Irregular interactive command prompt activity detection
AssigneeCrowdStrike, Inc.
InventorsDaniel W. Brown, Thomas R Hobson, Talha Ongun, Rico Valdez
Life of this patent
Estimating the term…
Abstract
Techniques are provided to detect irregular interactive command prompt activity. Interactive command prompt activity that is irregular for one user may be regular for another, and therefore the disclosed techniques determine whether interactive command prompt activity is irregular on a user-by-user basis. A sensor in a customer network can detect interactive command prompt use and send event data to a cloud service configured to score the irregularity of the interactive command prompt use. The score can optionally be combined with other information to determine whether alerting the customer network of potentially malicious activity is warranted.
Claims20
A method, comprising:
- receiving event data from a sensor deployed in a network, the event data comprising an indication of an occurrence of an interaction between a user of the network and an interactive command prompt at the network;
- assigning a score to the occurrence, wherein the score is based on irregularity of the occurrence with respect to the user, wherein the score increases at a slowing rate with respect to a time elapsed since a previous occurrence of the interaction;
- and
- determining, based at least in part on the score, whether to generate an alert, wherein the alert is provided to the network and identifies the occurrence as potential malicious activity at the network.
A system, comprising:
- a processor, and
- at least one memory storing instructions executed by the processor to perform actions including:
- receiving event data comprising an indication of an occurrence of an interaction between a user and an interactive command prompt,
- wherein the interaction between the user and the interactive command prompt comprises an entry of interaction data into the interactive command prompt;
- assigning a score to the occurrence,
- wherein the score is based on irregularity of the occurrence with respect to the user, wherein the score increases at a slowing rate with respect to an elapsed time since a previous occurrence of the interaction, and wherein the score is independent of the interaction data;
- and
- determining, based at least in part on the score, whether to generate an alert, wherein the alert identifies the occurrence as potential malicious activity.
A computer-readable storage medium storing computer-readable instructions, that when executed by a processor, cause the processor to perform actions comprising:
- detecting, by a sensor deployed in a network, an occurrence of an interaction between a user of the network and an interactive command prompt at the network;
- wherein the interaction between the user of the network and the interactive command prompt at the network comprises an entry of interaction data into the interactive command prompt;
- determining whether the occurrence comprises potential malicious activity at the network, wherein the determining whether the occurrence comprises the potential malicious activity comprises assigning a score to the occurrence, wherein the score is based on irregularity of the occurrence with respect to the user, wherein the score increases at a slowing rate with respect to an elapsed time since a previous occurrence of the interaction, and wherein the score is independent of the interaction data;
- and
- generating an alert in response to a determination that the occurrence comprises the potential malicious activity at the network.
Dependencies are inferred from the claim text.