Active Directory Deception Sensors for Unauthorized Access Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Attackers compromise endpoint systems to harvest data and move laterally within networks, posing a risk of unauthorized access to application and directory data.
Innovation Solution
Implementing a sensor module on endpoints that intercepts commands, verifies the source against a sanctioned list of applications, and either executes or modifies commands to refer to deception data, or ignores them, while simulating successful execution, to prevent unauthorized access and lure attackers into decoy systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control methods are used to protect Active Directory data, then security measures are in place, but attackers can still compromise endpoint systems and harvest data to move laterally within the network
Solution Approach 1:
The patent creates a copy of the Active Directory database and stores it locally on endpoint systems. This local copy allows the system to simulate Active Directory responses without exposing the actual directory data, thereby maintaining security while enabling detection of unauthorized access attempts.
Solution Approach 2:
The patent introduces an intermediary component that sits between attackers and the actual Active Directory data. This intermediary intercepts commands, verifies them against a sanctioned list, and either executes them against the local copy or modifies them to refer to deception data, preventing direct access to real directory data.
2Difficulty of detecting and measuring
If deception data is used to lure attackers, then early detection is enabled, but additional system complexity is introduced through sensor modules and command interception mechanisms
Solution Approach 1:
The patent implements a self-service mechanism where the local Active Directory copy automatically responds to commands without requiring constant verification against the sanctioned list. The system serves itself by maintaining an up-to-date local copy that can independently handle requests, reducing the complexity of continuous monitoring.
3Reliability
If all commands are verified against a sanctioned list, then unauthorized access is prevented, but system performance decreases due to extensive verification requirements
Solution Approach 1:
The patent applies partial verification by only checking commands against the sanctioned list when necessary. The sensor module intercepts commands and verifies them, but allows legitimate commands to proceed without extensive verification, balancing security with performance by applying verification selectively rather than to all commands uniformly.
Data Source
AI summary
Endpoints in a network execute a sensor module that intercepts commands. The sensor module compares a source of commands to a sanctioned list of applications received from a management server. If the source does not match a sanctioned application and the command is a write or delete command, the command is ignored and a simulated acknowledgment is sent. If the command is a read command, deception data is returned instead. In some embodiments, certain data is protected such that commands will be ignored or modified to refer to deception data where the source is not a sanctioned application. The source may be verified to be a sanctioned application by evaluating a certificate, hash, or path of the source. Responses from an active directory server may be intercepted and modified to reference a decoy server when not addressed to a sanctioned application.