US 11,836,250 B2
Identification and mitigation of permissions elevating attack vector
Ilay Grossman, Tel Aviv (IL); and Ram Haim Pliskin, Rishon Iezion (IL)
Assigned to MICROSOFT TECHNOLOGY LICENSING, LLC, Redmond, WA (US)
Filed by MICROSOFT TECHNOLOGY LICENSING, LLC, Redmond, WA (US)
Filed on Mar. 25, 2021, as Appl. No. 17/213,111.
Prior Publication US 2022/0309156 A1, Sep. 29, 2022
Int. Cl. G06F 21/55 (2013.01)
CPC G06F 21/554 (2013.01) [G06F 2221/034 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method for identifying and mitigating an attack vector in a computing environment, comprising:
identifying a policy definition that is configured to cause generation of a virtual machine having access to a first permissions level that is lower than at least one second permissions level;
determining that a user account that is assigned the at least one second permissions level has been utilized to generate, at a first time, a first service principal and a second service principal that includes the policy definition and that is assigned the at least one second permissions level, wherein the second service principal is configured to update the virtual machine from having access to the first permissions level to having access to the at least one second permissions level;
identifying at least one trigger event associated with the first service principal that is configured to:
cause the second service principal to:
generate, at a second time, the virtual machine in accordance with the policy definition, and
update the virtual machine from having access to the first permissions level to having access to the at least one second permissions level by associating the virtual machine with a third service principal at the second time;
determining whether that the at least one trigger event is not restricted based on the at least one second permissions level; and
mitigating the attack vector by performing a predefined remedial action in response to determining that the at least one trigger event is not restricted based on the at least one second permissions level prior to an occurrence of the at least one trigger event.