Detecting and protecting against computing breaches based on lateral movement of a computer file within an enterprise

A computer device for detecting and protecting against detecting and protecting against a computing breach based on lateral movement of a computer file within an enterprise, comprising:

• a processor;
• a memory in electronic communication with the processor;
• and
• instructions stored in the memory, the instructions being executable by the processor to:
• obtaining data associated with an existence a computer file in a first computing device and a second computing device of an enterprise;
• detecting a pattern of lateral movement of the computer file from the first computing device to the second computing device over a predetermined period of time, based on the data;
• generating a file movement graph comprising a first node and a second node, wherein the first node is associated with a first device and a first timestamp representative of when the computer file was determined to be associated with the first device, and wherein the second node is associated with a second device and a second timestamp of when the computer file was determined to be associated with the second device;
• calculating a likelihood score that the computer file is malicious based on the detected pattern and the file movement graph;
• determining that the likelihood score satisfies a predetermined breach threshold;
• and
• in response to determining that the likelihood score satisfies the predetermined breach threshold, initiating remedial action on the computer file to protect the enterprise against the computer file.

One or more non-transitory computer-readable media comprising one or more computer readable instructions that, when executed by one or more processors of a computing device, cause the computing device to perform a method for detecting and protecting against a computing breach based on lateral movement of a computer file within an enterprise, the method comprising:

• obtaining data associated with an existence a computer file in a first computing device and a second computing device of an enterprise;
• detecting a pattern of lateral movement of the computer file from the first computing device to the second computing device over a predetermined period of time, based on the data;
• generating a file movement graph comprising a first node and a second node, wherein the first node is associated with a first device and a first timestamp representative of when the computer file was determined to be associated with the first device, and wherein the second node is associated with a second device and a second timestamp of when the computer file was determined to be associated with the second device;
• calculating a likelihood score that the computer file is malicious based on the detected pattern and the file movement graph;
• determining that the likelihood score satisfies a predetermined breach threshold;
• and
• in response to determining that the likelihood score satisfies the predetermined breach threshold, initiating remedial action on the computer file to protect the enterprise against the computer file.