System and method of adding tags for use in detecting computer attacks

A system of adding tags for use in detecting computer attacks comprising:

• a computer protection module executed on a hardware processor and configured to:
• receive a security notification;
• extract an object from the security notification;
• search for the extracted object in a threat database;
• add a first tag corresponding to the extracted object in the threat database only when the extracted object is found in the threat database;
• search for signs of suspicious activity in a database of suspicious activities based on the received security notification and the added first tag;
• and
• when at least one sign of suspicious activity is found, extract a second tag from the database of suspicious activities and add the second tag to an object database, wherein the object database is used for identifying signature of targeted attacks based on security notifications, objects, first tags and second tags.

A non-transitory computer readable medium storing thereon computer executable instructions, that when executed by a hardware processor, performs a method of adding tags for use in detecting computer attacks, including instructions for:

• receiving, by a processor, a security notification;
• extracting, by the processor, an object from the security notification;
• searching, by the processor, for the extracted object in a threat database;
• adding, by the processor, a first tag corresponding to the extracted object in the threat database only when the extracted object is found in the threat database;
• searching, by the processor, for signs of suspicious activity in a database of suspicious activities based on the received security notification and the added first tag;
• and
• when at least one sign of suspicious activity is found, extracting, by the processor, a second tag from the database of suspicious activities and adding the second tag to an object database, wherein the object database is used for identifying signature of targeted attacks based on security notifications, objects, first tags and second tags.