CROSS-USER CORRELATION FOR DETECTING SERVER-SIDE MULTI-TARGET INTRUSION
Technologies are generally described for time-correlating administrative events with virtual machines of a datacenter across many users and/or deployments. In some examples, the correlation of administrative events enables the detection of confluences of repeated unusual events that may indicate a mass hacking attack, thereby allowing attacks lacking network signatures to be detected. Detection of the attack may also allow the repair of affected systems and the prevention of further hacking before the vulnerability has been analyzed or repaired.