# US 10,484,423 B2 · System and method for detecting and monitoring thread creation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,484,423 B2
- Document ID: US10484423B2
- Status: Granted
- Kind: B2
- Application number: 15/436,301
- Filed: 2017-02-17
- Published: 2017-08-24
- Granted: 2019-11-19
- Earliest claimed: 2016-02-19
- Assignees: Secureworks Corp.
- Applicants: SecureWorks Corp.
- Inventors: Ross R. Kinder; Aaron Hackworth; Matthew K. Geiger; Kevin R. Moore; Timothy M. Vidas
- Web page: https://patentgrep.com/patent/US10484423B2

## CPC

- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- G06F 9/4406: {Loading of operating system}
- G06F 9/4843: {by program, e.g. task dispatcher, supervisor, operating system}
- G06F 9/542: {Event management; Broadcasting; Multicasting; Notifications}
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/554: {involving event detection and direct action}
- G06F 21/565: {by checking file integrity}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- H04L 41/069: using logs of notifications; Post-processing of notifications
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/308: {retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content}
- G06F 2221/033: Test or assess software
- G06F 2221/034: Test or assess a computer or a system
- G06F 2221/2115: Third party
- H04L 61/4511: using domain name system [DNS]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system for collection and analysis of forensic and event data comprising a server and an endpoint agent operating on a remote system. The server is configured to receive event data including process creation data, persistent process data, thread injection data, network connection data, memory pattern data, or any combination thereof, and analyze the event data to detect compromises of a remote system. The endpoint agent is configured to acquire event data, and communicate the event data to the server.

## Claims

### Claim 1

A method of monitoring network connections for malicious activity, comprising:
identifying creation of a new thread;
determining the creation of the new thread is a remote thread creation event when a target process and a creating process are different;
logging the remote thread creation event, wherein the logging includes source process information, target process information, and a portion of the data stored at the start address of the thread;
evaluating the new thread based on a set of rules to determine the thread is malicious or compromised, the set of rules including a set of protected processes for which no remote thread injection is allowable;
wherein evaluating the new thread includes comparing the target process to the set of protected processes and determining the thread is malicious or compromised when the target process is in the set of protected processes; and
terminating the new thread when the thread is determined to be malicious.

### Claim 2 (depends on 1)

The method of claim 1, wherein logging the remote thread creation event includes logging the creating process and the target process.

### Claim 3 (depends on 1)

The method of claim 1, wherein logging the remote thread creation event includes logging a portion of data stored at a start address of the new thread.

### Claim 4 (depends on 1)

The method of claim 1, wherein logging the remote thread creation event includes logging a path for any mapped memory references by the new thread.

### Claim 5 (depends on 1)

The method of claim 1, wherein evaluating the new thread includes comparing the privileges of the creating process to the privileges of the target process.

### Claim 6 (depends on 1)

The method of claim 1, further comprising terminating the creating process.

### Claim 7

An endpoint agent for monitoring thread creation for malicious activity, comprising:
a communications engine configured to:
receive a set of rules from a cloud service; and
send creating process data, target process data, and thread data to the cloud service for new threads;
a thread creation monitor configured to: identify the new thread; determine a creating process and target process for the new thread;
compare the creating process and target process to identify a remote thread injection event when the target process and the creating process are different; and
log the creating process data, the target process data, the thread data for the remote thread injection event, and a portion of the data stored at a start address of the thread; and
an inspector configured to: compare the remote thread injection event to the set of rules;
determine if the new thread is allowable including checking a set of protected processes for which no remote thread injection is allowable;
wherein the set of rules includes a set of protected processes and the inspector is further configured to compare the target process to the set of protected processes and determining the thread is not allowable when the target process is in the set of protected processes; and
terminate the new thread if the thread is not allowable.

### Claim 8 (depends on 7)

The endpoint agent of claim 7, wherein the thread data includes a portion of the data stored at the start address of the new thread.

### Claim 9 (depends on 7)

The endpoint agent of claim 7, wherein the thread data includes a path for any mapped memory references by the new thread.

### Claim 10 (depends on 7)

The endpoint agent of claim 7, wherein the inspector is further configured compare the privileges of the creating process to the privileges of the target process.

### Claim 11 (depends on 7)

The endpoint agent of claim 7, wherein the inspector is further configured to terminate the creating process.

### Claim 12

A non-transitory computer-readable medium including code that when executed causes a processor to perform a method, the method comprising:
monitoring a system for creation of a new thread;
determining the creation of the new thread is a remote thread creation event when a comparison between a target process and a creating process indicates the target process and the creating process are different;
logging the remote thread creation event including source process information, target process information, and a portion of the data stored at a start address of the thread;
evaluating the new thread based on a set of rules to determine the thread is malicious or compromised, the set of rules including a set of protected processes for which no remote thread injection is allowable;
wherein evaluating the new thread includes comparing the target process to a set of protected processes and determining the thread is malicious or compromised when the target process is in the set of protected processes; and
terminating the new thread.

### Claim 13 (depends on 12)

The non-transitory computer-readable medium of claim 12, wherein logging the remote thread creation event includes logging the creating process and the target process.

### Claim 14 (depends on 12)

The non-transitory computer-readable medium of claim 12, wherein logging the remote thread creation event includes logging a portion of the data stored at the start address of the new thread.

### Claim 15 (depends on 12)

The non-transitory computer-readable medium of claim 12, wherein logging the remote thread creation event includes logging a path for any mapped memory references by the new thread.

### Claim 16 (depends on 12)

The non-transitory computer-readable medium of claim 12, wherein evaluating the new thread includes comparing the privileges of the creating process to the privileges of the target process.

### Claim 17 (depends on 12)

The non-transitory computer-readable medium of claim 12, wherein the method further includes terminating the creating process.