A Large-Scale Analysis of Attacker Activity in Compromised Enterprise Accounts

TL;DR

This study analyzes attacker behavior in compromised enterprise accounts across 111 organizations, introducing a novel forensic technique to distinguish malicious activity, revealing attacker dwell times, access patterns, and market dynamics, informing improved detection strategies.

Contribution

The paper presents a new forensic method for accurately identifying attacker activity in enterprise accounts and provides large-scale insights into attacker behavior and market dynamics.

Findings

Attackers often remain active for days to weeks.

Two distinct attacker access modalities suggest a hijacked account market.

Delayed detection can still be effective in identifying attacks.

Abstract

We present a large-scale characterization of attacker activity across 111 real-world enterprise organizations. We develop a novel forensic technique for distinguishing between attacker activity and benign activity in compromised enterprise accounts that yields few false positives and enables us to perform fine-grained analysis of attacker behavior. Applying our methods to a set of 159 compromised enterprise accounts, we quantify the duration of time attackers are active in accounts and examine thematic patterns in how attackers access and leverage these hijacked accounts. We find that attackers frequently dwell in accounts for multiple days to weeks, suggesting that delayed (non-real-time) detection can still provide significant value. Based on an analysis of the attackers' timing patterns, we observe two distinct modalities in how attackers access compromised accounts, which could be explained by the existence of a specialized market for hijacked enterprise accounts: where one class of attackers focuses on compromising and selling account access to another class of attackers who exploit the access such hijacked accounts provide. Ultimately, our analysis sheds light on the state of enterprise account hijacking and highlights fruitful directions for a broader space of detection methods, ranging from new features that home in on malicious account behavior to the development of non-real-time detection methods that leverage malicious activity after an attack's initial point of compromise to more accurately identify attacks.