Detecting attacks using compromised credentials via internal network monitoring

A system for protecting, via internal network monitoring, a first network from an attack using credentials exposed from a second network, comprising:

• a security device center deployed in the first network in communication with a gateway for the first network and an authentication server for the first network;
• wherein the security device center is operable to passively receive an authentication request from the gateway destined for the authentication server, wherein the authentication request includes an email address and an encrypted portion;
• wherein the security device center is further operable to receive an intelligence feed from an intelligence service, the intelligence feed comprising exposed credentials, including username/password pairs;
• wherein the security device is further operable to resolve the email address from the authentication request into a local account hosted in the first network by querying an active directory in the first network;
• wherein the security device center is further operable to actively verify the security of the local account hosted in the first network by generating a login attempt with the exposed password;
• wherein the security device center is further operable to passively determine whether the authentication request is part of an attack on the first network by attempting to decrypt the encrypted portion with the exposed password;
• and
• wherein the security device center is further operable to implement security measures in the first network based on the login attempt successfully logging into the local account or based on the encrypted portion successfully being decrypted with the exposed password.

A method for protecting, via internal network monitoring, a first network from an attack using credentials exposed from a second network, comprising:

• requesting by a security device center within the first network an intelligence feed from an intelligence service, the intelligence feed including an exposed username and an exposed password associated with the exposed username, wherein the exposed username and the exposed password were exposed from the second network;
• receiving by the security device center credentials from an authentication server in the first network, the credentials including a local username;
• determining by the security device center whether the exposed username resolves in the first network to the local username;
• based on determining that the exposed username resolves in the first network to the local username, attempting by the security device center to log into the first network using the local username and the exposed password;
• based on determining the security device center successfully logged into the first network using the local username and the exposed password, signaling by the security device to the authentication server to secure an account associated with the local username in the first network.