  We present a large-scale characterization of attacker activity across 111
real-world enterprise organizations. We develop a novel forensic technique for
distinguishing between attacker activity and benign activity in compromised
enterprise accounts that yields few false positives and enables us to perform
fine-grained analysis of attacker behavior. Applying our methods to a set of
159 compromised enterprise accounts, we quantify the duration of time attackers
are active in accounts and examine thematic patterns in how attackers access
and leverage these hijacked accounts. We find that attackers frequently dwell
in accounts for multiple days to weeks, suggesting that delayed (non-real-time)
detection can still provide significant value. Based on an analysis of the
attackers' timing patterns, we observe two distinct modalities in how attackers
access compromised accounts, which could be explained by the existence of a
specialized market for hijacked enterprise accounts: where one class of
attackers focuses on compromising and selling account access to another class
of attackers who exploit the access such hijacked accounts provide. Ultimately,
our analysis sheds light on the state of enterprise account hijacking and
highlights fruitful directions for a broader space of detection methods,
ranging from new features that home in on malicious account behavior to the
development of non-real-time detection methods that leverage malicious activity
after an attack's initial point of compromise to more accurately identify
attacks.
