Interactive shell event detection
AssigneeCapsule8, Inc.
InventorBrandon M. Edwards
Life of this patent
Estimating the term…
Abstract
Telemetry associated with an Exec( ) Event denoting that a program has been invoked via a process is received. A determination is made that the process is a shell. Subsequent to determining that the invoked program is a shell, additional information comprising information that the program has attempted to obtain terminal information is received. Based at least in part on the received additional information, a determination is made that the program is an interactive shell. An action is taken in response to the determination that the program is an interactive shell.
Claims20
A system, comprising:
- a first processor;
- and
- a memory coupled to the first processor, the memory storing instructions that configure the first processor to:
- receive telemetry denoting that a program has been invoked on a node via a process;
- determine that the invoked program is a shell based at least on a program path and name information associated with the process;
- subsequent to determining that the invoked program is a shell, receive additional information including timing information associated with commands entered into the shell;
- based at least in part on the received additional information, determine that the program is an interactive shell interactively operated by a user;
- in response to determining that the program is an interactive shell, configure the node to tag one or more commands entered into the interactive shell for storage and query with a tag identifying the one or more commands as interactive shell commands associated with the program;
- and
- manage a security policy for the node based on the tagged interactive shell commands.
A method, comprising:
- receiving telemetry denoting that a program has been invoked on a node via a process;
- determining that the invoked program is a shell based at least on a program path and name information associated with the process;
- subsequent to determining that the invoked program is a shell, receiving additional information including timing information associated with commands entered into the shell;
- based at least in part on the received additional information, determining that the program is an interactive shell interactively operated by a user;
- in response to determining that the program is an interactive shell, configuring the node to tag one or more commands entered into the interactive shell for storage and query with a tag identifying the one or more commands as interactive shell commands associated with the program;
- and
- managing a security policy for the node based on the tagged interactive shell commands.
A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions executable on one or more computing devices to perform the steps of for:
- receiving telemetry denoting that a program has been invoked on a node via a process;
- determining that the invoked program is a shell based at least on a program path and name information associated with the process;
- subsequent to determining that the invoked program is a shell, receiving additional information including timing information associated with commands entered into the shell;
- based at least in part on the received additional information, determining that the program is an interactive shell interactively operated by a user;
- in response to determining that the program is an interactive shell, configuring the node to tag one or more commands entered into the interactive shell for storage and query with a tag identifying the one or more commands as interactive shell commands associated with the program;
- and
- managing a security policy for the node based on the tagged interactive shell commands.
Dependencies are inferred from the claim text.