US 12,273,359 B2
Lateral movement analysis using certificate private keys
Avi Tal Lichtenstein, Tel Aviv (IL); Ami Luttwak, Binyamina (IL); and Yinon Costica, Tel Aviv (IL)
Assigned to Wiz, Inc., New York, NY (US)
Filed by Wiz, Inc., New York, NY (US)
Filed on Sep. 18, 2024, as Appl. No. 18/888,973.
Application 18/888,973 is a continuation of application No. 18/887,697, filed on Sep. 17, 2024.
Application 18/887,697 is a continuation of application No. 18/798,377, filed on Aug. 8, 2024.
Application 18/798,377 is a continuation of application No. 18/394,608, filed on Dec. 22, 2023, granted, now 12,095,776, issued on Sep. 17, 2024.
Application 18/394,608 is a continuation of application No. 18/478,472, filed on Sep. 29, 2023, granted, now 11,916,926, issued on Feb. 27, 2024.
Application 18/478,472 is a continuation of application No. 17/657,492, filed on Mar. 31, 2022, granted, now 11,811,786, issued on Nov. 7, 2023.
Claims priority of provisional application 63/170,225, filed on Apr. 2, 2021.
Prior Publication US 2025/0016177 A1, Jan. 9, 2025
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/14 (2013.01) 25 Claims
OG exemplary drawing
 
1. A method for detecting potential lateral movement in a cloud computing environment, comprising:
detecting a private encryption key including a first hash value of a first public key;
detecting a certificate including a second hash value of a second public key, the detected certificate associated with a workload in the cloud computing environment;
associating the certificate with a cloud identity;
generating in a security database: a representation of the private encryption key, a representation of the certificate, a representation of the workload, and a representation of the cloud identity, wherein the representation of the workload is associated with the representation of the certificate;
associating the representation of the private key and the representation of the certificate, in response to determining a match between the first hash value and the second hash value;
determining that the workload is potentially compromised, in response to receiving an indication that an element of: the first public key, the second public key, or a combination thereof, is compromised; and
generating a graph visualization based at least on the representation of the cloud identity and the potentially compromised workload.