System and method for detecting lateral movement using cloud access keys

A non-transitory computer-readable medium storing a set of instructions for detecting potential lateral movement in a computing environment, the set of instructions comprising:

• one or more instructions that, when executed by one or more processors of a device, cause the device to:
• generate in a security database a representation of a computing environment, the computing environment including a plurality of entities;
• detect a first node in the security database, the first node representing a compromised entity of the plurality of entities;
• detect in the security database a credential node connected to the first node, wherein the credential node represents a credential utilized by the entity in the computing environment;
• and
• generate a potential lateral movement path including:
• the first node, and a second node represent a second entity of the plurality of entities, wherein the second node is further connected to the credential node.

A system for detecting potential lateral movement in a computing environment comprising:

• a processing circuitry;
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• generate in a security database a representation of a computing environment, the computing environment including a plurality of entities;
• detect a first node in the security database, the first node representing a compromised entity of the plurality of entities;
• detect in the security database a credential node connected to the first node, wherein the credential node represents a credential utilized by the entity in the computing environment;
• and
• generate a potential lateral movement path including:
• the first node, and a second node represent a second entity of the plurality of entities, wherein the second node is further connected to the credential node.