Memory scan-based process monitoring

A non-transitory storage medium that stores machine-readable instructions that, when executed by a machine, cause the machine to:

• cause an operating system agent to scan a kernel memory space associated with a process to detect a memory state corresponding to the process being compromised by a security attack;
• cause the operating system agent to send a first heartbeat to a hardware controller, wherein the hardware controller is separate from the operating system agent and the heartbeat comprises a sequence of indications following a schedule to represent that the operating system agent is operating in an acceptable state;
• and
• in response to detection of the memory state, cause the operating system agent to communicate an alert to the hardware controller to cause the hardware controller to take corrective action.

A computer platform comprising:

• a baseboard management controller to:
• monitor a first heartbeat provided by a loadable operating system kernel extension, wherein the first heartbeat comprises a first sequence of indications following a first schedule to represent that the kernel extension is operating in an acceptable state;
• and
• in response to a detected interruption of the first sequence of indications or a communication of a security alert from the operating system kernel extension, initiate an action to address the security alert;
• a hardware processor other than the baseboard management controller;
• and
• a memory to store instructions corresponding to the operating system kernel extension, wherein the instructions, when executed by the hardware processor, cause the hardware processor to:
• listen for a second heartbeat generated by the process, wherein the second heartbeat comprises a second sequence of indications following a second schedule to represent that the process is operating in an acceptable state;
• scan a kernel memory space associated with the process to detect a memory state corresponding to an integrity of the process being compromised;
• send the first heartbeat to the baseboard management controller;
• and
• in response to at least one of detected interruption of the second sequence of indications or the detection of the memory state, communicate the security alert to the baseboard management controller.