Lateral movement facilitation of malicious attacks using honeypots

A non-transitory computer readable storage medium

• comprising program instructions executable to:
• receive a request to validate an opaque credential at a honeypot that is part of a honeypot fleet implemented in a network;
• extract context information associated with the opaque credential that indicates a domain of the opaque credential, a credential store of the opaque credential, an authentication mechanism of the request, and an application or a host intended for use by the request;
• perform, by the honeypot and based on the context information, a context-driven filtering of the request to determine that the request indicates a security concern that should be checked for credential compromise;
• validate the opaque credential to determine that opaque credential is compromised and that the opaque credential was presented as a legitimate credential to the honeypot in association with an attack;
• in response to determining that the opaque credential is compromised:
• log an alert indicating the presentation of the opaque credential to the honeypot in association with the attack;
• and
• perform a bifurcated deactivation operation on the opaque credential to (a) deactivate the opaque credential for one or more protected assets identified based on the context information and (b) transmit an instruction to other honeypots in the honeypot fleet to conceal the deactivation of the opaque credential and treat the opaque credential as the legitimate credential in the honeypot fleet so as to facilitate progression of the attack laterally within the honeypot fleet;
• and
• gather attack telemetry data from a lateral movement associated with the attack using the opaque credential, wherein the attack telemetry data comprises one or more attack mechanisms used by the attack and one or more targets sought by the attack.

A system comprising:

• one or more processors;
• and
• a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
• receive a request to validate an opaque credential at a honeypot that is part of a honeypot fleet implemented in a network;
• extract context information associated with the opaque credential that indicates a domain of the opaque credential, a credential store of the opaque credential, an authentication mechanism of the request, and an application or a host intended for use by the request;
• perform, by the honeypot and based on the context information, a context-driven filtering of the request to determine that the request indicates a security concern that should be checked for credential compromise;
• validate the opaque credential to determine that opaque credential is compromised and that the opaque credential was presented as a legitimate credential to the honeypot in association with an attack;
• in response to determining that the opaque credential is compromised:
• log an alert indicating the presentation of the opaque credential to the honeypot in association with the attack;
• and
• perform a bifurcated deactivation operation on the opaque credential to (a) deactivate the opaque credential for one or more protected assets identified based on the context information and (b) transmit an instruction to other honeypots in the honeypot fleet to conceal the deactivation of the opaque credential and treat the opaque credential as the legitimate credential in the honeypot fleet so as to facilitate progression of the attack laterally within the honeypot fleet;
• and
• gather attack telemetry data from a lateral movement associated with the attack using the opaque credential, wherein the attack telemetry data comprises one or more attack mechanisms used by the attack and one or more targets sought by the attack.