Adaptive authentication for ransomware intervention

A system for securing a computing environment from unauthorized access comprising:

• at least one processor,
• memory storing instructions, which executed by the at least one processor, result in operations comprising:
• identifying, based on (i) telemetry data generated by an agent executing on a monitored computing device and (ii) user integrity information, an event indicative of compromised credentials;
• determining, based on the identifying, a risk level for the event indicative of compromised credentials;
• mapping the risk level to an authentication difficulty level, the authentication difficulty level specifying types of authentication mechanisms to implement;
• enforcing the authentication difficulty level across one or more computing devices within the computing environment to counter the event indicative of compromised credentials;
• terminating any active sessions associated with the compromised credentials;
• and
• in response to subsequent use of the compromised credentials, recording session and process information associated with the subsequent use and generating an alert;
• wherein:
• the agent locally collects the telemetry data by monitoring operating-system kernel event streams including Event Tracing for Windows (ETW) security auditing events and Local Security Authority (LSA) settings and events;
• the telemetry data comprises at least credential provider changes, notification package changes, authentication package changes, and attempted access to a Local Security Authority Subsystem Service (lsass) process;
• and
• enforcing the authentication difficulty level comprises, via a pluggable authentication module (PAM) integrated with an endpoint authentication system on the monitored computing device, automatically requiring a token-based multi-factor authentication or denying authentication for accounts associated with the compromised credentials, including when the monitored computing device is unable to communicate with a remote monitoring platform.

A non-transitory computer-readable medium storing instructions which, when executed by at least one processor, result in operations comprising:

• identifying, based on (i) telemetry data generated by an agent executing on a monitored computing device and (ii) user integrity information, an event indicative of compromised credentials;
• determining, based on the identifying, a risk level for the event indicative of compromised credentials;
• mapping the risk level to an authentication difficulty level, the authentication difficulty level specifying types of authentication mechanisms to implement;
• enforcing the authentication difficulty level across one or more computing devices within the computing environment to counter the event indicative of compromised credentials;
• terminating any active sessions associated with the compromised credentials;
• and
• in response to subsequent use of the compromised credentials, recording session and process information associated with the subsequent use and generating an alert;
• wherein:
• the agent locally collects the telemetry data by monitoring operating-system kernel event streams including Event Tracing for Windows (ETW) security auditing events and Local Security Authority (LSA) settings and events;
• the telemetry data comprises at least credential provider changes, notification package changes, authentication package changes, and attempted access to a Local Security Authority Subsystem Service (lsass) process;
• and
• enforcing the authentication difficulty level comprises, via a pluggable authentication module (PAM) integrated with an endpoint authentication system on the monitored computing device, automatically requiring a token-based multi-factor authentication or denying authentication for accounts associated with the compromised credentials, including when the monitored computing device is unable to communicate with a remote monitoring platform.