Systems and methods for monitoring bait to protect users from security threats

A system for monitoring bait to protect users from security threats, the system comprising:

• a monitoring module, stored in memory, that monitors a bait computing resource to detect attempts to access the bait computing resource, the bait computing resource comprising a registry key;
• a virtualization module, stored in memory, that virtualizes, using a system filter driver, the bait computing resource to prevent a false positive by hiding the bait computing resource from at least one trusted application that has been categorized as safe, the filter driver hiding the bait computing resource by preventing the registry key from being revealed to the trusted application;
• a detection module, stored in memory, that detects an attempt by a different application to access the virtualized bait computing resource;
• a performance module, stored in memory, that performs a security action to protect a trusted user by reporting the attempt to access the virtualized bait computing resource by the different application;
• and
• at least one physical processor configured to execute the monitoring module, the virtualization module, the detection module, and the performance module;
• wherein the virtualization module virtualizing the bait computing resource enables the bait computing resource to deceive attackers into interacting with the bait computing resource while the bait computing resource remains unseen by legitimate users to avoid false positives.

A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• monitor a bait computing resource to detect attempts to access the bait computing resource, the bait computing resource comprising a registry key;
• virtualize, using a system filter driver, the bait computing resource to prevent a false positive by hiding the bait computing resource from at least one trusted application that has been categorized as safe, the filter driver hiding the bait computing resource by preventing the registry key from being revealed to the trusted application;
• detect an attempt by a different application to access the virtualized bait computing resource;
• and
• perform a security action to protect a trusted user by reporting the attempt to access the virtualized bait computing resource by the different application;
• wherein virtualizing the bait computing resource enables the bait computing resource to deceive attackers into interacting with the bait computing resource while the bait computing resource remains unseen by legitimate users to avoid false positives.