Detecting kerberos ticket attacks within a domain

A method for detecting and mitigating ticket-based attacks within a domain, comprising the steps of:

• using an authentication object inspector operating on a computing device comprising a memory and a processor to:
• receive network traffic via a first network connection, the network traffic comprising at least a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain;
• store a record of each received first authentication object, with attached metadata comprising a timestamp of when each first authentication object was received, in a time-series database;
• compute a unique identifier of each first authentication object;
• store the unique identifier of each first authentication object in a database of unique identifiers for the identity provider;
• receive a request for access to a network resource within the authentication domain accompanied by a second authentication object;
• compute a unique identifier of the second authentication object;
• determine if the second unique identifier exists in the database of unique identifiers for the authentication provider;
• and
• where the unique identifier of the second authentication object does not exist in the database of unique identifiers:
• analyze a plurality of the stored first authentication objects to determine a plurality of compromised accounts;
• analyze a plurality of the stored network traffic records to determine a plurality of access paths;
• generate an incident report comprising results of the analyses of the plurality of stored first authentication objects and the plurality of stored network traffic records;
• and
• transmit the incident report via a second network connection that is not connected to, or visible to, to the identity provider;
• wherein each unique identifier is a cryptographic hash generated by performing a plurality of calculations and transformations on the respective authentication object.

Non-transitory, computer-readable storage media having computer-executable instructions embodied thereon that, when executed by one or more processors of a computing system employing an asset registry platform for detecting and mitigating ticket-based attacks within a domain, cause the computing system to:

• receive network traffic via a first network connection, the network traffic comprising at least a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain;
• store a record of each received first authentication object, with attached metadata comprising a timestamp of when each first authentication object was received, in a time-series database;
• compute a unique identifier of each first authentication object;
• store the unique identifier of each first authentication object in a database of unique identifiers for the identity provider;
• receive a request for access to a network resource within the authentication domain accompanied by a second authentication object;
• compute a unique identifier of the second authentication object;
• determine if the second unique identifier exists in the database of unique identifiers for the authentication provider;
• and
• where the unique identifier of the second authentication object does not exist in the database of unique identifiers:
• analyze a plurality of the stored first authentication objects to determine a plurality of compromised accounts;
• analyze a plurality of the stored network traffic records to determine a plurality of access paths;
• generate an incident report comprising results of the analyses of the plurality of stored first authentication objects and the plurality of stored network traffic records;
• and
• transmit the incident report via a second network connection that is not connected to, or visible to, to the identity provider;
• wherein each unique identifier is a cryptographic hash generated by performing a plurality of calculations and transformations on the respective authentication object.

A system for detecting and mitigating ticket-based attacks within a domain employing an asset registry platform, comprising one or more computers with executable instructions that, when executed, cause the system to:

• receive network traffic via a first network connection, the network traffic comprising at least a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain;
• store a record of each received first authentication object, with attached metadata comprising a timestamp of when each first authentication object was received, in a time-series database;
• compute a unique identifier of each first authentication object;
• store the unique identifier of each first authentication object in a database of unique identifiers for the identity provider;
• receive a request for access to a network resource within the authentication domain accompanied by a second authentication object;
• compute a unique identifier of the second authentication object;
• determine if the second unique identifier exists in the database of unique identifiers for the authentication provider;
• and
• where the unique identifier of the second authentication object does not exist in the database of unique identifiers:
• analyze a plurality of the stored first authentication objects to determine a plurality of compromised accounts;
• analyze a plurality of the stored network traffic records to determine a plurality of access paths;
• generate an incident report comprising results of the analyses of the plurality of stored first authentication objects and the plurality of stored network traffic records;
• and
• transmit the incident report via a second network connection that is not connected to, or visible to, to the identity provider;
• wherein each unique identifier is a cryptographic hash generated by performing a plurality of calculations and transformations on the respective authentication object.