# US 12,764,156 B2 · Detecting malware infection path in a cloud computing environment utilizing a security graph > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,764,156 B2 - Document ID: US12764156B2 - Status: Granted - Kind: B2 - Application number: 19/046,243 - Filed: 2025-02-05 - Published: 2025-06-05 - Granted: 2026-10-13 - Earliest claimed: 2021-12-27 - Assignees: Wiz, Inc. - Applicants: Wiz, Inc. - Inventors: Elad Gabay; Yaniv Shaked; Alon Schindel; Roy Reznik; Ami Luttwak - Web page: https://patentgrep.com/patent/US12764156B2 ## CPC - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method detect a malware infection path in a compute environment. The method includes detecting a malware object on a first workload in a computing environment including a plurality of workloads, wherein the first workload is represented by a resource node on a security graph, the security graph including an endpoint node representing a resource which is accessible to a public network; generating a potential infection path between the resource node and the endpoint node including at least a second resource node connected to the resource node; inspecting a second workload of the plurality of workloads represented by the second resource node; determining that the potential infection path is a confirmed infection path, in response to detecting the malware on the second workload; and determining that the potential infection path is not an infection path, in response to detecting that the second workload does not include the malware. ## Claims ### Claim 1 A method for detecting a cybersecurity threat infection path in a compute environment, comprising: detecting a cybersecurity object, indicating a cybersecurity threat, on a first workload in a computing environment, the computing environment including a plurality of workloads, wherein the first workload is represented by a resource representation in a security database, the security database further including a representation of an endpoint having access to an external network; detecting in the security database a plurality of potential infection paths, each potential infection path including a resource which is on a network path between the resource representation of the first workload and the representation of the endpoint; inspecting a second workload of the plurality of workloads for the cybersecurity object, wherein the second workload is represented by a second resource node, and the second resource node is on a first potential infection path of the plurality of potential infection paths; determining that the first potential infection path is a confirmed infection path, in response to detecting the cybersecurity object on the second workload; determining that the first potential infection path is not an infection path, in response to detecting that the second workload does not include the cybersecurity object; and initiating a mitigation action in the computing environment in response to detecting the cybersecurity object on the second workload. ### Claim 2 (depends on 1) The method of claim 1, further comprising: generating the mitigation action to isolate the cybersecurity object, wherein the cybersecurity object is a malware code. ### Claim 3 (depends on 1) The method of claim 1, further comprising: detecting in the security database a number of second resource nodes connected to the resource node; and initiating the mitigation action in response to determining that the number of second resource nodes exceeds a threshold. ### Claim 4 (depends on 1) The method of claim 1, further comprising: determining that the first workload is authorized to access the second workload based on a permission detected in the security database. ### Claim 5 (depends on 4) The method of claim 4, further comprising: generating an impact analysis of the cybersecurity threat on a potential infection path of the plurality of potential infections paths, including an identifier of the second workload, in response to determining the authorization to access. ### Claim 6 (depends on 1) The method of claim 1, further comprising: generating an instruction to inspect the second workload to detect the cybersecurity object. ### Claim 7 (depends on 6) The method of claim 6, further comprising: generating an inspectable disk based on a disk of the second workload; and providing access of the inspectable disk to an inspector configured to detect at least the cybersecurity object. ### Claim 8 (depends on 7) The method of claim 7, further comprising: initiating the mitigation action on the second workload in response to detecting the cybersecurity object on the second workload. ### Claim 9 (depends on 1) The method of claim 1, further comprising: accessing a malware database to retrieve a first malware signature corresponding to the malware; and inspecting the first workload for the malware based on the first malware signature. ### Claim 10 A non-transitory computer-readable medium storing a set of instructions for detecting a cybersecurity threat infection path in a compute environment, the set of instructions comprising: one or more instructions that, when executed by one or more processors of a device, cause the device to: detect a cybersecurity object, indicating a cybersecurity threat, on a first workload in a computing environment, the computing environment including a plurality of workloads, wherein the first workload is represented by a resource representation in a security database, the security database further including a representation of an endpoint having access to an external network; detect in the security database a plurality of potential infection paths, each potential infection path including a resource which is on a network path between the resource representation of the first workload and the representation of the endpoint; inspect a second workload of the plurality of workloads for the cybersecurity object, wherein the second workload is represented by a second resource node, and the second resource node is on a first potential infection path of the plurality of potential infection paths; determine that the first potential infection path is a confirmed infection path, in response to detecting the cybersecurity object on the second workload; determine that the first potential infection path is not an infection path, in response to detecting that the second workload does not include the cybersecurity object; and initiate a mitigation action in the computing environment in response to detecting the cybersecurity object on the second workload. ### Claim 11 A system for detecting a cybersecurity threat infection path in a compute environment comprising: a processing circuitry; a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: detect a cybersecurity object, indicating a cybersecurity threat, on a first workload in a computing environment, the computing environment including a plurality of workloads, wherein the first workload is represented by a resource representation in a security database, the security database further including a representation of an endpoint having access to an external network; detect in the security database a plurality of potential infection paths, each potential infection path including a resource which is on a network path between the resource representation of the first workload and the representation of the endpoint; inspect a second workload of the plurality of workloads for the cybersecurity object, wherein the second workload is represented by a second resource node, and the second resource node is on a first potential infection path of the plurality of potential infection paths; determine that the first potential infection path is a confirmed infection path, in response to detecting the cybersecurity object on the second workload; determine that the first potential infection path is not an infection path, in response to detecting that the second workload does not include the cybersecurity object; and initiate a mitigation action in the computing environment in response to detecting the cybersecurity object on the second workload. ### Claim 12 (depends on 11) The system of claim 11, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: generate the mitigation action to isolate the cybersecurity object, wherein the cybersecurity object is a malware code. ### Claim 13 (depends on 11) The system of claim 11, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: detect in the security database a number of second resource nodes connected to the resource node; and initiate the mitigation action in response to determining that the number of second resource nodes exceeds a threshold. ### Claim 14 (depends on 11) The system of claim 11, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: determine that the first workload is authorized to access the second workload based on a permission detected in the security database. ### Claim 15 (depends on 14) The system of claim 14, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: generate an impact analysis of the cybersecurity threat on a potential infection path of the plurality of potential infections paths, including an identifier of the second workload, in response to determining the authorization to access. ### Claim 16 (depends on 11) The system of claim 11, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: generate an instruction to inspect the second workload to detect the cybersecurity object. ### Claim 17 (depends on 16) The system of claim 16, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: generate an inspectable disk based on a disk of the second workload; and provide access of the inspectable disk to an inspector configured to detect at least the cybersecurity object. ### Claim 18 (depends on 17) The system of claim 17, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: initiate the mitigation action on the second workload in response to detecting the cybersecurity object on the second workload. ### Claim 19 (depends on 11) The system of claim 11, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: access a malware database to retrieve a first malware signature corresponding to the malware; and inspect the first workload for the malware based on the first malware signature.