Patent ID: 11916953
Assignee: CYBEREASON INC.
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC H

Claim 0:
1. A computer-implemented method of preventing a malicious attack on a networked system comprising an endpoint machine, the computer-implemented method comprising:
generating, by an agent executing on the endpoint machine, a plurality of baseline fingerprints of system activity of the networked system, the plurality of baseline fingerprints comprising baseline representations of the system activity;
monitoring, by the agent, real-time system activity on the endpoint machine after said plurality of baseline fingerprints is generated;
generating, by the agent, a plurality of real-time fingerprints based on the real-time system activity on the endpoint machine;
determining, by the agent, that a Pass-the-Hash (PTH) attack is occurring by:
comparing the plurality of real-time fingerprints to the plurality of baseline fingerprints based on the endpoint machine, and
detecting a deviation between the plurality of real-time fingerprints and the plurality of baselines fingerprints; and

flagging the real-time system activity associated with the detected deviation.