Musarubra US LLC

Systems, apparatus, articles of manufacture, and methods are disclosed. An example system to authenticate a service chain comprises: a first server device in a network, the first server device to: receive a user token from a tenant device that is outside the network, authenticate the user token, and after the authentication, forward the user token and a server token. The example system also comprises a second server device in the network, the second server device to: receive the user token and the server token from the first server device, authenticate the server token, reauthenticate the user token, and in response to determinations that the server token passes authentication and the user token pass reauthentication, generate an output based on a value within the user token that identifies the tenant device.

A network device is described. The network device features a processor and a non-transitory storage medium. The non-transitory storage medium comprises multiple modules. A first module is configured, upon execution by the processor, to obtain content associated with environment assets situated within a first enterprise environment. A second module may include a campaign source module, which is configured, upon execution by the processor, to obtain content associated with phishing campaigns performed locally within the first enterprise environment and globally within one or more enterprise environments. A third module may include a template creation module, which is configured, upon execution by the processor, to generate a request message, including at least a portion of the content associated with the environment assets and the content associated with the phishing campaigns, for transmission to generative AI logic adapted to create and return one or more training templates customized for the first enterprise environment.

Systems, apparatus, articles of manufacture, and methods are disclosed. An example apparatus includes interface circuitry, machine readable instructions, and programmable circuitry to at least one of instantiate or execute the machine readable instructions to: analyze detection data from an unknown source to identify a potential threat, add an entry to a security event cache that describes the potential threat, determine a number of entries in the security event cache that correspond to the unknown source, in response to a determination that the number of entries exceeds a threshold, add the unknown source to a threat list, and perform, in response to the addition of the unknown source to the threat list, a responsive action corresponding to the unknown source.

Systems, apparatus, articles of manufacture, and methods are disclosed to authenticate computing devices. An example apparatus includes interface circuitry, machine readable instructions, and programmable circuitry to at least one of instantiate or execute the machine readable instructions to access, via an application providing an online resource, a message requesting access to the online resource, the message including a device Internet Protocol (IP) address corresponding to a computing device transmitting the message, extract a log of IP addresses from a token generated by an authentication server, compare the device IP address to the log of IP addresses, and when the device IP address matches at least one of the IP addresses in the log, transmit the token to the application providing the online resource, the token authorizing the computing device to access the online resource.

Disclosed herein is a cyberthreat detection system for detecting, in real-time, cyberthreats residing within a memory of a targeted computing device. The cyberthreat detection system features an undocumented structure extractor logic and an undocumented offset extractor logic. The undocumented structure extractor logic is configured to identify known, undocumented, memory structures associated with software operating on the targeted computing device. The undocumented offset extractor logic is configured to identify undocumented and unknown memory structures associated with software installed on the targeted computing device.

An apparatus includes a network interface and a processor. The network interface receives an application programming interface (API) request, transmits a customer management request including an identifier of the customer apparatus, and receives a customer management response including a policy. The processor performs a security service on the API request, at least in part based on the policy.

A computerized method for cluster selection is described. Initially, a cloud-based enrollment service advertises features and capabilities of clusters performing malware analyses within a cloud-based malware detection system. Upon receiving an enrollment request message, including tenant credentials associated with a sensor having an object to be analyzed for malware, the cloud-based enrollment service returns an enrollment response message. The tenant credentials are used to authenticate the sensor and determine a type of subscription assigned to the sensor. The enrollment response message includes a portion of the advertised features and capabilities of a selected cluster of the cloud-based malware detection system in response to the sensor being authenticated. The portion of the advertised features and capabilities enables the sensor to establish communications with the selected cluster.

In one or more examples, there is disclosed a system and method of detecting agent presence for self-healing. An out-of-band monitoring process, such as Intel® AMT, or any process in firmware executing on a co-processor, may monitor one or more processes to determine if one goes down or otherwise meets a security criterion. Crashed processes may be reported to an enterprise security controller (ESC). The ESC may notice trends among affected machines and instruct the machines to take appropriate remedial action, such as booting from a remedial image.

A system for conducting cyberthreat analytics on a submitted object to determine whether the object is malicious is described. The system features a cybersecurity system operating with a cloud platform, which is configured to host resources including cloud processing resources and cloud storage resources. The cybersecurity system is configured to analyze one or more received objects included as part of a submission received from a subscriber after authentication of the subscriber and verification that the subscriber is authorized to perform one or more tasks associated with the submission. The cybersecurity system is configured to operate as a multi-tenant Security-as-a-Service (SaaS) that relies upon the cloud processing resources and the cloud storage resources provided by the cloud platform in performing the cybersecurity operations.

Methods and apparatus to determine machine learning (ML) configurations for classifying malware are disclosed. An example server comprises interface circuitry, machine readable instructions, and programmable circuitry to at least one of instantiate or execute the machine readable instructions to determine a computing parameter associated with a computing device, the computing device communicatively coupled to the server, select a ML model to deploy on the computing device based on the computing parameter, determine a configuration of the ML model based on the computing parameter, deploy the ML model to the computing device, and cause the deployed ML model to classify a sample as clean or malicious, the sample received at the computing device.