Using cross workloads signals to remediate password spraying attacks
AssigneeMicrosoft Technology Licensing, LLC
InventorDor EDRY
Life of this patent
Estimating the term…
Abstract
A method for detecting password spray attacks. The method includes obtaining information from an on-machine malware detection application for a particular machine indicating that a password spray tool is detected on the particular machine. Information is obtained indicating that the particular machine has performed failed sign in attempts. As a result, a determination is made that the particular machine is performing password spray attacks.
Claims20
A method of detecting password spray attacks, the method comprising:
- obtaining information from an on-machine malware detection application for a particular machine indicating that the malware detection application has detected a malicious password spray tool on the particular machine;
- obtaining information that the particular machine has performed failed sign in attempts;
- and
- determining that the particular machine is performing password spray attacks by identifying that the malicious password spray tool is detected on the particular machine and identifying that the particular machine has performed failed sign in attempts.
A cloud service system for detecting password spray attacks, the system comprising:
- the system hosting a plurality of tenants comprising a plurality of user accounts;
- a particular virtual machine having a malicious password spray tool and a malware detection application running thereon, wherein the malicious password spray tool is configured to perform password spray attacks against one or more of the user accounts;
- a cloud administrator machine configured to obtain information from the malware detection application indicating that the malicious password spray tool is running on the particular virtual machine and configured to obtain failed sign in attempt information about failed sign in attempts by the particular virtual machine, and as a result to determine that the particular virtual machine is performing password spray attacks.
One or more physical computer readable storage media comprising computer executable instructions that when executed by one or more processors configure the one or more processors to perform the following:
- a malware detection application identifying that a malicious password spray tool is detected on a particular machine;
- identifying that the particular machine has performed failed sign in attempts;
- and
- determining that the particular machine is performing password spray attacks by identifying that the malicious password spray tool is detected on the particular machine and identifying that the particular machine has performed failed sign in attempts.
Dependencies are inferred from the claim text.