US 12,250,230 B2
Lateral movement analysis using certificate private keys
Avi Tal Lichtenstein, Tel Aviv (IL); Ami Luttwak, Binyamina (IL); and Yinon Costica, Tel Aviv (IL)
Assigned to Wiz, Inc., New York, NY (US)
Filed by Wiz, Inc., New York, NY (US)
Filed on Sep. 17, 2024, as Appl. No. 18/887,697.
Application 18/887,697 is a continuation of application No. 18/798,377, filed on Aug. 8, 2024.
Application 18/798,377 is a continuation of application No. 18/394,608, filed on Dec. 22, 2023, granted, now 12,095,776, issued on Sep. 17, 2024.
Application 18/394,608 is a continuation of application No. 18/478,472, filed on Sep. 29, 2023, granted, now 11,916,926, issued on Feb. 27, 2024.
Application 18/478,472 is a continuation of application No. 17/657,492, filed on Mar. 31, 2022, granted, now 11,811,786, issued on Nov. 7, 2023.
Claims priority of provisional application 63/170,225, filed on Apr. 2, 2021.
Prior Publication US 2025/0016172 A1, Jan. 9, 2025
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/14 (2013.01) 25 Claims
OG exemplary drawing
 
1. A method for detecting potential lateral movement in a cloud computing environment, comprising:
detecting a private encryption key including a first hash value of a first public key;
detecting a certificate including a second hash value of a second public key, the detected certificate associated with a workload in the cloud computing environment;
generating in a security database: a representation of the private encryption key, a representation of the certificate, and a representation of the workload, wherein the representation of the workload is associated to the representation of the certificate;
associating the representation of the private key and the representation of the certificate, in response to determining a match between the first hash value and the second hash value;
determining that the workload is potentially compromised, in response to receiving an indication that an element of: the first public key, the second public key, or a combination thereof, is compromised; and
generating a graph visualization based at least on the representation of the workload.