System and method for pattern-based detection and mitigation of compromised credentials

A system for detection and mitigation of software attacks compromising an insecurely-stored credential on a monitored device, the system comprising:

• at least one non-volatile memory configured to store computer program code;
• and
• at least one processor configured to operate as instructed by the computer program code, the computer program code comprising:
• initial stage detection code configured to cause at least one of the at least one processor to detect an occurrence of an initial stage of an attack pattern definition by detecting at least one initial identifier associated with the initial stage within an activity log of the monitored device, the at least one initial identifier indicating a possible attempt to locate an insecurely-stored credential on the monitored device;
• subsequent stage detection code configured to cause at least one of the at least one processor to, responsive to detection of the initial stage:
• commence a search window having a predetermined time duration, and
• detect an occurrence of a subsequent stage of the attack pattern definition by detecting at least one subsequent identifier associated with the subsequent stage within the activity log of the monitored device prior to an elapsing of the search window, the at least one subsequent identifier indicating a possible attempt to determine context for the insecurely-stored credential from the monitored device;
• target identification code configured to cause at least one of the at least one processor to, responsive to detection of the initial stage and the subsequent stage, identify a response target associated with the detected identifiers;
• and
• response code configured to cause at least one of the at least one processor to perform a security response associated with the response target to thereby mitigate exploitation of the insecurely-stored credential.

A non-transitory computer-readable recording medium having recorded thereon instructions executable by at least one processor to perform a method for detection and mitigation of software attacks compromising an insecurely-stored credential on a monitored device, the method comprising:

• detecting an occurrence of an initial stage of an attack pattern definition by detecting at least one initial identifier associated with the initial stage within an activity log of the monitored device, the at least one initial identifier indicating a possible attempt to locate an insecurely-stored credential on the monitored device;
• responsive to detection of the initial stage, commencing a search window having a predetermined time duration;
• detecting an occurrence of a subsequent stage of the attack pattern definition by detecting at least one subsequent identifier associated with the subsequent stage within the activity log of the monitored device prior to an elapsing of the search window, the at least one subsequent identifier indicating a possible attempt to determine context for the insecurely-stored credential from the monitored device;
• responsive to detection of the initial stage and the subsequent stage, identifying a response target associated with the detected identifiers;
• and
• performing a security response associated with the response target to thereby mitigate exploitation of the insecurely-stored credential.