Systems and methods for detecting and reacting to malicious activity in computer networks

A network system configured for cyber-attack remediation operations, the network system comprising:

• at least one computer-readable memory storing instructions;
• and
• at least one processor configured to execute the instructions to:
• receive an indication of potentially malicious activity in a computer network, wherein the indication is based on a comparison of an intercepted authentication message including purported authentication data with data of a plurality of authentication messages generated in the computer network in accordance with a client authentication protocol;
• identify, based on data included in the indication, a plurality of network accounts associated with the purported authentication data, wherein a network account of the plurality of network accounts includes at least one of a sender account of the intercepted authentication message and an indirectly associated account that is possibly related to the potentially malicious activity;
• and
• invoke, based on the identifying and the potentially malicious activity, at least one responsive operation, the at least one responsive operation including at least one of determining whether to automatically change a credential for the respective plurality of network accounts, determining whether to control a session established in association with the respective plurality of network accounts, and determining whether to change an authorization policy associated with the respective plurality of network accounts.

A computer-implemented method for performing operations responsive to potentially malicious activity, comprising:

• receiving an indication of the potentially malicious activity in a computer network, wherein the indication is based on a comparison of an intercepted authentication message including purported authentication data with data of a plurality of authentication messages generated in the computer network in accordance with a client authentication protocol;
• identifying, based on data included in the indication, a plurality of network accounts associated with the purported authentication data, wherein a network account of the plurality of network accounts includes at least one of a sender account of the intercepted authentication message and an indirectly associated account that is possibly related to the potentially malicious activity;
• and
• invoking, based on the identifying and the potentially malicious activity, at least one responsive operation, the at least one responsive operation including at least one of determining whether to automatically change a credential for the respective plurality of network accounts, determining whether to control a session established in association with the respective plurality of accounts, and determining whether to change an authorization policy associated with the respective plurality of network accounts.