System and method for detecting and remediating a cybersecurity attack
AssigneeFireEye, Inc.
InventorHatem Eyada
Life of this patent
Estimating the term…
Abstract
According to one embodiment, a computerized method is directed to neutralizing callback malware. This method involves intercepting a message directed to an endpoint device, where the message is in response to a callback message sent from callback malware operating on the endpoint device. Thereafter, a first portion of information within the message is substituted with a second portion of information. The second portion of information includes code that is configured to overwrite at least a portion of the callback malware and cause the callback malware to become inoperable or mitigate its operability.
Claims41
A computerized method, comprising:
- intercepting a message directed to an endpoint device, the message is in response to a first message sent from a malware operating on the endpoint device prior to the intercepting of the message;
- and
- substituting a first portion of information within the message with a second portion of information prior to execution of the first portion of the information and prior to receipt of the message by the endpoint device, the second portion of information includes code that is configured to overwrite at least a portion of the malware and neutralize the malware by causing the malware to become inoperable or mitigate its operability.
A computerized method comprising:
- scanning memory of an endpoint device;
- performing an analysis on information obtained from the scanned memory to (1) determine that the information includes malware and (2) generate callback check information corresponding to the malware;
- in response to a malicious callback session being detected based on the callback check information,
- intercepting a message directed to the endpoint device, the message being a response to a callback message from malware already operating on the endpoint device prior to intercepting the message,
- substituting a first portion of information within the message with a second portion of information prior to execution of the first portion of the information and prior to receipt of the message by the endpoint device, and
- providing the message including the second portion of the information to the endpoint device,
- wherein the second portion of information is configured to overwrite a portion of the malware and at least mitigate operability of the malware by at least (i) disabling further callback messages from the malware operating in the endpoint device, (ii) delaying further callback messages from the malware operating in the endpoint device, or (iii) redirecting further callback messages from the malware operating in the endpoint device.
A system comprising:
- one or more hardware processors;
- and
- a non-transitory storage medium comprises:
- an interface to receive an incoming message directed to an endpoint device, the endpoint device being previously detected as including a malware associated with a malicious callback-based attack, and
- a first analysis engine in communication with the interface, the first analysis engine to substitute a first portion of information within the incoming message with a second portion of information prior to execution of the first portion of the information and prior to receipt of the message by the endpoint device, the second portion of information is configured to overwrite at least a portion of the malware and cause the malware to become inoperable or mitigate its operability.
A non-transitory storage medium including one or more software modules that, upon execution by circuitry, performs a plurality of operations, comprising:
- intercepting a message directed to an endpoint device, the message is in response to a first message sent from a malware operating on the endpoint device prior to the intercepting of the message;
- and
- substituting a first portion of information within the message with a second portion of information prior to execution of the first portion of the information and prior to receipt of the message by the endpoint device, the second portion of information includes code that is configured to overwrite at least a portion of the malware and neutralize the malware by causing the malware to become inoperable or mitigate its operability.
Dependencies are inferred from the claim text.