# US 12,010,122 B2 · System and method for detecting lateral movement using cloud access keys > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,122 B2 - Document ID: US12010122B2 - Status: Granted - Kind: B2 - Application number: 18/474,974 - Filed: 2023-09-26 - Published: 2024-01-25 - Granted: 2024-06-11 - Earliest claimed: 2021-04-02 - Assignees: Wiz, Inc. - Applicants: Wiz, Inc. - Inventors: Avi Tal Lichtenstein; Ami Luttwak; Daniel Hershko Shemesh - Web page: https://patentgrep.com/patent/US12010122B2 ## CPC - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for detecting potential lateral movement using cloud keys in a cloud computing environment includes determining a first node in a security graph is a compromised node, wherein the security graph represents cloud entities of the cloud computing environment; detecting a cloud key node connected to the first node, wherein the cloud key node represents a cloud key of the cloud computing environment; and generating a potential lateral movement path, including the first node, and a second node, wherein the second node is connected to the cloud key node. ## Claims ### Claim 1 A method for detecting potential lateral movement in a cloud computing environment, comprising: generating in a security database a representation of a cloud computing environment, the cloud computing environment including a plurality of cloud entities; determining a first node in the security database is a compromised node wherein the first node represents a first cloud entity of the plurality of cloud entities; detecting a credential node connected to the first node, wherein the credential node represents a credential utilized in the cloud computing environment; and generating a potential lateral movement path, including the first node, and a second node representing a second cloud entity of the plurality of cloud entities, wherein the second node is connected to the credential node. ### Claim 2 (depends on 1) The method of claim 1, further comprising: determining that the first cloud entity is exploited. ### Claim 3 (depends on 1) The method of claim 1, wherein the credential is any one of: a certificate, a cloud key, a password, and a combination thereof. ### Claim 4 (depends on 1) The method of claim 1, wherein the credential is implemented as any one of: a text file, a configuration file, a structured configuration file, a script, a source code, and a combination thereof. ### Claim 5 (depends on 1) The method of claim 1, further comprising: determining an expiry of the credential; and determining that the potential lateral movement path is not a lateral movement path in response to determining that the credential is expired. ### Claim 6 (depends on 1) The method of claim 1, further comprising: inspecting a workload deployed in the cloud computing environment to detect the credential, wherein the workload is represented by the first node. ### Claim 7 (depends on 1) The method of claim 1, further comprising: inspecting a plurality of layers of the cloud computing environment for an object. ### Claim 8 (depends on 7) The method of claim 7, wherein the plurality of data layers includes any one of: an identity layer, a network layer, a code layer, and a combination thereof. ### Claim 9 A non-transitory computer-readable medium storing a set of instructions for detecting potential lateral movement in a cloud computing environment, the set of instructions comprising: one or more instructions that, when executed by one or more processors of a device, cause the device to: generate in a security database a representation of a cloud computing environment, the cloud computing environment including a plurality of cloud entities; determine a first node in the security database is a compromised node wherein the first node represents a first cloud entity of the plurality of cloud entities; detect a credential node connected to the first node, wherein the credential node represents a credential utilized in the cloud computing environment; and generate a potential lateral movement path, including the first node, and a second node representing a second cloud entity of the plurality of cloud entities, wherein the second node is connected to the credential node. ### Claim 10 A system for detecting potential lateral movement in a cloud computing environment comprising: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: generate in a security database a representation of a cloud computing environment, the cloud computing environment including a plurality of cloud entities; determine a first node in the security database is a compromised node, wherein the first node represents a first cloud entity of the plurality of cloud entities; detect a credential node connected to the first node, wherein the credential node represents a credential utilized in the cloud computing environment; and generate a potential lateral movement path, including the first node, and a second node representing a second cloud entity of the plurality of cloud entities, wherein the second node is connected to the credential node. ### Claim 11 (depends on 10) The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: determine that the first cloud entity is exploited. ### Claim 12 (depends on 10) The system of claim 10, wherein the credential is any one of: a certificate, a cloud key, a password, and a combination thereof. ### Claim 13 (depends on 10) The system of claim 10, wherein the credential is implemented as any one of: a text file, a configuration file, a structured configuration file, a script, a source code, and a combination thereof. ### Claim 14 (depends on 10) The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: determine an expiry of the credential; and determine that the potential lateral movement path is not a lateral movement path in response to determining that the credential is expired. ### Claim 15 (depends on 10) The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: inspect a workload deployed in the cloud computing environment to detect the credential, wherein the workload is represented by the first node. ### Claim 16 (depends on 10) The system of claim 10, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: inspect a plurality of layers of the cloud computing environment for an object. ### Claim 17 (depends on 16) The system of claim 16, wherein the plurality of layers includes any one of: an identity layer, a network layer, a code layer, and a combination thereof.