Patent ID: 9075991
Filing Date: 2015-07-07
Classification: G06F

Abstract:
1. A method of limiting the amount of sensitive information looted during a malicious attack on a computing system, comprising: monitoring a set of performance indicators of the computing system, the set of performance indicators providing a measure of sensitive information being accessed on the computing system; testing whether the monitored set of performance indicators indicates a likelihood of looting; and temporarily reducing access to the sensitive information on the computing system in response to the act of testing indicating a likelihood of looting, wherein the method further comprises establishing a looting criterion pertaining to the set of performance indicators that indicates a likelihood that the sensitive information is being looted, wherein the act of testing comprises determining whether the looting criterion is satisfied, wherein the looting criterion is based at least in part on an amount of time that a performance indicator remains at a particular level, wherein monitoring the set of performance indicators includes monitoring a number of directory requests per second from a domain controller, wherein testing whether the monitored set of performance indicators indicates a likelihood of looting includes testing whether the number of directory requests per second from the domain controller exceeds 1000, and wherein testing whether the number of directory requests per second from the domain controller exceeds 1000 is performed after a malicious user has renamed a PWDUMP.exe program in the computerized system and changed its contents to avoid detection by anti-virus software.