Detecting and reacting to malicious activity in decrypted application data

A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for detecting potentially malicious activity in a network session, comprising:

• identifying a requested network session between a first computer device and a second computer device, wherein the requested network session includes at least one security access message having an encrypted portion;
• obtaining a decryption key suitable for decrypting the encrypted portion of the security access message;
• decrypting the encrypted portion of the security access message with the decryption key;
• identifying a session key within the decrypted portion of the security access message;
• decrypting an application message that has been transmitted between the first computer device and the second computer device in the requested network session using the session key;
• and
• determining whether the decrypted application message includes an indicia of potentially malicious activity.

A method for detecting potentially malicious activity in a network session, the method comprising:

• identifying a requested network session between a first computer device and a second computer device, wherein the requested network session includes at least one security access message having an encrypted portion;
• obtaining a decryption key suitable for decrypting the encrypted portion of the security access message;
• decrypting the encrypted portion of the security access message with the decryption key;
• identifying a session key within the decrypted portion of the security access message;
• decrypting an application message that has been transmitted between the first computer device and the second computer device in the requested network session using the session key;
• and
• determining whether the decrypted application message includes an indicia of potentially malicious activity.