Systems and methods of detecting malicious powershell scripts
AssigneeUnited Services Automobile Association (USAA)
InventorRobert Jason Neel
Life of this patent
Estimating the term…
Abstract
Disclosed herein are systems and methods of executing scanning software, such an executable software program or script (e.g., PowerShell script), by a computing device of an enterprise, such as a security server, may instruct the computing device to search all or a subset of computing devices in an enterprise network. The scanning software may identify PowerShell scripts containing particular malware attributes, according to a malicious-code dataset. The computing system executing the scanning software may scan through the identified PowerShell scripts to identify particular strings, values, or code-portions, and take a remedial action according to the scanning software programming.
Claims20
A computer-implemented method comprising:
- periodically querying, by a computer executing a scanning software, at least a portion of one or more hard drives of one or more remote computers according to a set of instructions of the scanning software to identify one or more task automation and configuration management software files containing at least one of A) a task automation and configuration management software script, B) a task automation and configuration management software command, or C) a task automation and configuration management software argument,
- wherein the one or more hard drives are connected to the computer via an enterprise network;
- and
- in response to the computer identifying at least one task automation and configuration management software file hosted by a first hard drive of the one or more hard drives:
- querying, by the computer, the at least one task automation and configuration management software file according to a malicious-code dataset;
- and
- in response to the computer determining that the at least one task automation and configuration management software file hosted by the first hard drive contains a code portion that matches at least a part of the malicious-code dataset,
- causing, by the computer, termination of the connection between the enterprise network and the remote computer associated with the first hard drive.
A computer system comprising:
- a plurality of computers, each computer accessing one or more hard drives that each host a file system configured to store a plurality of task automation and configuration management software files;
- and
- a server coupled to the plurality of computers via an enterprise network, the server comprising at least one processor and non-transitory computer readable medium comprising machine-readable instructions configured to be executed by the at least one processor to:
- periodically query at least a portion of the one or more hard drives of the plurality of computers according to a set of instructions of a scanning software to identify one or more task automation and configuration management software files containing at least one of A) a task automation and configuration management software script, B) a task automation and configuration management software command, or C) a task automation and configuration management software argument;
- and
- in response to the server identifying at least one task automation and configuration management software file hosted by a first hard drive of the one or more hard drives:
- query the at least one task automation and configuration management software file according to a malicious-code dataset;
- and
- in response to the server determining that the at least one task automation and configuration management software file hosted by the first hard drive contains a code portion that matches at least a part of the malicious-code dataset,
- causing, by the server, termination of the connection between the enterprise network and at least one of the computers configured to access the first hard drive.
A non-transitory, computer-readable storage medium storing instructions that, when executed by a computing system, cause the computing system to perform a process for scanning memory devices for malicious code, the process comprising:
- periodically querying, by a computing system executing a scanning software, at least a portion of one or more hard drives of one or more remote computers according to a set of instructions of the scanning software to identify one or more task automation and configuration management software files containing at least one of A) a task automation and configuration management software script, B) a task automation and configuration management software command, or C) a task automation and configuration management software argument,
- wherein the one or more hard drives are connected to the computing system via an enterprise network;
- and
- in response to the computing system identifying at least one task automation and configuration management software file hosted by a first hard drive of the one or more hard drives:
- querying, by the computing system, the at least one task automation and configuration management software file according to a malicious-code dataset;
- and
- in response to the computing system determining that the at least one task automation and configuration management software file hosted by the first hard drive contains a code portion that matches at least a part of the malicious-code dataset,
- causing, by the computing system, termination of the connection between the enterprise network and the remote computer associated with the first hard drive.
Dependencies are inferred from the claim text.