# US 10,659,432 B2 · Network containment of compromised machines > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,659,432 B2 - Document ID: US10659432B2 - Status: Granted - Kind: B2 - Application number: 15/643,291 - Filed: 2017-07-06 - Published: 2019-01-10 - Granted: 2020-05-19 - Earliest claimed: 2017-07-06 - Assignees: CrowdStrike, Inc. - Applicants: CrowdStrike, Inc. - Inventors: Paul Meyer; Cameron Gutman; John R. Kooker - Web page: https://patentgrep.com/patent/US10659432B2 ## CPC - H04L 63/0263: {Rule management} - G06F 21/554: {involving event detection and direct action} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/562: {Static detection} - G06F 2221/2115: Third party - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computing device can install and execute a kernel-level security agent that interacts with a remote security system as part of a detection loop aimed at defeating malware attacks. The kernel-level security agent can be installed with a firewall policy that can be remotely enabled by the remote security system in order to “contain” the computing device. Accordingly, when the computing device is being used, and a malware attack is detected on the computing device, the remote security system can send an instruction to contain the computing device, which causes the implementation, by an operating system (e.g., a Mac™ operating system) of the computing device, of the firewall policy accessible to the kernel-level security agent. Upon implementation and enforcement of the firewall policy, outgoing data packets from, and incoming data packets to, the computing device that would have been allowed prior to the implementation of the firewall policy are denied. ## Claims ### Claim 1 A method comprising: installing a kernel-level security agent on a computing device with a firewall policy, but refraining from implementing the firewall policy until an instruction to contain the computing device is received; observing events associated with activity on the computing device; sending the events, over a computer network, to a remote security system; receiving, over the computer network and from the remote security system, the instruction to contain the computing device; executing instructions to load a user-mode component in user mode of the computing device; providing the firewall policy to the user-mode component; using the user-mode component to invoke an application programming interface (API) to implement the firewall policy; and implementing the firewall policy in kernel mode of the computing device based at least in part on the API invoked using the user-mode component, wherein the firewall policy, upon enforcement, denies outgoing data packets from, and incoming data packets to, the computing device that would have been allowed prior to the implementing of the firewall policy. ### Claim 2 (depends on 1) The method of claim 1, wherein the firewall policy specifies: at least one remote network address associated with the remote security system; and an action to allow outgoing data packets to, and incoming data packets from, the remote security system associated with the at least one remote network address. ### Claim 3 (depends on 2) The method of claim 2, wherein denying the outgoing data packets and the incoming data packets comprises denying all outgoing data packets and all incoming data packets except the outgoing data packets to, and the incoming data packets from, the remote security system associated with the at least one remote network address. ### Claim 4 (depends on 2) The method of claim 2, further comprising, after the implementing of the firewall policy: receiving, over the computer network and from the remote security system, a new version of the kernel-level security agent; and installing the kernel-level security agent on the computing device. ### Claim 5 (depends on 2) The method of claim 2, further comprising, after the implementing of the firewall policy: receiving, over the computer network and from the remote security system, an instruction to perform a remediation action to counter malicious code associated with the events; and performing the remediation action. ### Claim 6 (depends on 1) The method of claim 1, further comprising: receiving, over the computer network and from the remote security system, a whitelist including one or more remote network addresses; dynamically updating the firewall policy to specify: the one or more remote network addresses; and an action to allow outgoing data packets to, and incoming data packets from, one or more computer systems associated with the one or more remote network addresses. ### Claim 7 A computing device comprising: one or more processors; and memory storing computer-executable instructions configured to be executed by the one or more processors to install a kernel-level security agent on the computing device with a firewall policy, but refrain from implementing the firewall policy until an instruction to contain the computing device is received, the kernel-level security agent configured to be executed by the one or more processors to: observe events associated with activity on the computing device; send the events, over a computer network, to a remote security system; receive, over the computer network and from the remote security system, the instruction to contain the computing device; execute instructions to load a user-mode component in user mode of the computing device; provide the firewall policy to the user-mode component; use the user-mode component to invoke an application programming interface (API) to implement the firewall policy; and implement the firewall policy in kernel