
• in response to determining that the user correctly identified the simulated electronic communication as malicious, transmit a notification to the first networked device indicating successful identification of the simulated electronic communication by the user.

A computerized system for detecting and mitigating malicious communications, wherein the computerized system is configured to simulate malicious communications, the computerized system comprising:

• a memory device with computer-readable program code stored thereon;
• a communication device, wherein the communication device is configured to establish operative communication with a plurality of networked devices via a communication network;
• one or more processing devices operatively coupled to the memory device and the communication device, wherein the one or more processing devices are configured to execute the computer-readable program code to:
• receive, via a first operative communication channel, an electronic communication from one of the plurality of networked devices;
• analyze the electronic communication to determine whether the electronic communication comprises a malicious simulation signature;
• in response to determining that the electronic communication does not comprise the malicious simulation signature, analyze the electronic communication (i) to determine whether the electronic communication comprises a malicious attachment, (ii) to determine whether the electronic communication comprises a malicious Uniform Resource Locator (URL), and/or (iii) to determine whether the electronic communication is malicious;
• based on determining that (i) the electronic communication comprises a malicious attachment, (ii) the electronic communication comprises a malicious URL, and/or (iii) the electronic communication is malicious, construct a simulated malicious electronic communication based on the electronic communication;
• transmit the simulated malicious electronic communication to a first networked device of plurality of networked devices;
• transmit a user training communication to the first networked device, wherein the user training communication is configured to provide training to a user of the first networked device for reporting malicious electronic communications, wherein the user training communication is transmitted (i) at a predetermined time period, or (ii) in response to determining a predetermined user action associated with the simulated electronic communication;
• identify at least one of one or more predetermined tactics, techniques and/or procedures associated with the electronic communication;
• and
• based on the identified at least one of the one or more tactics, techniques and/or procedures, construct a simulation template;
• wherein the simulated malicious electronic communication is constructed based on the simulation template.