Störung von Angreiferfokussierter Granularer Aktion

Details

Veröffentlichungs-Nr.

EP4614366

Aktenzeichen

EP25161914

Anmeldetag

5. März 2025

Veröffentlichung

10. September 2025

Rechtsraum

EP

IPC

G06F21/55G06F21/57

Abstract

Some embodiments provide attacker-focused granular disruption functionality to detect and defend against cyberattacks. An embodiment observes that a user account or a user session has executed one or more precursor events but has not executed an incrimination action. The incrimination action is more likely, by at least a specified amount, to be performed by an attacker-driven account or session than by a non-attacker-driven account or session. Performance of the incrimination action is preemptively blocked, without disabling the account or session. The block is focused on the incrimination action, and in some scenarios the embodiment also blocks performance of similar actions. After an attempt by the account or session to perform the blocked incrimination action, larger blocks on activity are enforced, up to and including disablement, because the attempt indicates strongly that the account or session is driven by an attacker.

Anmelder

Firma

Microsoft Technology Licensing, LLC

Land

🇺🇸 USA

Fachgebiete