大规模分析受影响企业帐户中的攻击者活动
A Large-Scale Analysis of Attacker Activity in Compromised Enterprise Accounts
摘要：
我们对111个真实企业组织的攻击者活动进行了大规模的描述。我们开发了一种新的取证技术，用于区分受感染企业帐户中的攻击者活动和良性活动，该技术几乎没有误报，并使我们能够对攻击者行为进行细粒度分析。将我们的方法应用于一组159个受感染的企业帐户，我们量化了攻击者在帐户中活动的持续时间，并研究了攻击者如何访问和利用这些被劫持帐户的主题模式。我们发现，攻击者经常在账户中停留数天到数周，这表明延迟（非实时）检测仍然可以提供重要的价值。基于对攻击者的时间模式的分析，我们观察到攻击者如何访问受损帐户的两种不同模式，这可以通过被劫持企业帐户的专门市场的存在来解释：一类攻击者专注于妥协和出售帐户访问权给另一类攻击者，这些攻击者利用这些被劫持帐户提供的访问权。最终，我们的分析揭示了企业帐户劫持的状态，并强调了更广泛的检测方法的富有成效的方向，从针对恶意帐户行为的新功能到非实时检测方法的开发，这些方法在攻击的初始危害点之后利用恶意活动来更准确地识别攻击。
英文摘要：
We present a large-scale characterization of attacker activity across 111 real-world enterprise organizations. We develop a novel forensic technique for distinguishing between attacker activity and benign activity in compromised enterprise accounts that yields few false positives and enables us to perform fine-grained analysis of attacker behavior. Applying our methods to a set of 159 compromised enterprise accounts, we quantify the duration of time attackers are active in accounts and examine thematic patterns in how attackers access and leverage these hijacked accounts. We find that attackers frequently dwell in accounts for multiple days to weeks, suggesting that delayed (non-real-time) detection can still provide significant value. Based on an analysis of the attackers' timing patterns, we observe two distinct modalities in how attackers access compromised accounts, which could be explained by the existence of a specialized market for hijacked enterprise accounts: where one class of attackers focuses on compromising and selling account access to another class of attackers who exploit the access such hijacked accounts provide. Ultimately, our analysis sheds light on the state of enterprise account hijacking and highlights fruitful directions for a broader space of detection methods, ranging from new features that home in on malicious account behavior to the development of non-real-time detection methods that leverage malicious activity after an attack's initial point of compromise to more accurately identify attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