mode of the computing device based at least in part on the API invoked using the user-mode component, wherein the firewall policy, upon enforcement, denies outgoing data packets from, and incoming data packets to, the computing device that would have been allowed prior to the implementing of the firewall policy. ### Claim 8 (depends on 7) The computing device of claim 7, wherein the firewall policy specifies: at least one remote network address associated with the remote security system; and an action to allow outgoing data packets to, and incoming data packets from, the remote security system associated with the at least one remote network address. ### Claim 9 (depends on 8) The computing device of claim 8, wherein denying the outgoing data packets and the incoming data packets comprises denying all outgoing data packets and all incoming data packets except the outgoing data packets to, and the incoming data packets from, the remote security system associated with the at least one remote network address. ### Claim 10 (depends on 8) The computing device of claim 8, wherein the kernel-level security agent is further configured to be executed by the one or more processors to, after implementing the firewall policy: receive, over the computer network and from the remote security system, an instruction to perform a remediation action to counter malicious code associated with the events; and perform the remediation action. ### Claim 11 (depends on 7) The computing device of claim 7, wherein the kernel-level security agent is further configured to be executed by the one or more processors to: receive, over the computer network and from the remote security system, a whitelist including one or more remote network addresses; and dynamically update the firewall policy to specify: the one or more remote network addresses; and an action to allow outgoing data packets to, and incoming data packets from, one or more computer systems associated with the one or more remote network addresses. ### Claim 12 (depends on 7) The computing device of claim 7, wherein the kernel-level security agent is further configured to be executed by the one or more processors to, after implementing the firewall policy: send, over the computer network, a current containment status to the remote security system. ### Claim 13 (depends on 7) The computing device of claim 7, further comprising a display, wherein the kernel-level security agent is further configured to be executed by the one or more processors to, after implementing the firewall policy: receive, over the computer network and from the remote security system, a notification that the computing device has been contained; and display the notification on the display of the computing device, the notification including contact information of support personnel. ### Claim 14 (depends on 7) The computing device of claim 7, wherein the kernel-level security agent is further configured to be executed by the one or more processors to, after implementing the firewall policy: receive, over the computer network and from the remote security system, an instruction to deactivate containment of the computing device; and cease the enforcement of the firewall policy on the computing device to allow the outgoing data packets and the incoming data packets. ### Claim 15 One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors of a computing device, cause the computing device to install a kernel-level security agent on the computing device with a firewall policy, but refrain from implementing the firewall policy until an instruction to contain the computing device is received, wherein the kernel-level security agent, when executed by the one or more processors, causes the computing device to perform operations comprising: observing events associated with activity on the computing device; sending the events, over a computer network, to a remote security system; receiving, over the computer network and from the remote security system, the instruction to contain the computing device; executing instructions to load a user-mode component in user mode of the computing device; providing the firewall policy to the user-mode component; using the user-mode component to call an application programming interface (API) to implement the firewall policy; and implementing the firewall policy in kernel mode of the computing device based at least in part on the API called by the user-mode component, wherein the firewall policy, upon enforcement, denies outgoing data packets from, and incoming data packets to, the computing device that would have been allowed prior to the implementing of the firewall policy. ### Claim 16 (depends on 15) The one or more non-transitory computer-readable media of claim 15, the operations further comprising, after the implementing of the firewall policy: sending, over the computer network, a current containment status to the remote security system. ### Claim 17 (depends on 15) The one or more non-transitory computer-readable media of claim 15, the operations further comprising, after the implementing of the firewall policy: receiving, over the computer network and from the remote security system, an instruction to deactivate containment of the computing device; and ceasing the enforcement of the firewall policy on the computing device to allow the outgoing data packets and the incoming data packets. ### Claim 18 (depends on 15) The one or more non-transitory computer-readable media of claim 15, wherein a kernel-mode component of the kernel-level security agent maintains a configuration of the kernel-level security agent, the configuration specifying the user-mode component.