US 12,452,273 B2
Systems, methods, and devices for preventing credential passing attacks
Harinath Vishwanath Ramchetty, Bangalore (IN); and Anil Gupta, Bangalore (IN)
Assigned to SentinelOne, Inc, Mountain View, CA (US)
Filed by SentinelOne, Inc., Mountain View, CA (US)
Filed on Mar. 13, 2023, as Appl. No. 18/182,979.
Claims priority of provisional application 63/325,419, filed on Mar. 30, 2022.
Prior Publication US 2023/0319087 A1, Oct. 5, 2023
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1425 (2013.01) [H04L 63/0807 (2013.01); H04L 63/0823 (2013.01); H04L 63/1416 (2013.01); H04L 63/1441 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method for preventing credential passing attacks, the computer-implemented method comprising:
receiving, by a computer system, an input;
determining, by a credential passing mitigation module, whether the input is a credential access command, wherein the determination of whether the input is a credential access command comprises searching for occurrences of references to executables related to adding, reading, copying, or performing actions with respect to a credential in a user session;
if the input is determined to be a credential access command, performing, by an anomaly detection module, anomaly detection corresponding to the credential access command, wherein performing the anomaly detection comprises:
evaluating whether a user is a valid domain user to which the credential belong;
evaluating whether an elapsed time of the credential is greater than a maximum lifetime of the credential; and
evaluating whether a privilege attribute certificate of the credential is valid;
determining that an anomaly exists if:
(i) a console command was generated by an invalid domain user;
(ii) an elapsed time of the credential is greater than a maximum lifetime for the credential; or
(iii) the privilege attribute certificate of the credential is invalid; and
if an anomaly is determined to exist, performing mitigation of the anomaly,
wherein the computer system comprises a processor and memory.