# US 11,909,761 B2 · Mitigating malware impact by utilizing sandbox insights > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,761 B2 - Document ID: US11909761B2 - Status: Granted - Kind: B2 - Application number: 17/591,409 - Filed: 2022-02-02 - Published: 2022-05-19 - Granted: 2024-02-20 - Earliest claimed: 2019-12-10 - Assignees: Fortinet, Inc. - Applicants: Fortinet, Inc. - Inventors: Udi Yavo; Roy Katmor; Ido Kelson - Web page: https://patentgrep.com/patent/US11909761B2 ## CPC - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 8/30: Creation or generation of source code - G06F 8/65: Updates (security arrangements therefor G06F21/57) - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/568: {eliminating virus, restoring damaged files} - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - G06F 8/74: Reverse engineering; Extracting design information from source code - G06F 9/45512: {Command shells} - G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)} - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45591: {Monitoring or debugging support} - H04L 63/0272: {Virtual private networks} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods for mitigating the impact of malware by reversing malware related modifications in a computing device are provided. According to an embodiment, a sandbox service running within a network security platform protecting an enterprise network receives a file containing malware and associated contextual information from an endpoint security solution running on an endpoint device, which has been infected by the malware. The sandbox service captures information regarding a first series of actions performed by the malware and based on the first series of actions generates a remediation script specifying a second series of actions that are configured to restore the endpoint device to a pre-infected state. The network security platform causes the endpoint device to be returned to the pre-infected state by causing the endpoint security solution to execute the remediation script on the endpoint device. ## Claims ### Claim 1 A method comprising: receiving, by a processing resource associated with a sandbox service, a file containing malware via a communication network from an endpoint device and contextual information associated with the file, wherein the endpoint device has been infected by the malware; capturing, by the processing resource, information regarding a first series of actions performed by the malware, wherein the capturing is done based at least in part upon receiving the file and the contextual information; generating, by the processing resource, a remediation script specifying a second series of actions that are configured to restore the endpoint device to a pre-infected state representing a state of the endpoint device prior to being infected by the malware, wherein the generating is based at least in part on the first series of actions; transferring, by the processing resource, the remediation script to an endpoint agent executing on the endpoint device via the communication network; and causing the endpoint device to execute the remediation script. ### Claim 2 (depends on 1) The method of claim 1, wherein executing the remediation script returns the endpoint device to the pre-infected state. ### Claim 3 (depends on 1) The method of claim 1, wherein each action of the first series of actions is associated with a time stamp. ### Claim 4 (depends on 1) The method of claim 1, wherein the contextual information is captured by the endpoint device responsive to detection of a suspicious or malicious event detected by the endpoint device that relates to a process running on the endpoint device that is associated with the file. ### Claim 5 (depends on 4) The method of claim 4, wherein the contextual information includes: command line information associated with the process; an execution chain associated with the process; a memory dump associated with the process; information indicative of an application with which the process is associated; information identifying an end user associated with the process; or environment variables associated with the process. ### Claim 6 (depends on 1) The method of claim 1, wherein the sandbox service is a cloud-based security service. ### Claim 7 (depends on 1) The method of claim 1, wherein the second series of actions are based on reverse actions of the first series of actions. ### Claim 8 (depends on 1) The method of claim 1, wherein each action of the first series of action is associated with an undo recipe that is used to generate the remediation script specifying the second series of actions. ### Claim 9 (depends on 1) The method of claim 1, wherein the first series of actions include one or more of: a change in a registry file of the endpoint device; a change in a system file of the endpoint device; addition of a new user account on the endpoint device; addition of a new firewall rule; and a change to an existing firewall rule. ### Claim 10 (depends on 1) The method of claim 1, wherein the sandbox service captures the information regarding the first series of actions by tracing operating system code of the endpoint device. ### Claim 11 (depends on 1) The method of claim 1, wherein a three-dimensional in-memory graph represents the first series of actions in an operating system of the endpoint device. ### Claim 12 (depends on 1) The method of claim 1, wherein the sandbox service captures the information regarding the first series of actions based on at least one of static analysis or dynamic analysis of the file. ### Claim 13 A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processing resources associated with a sandbox service, causes the one or more processing resources to perform a method comprising: receiving a file containing malware via a communication network from an endpoint device and contextual information associated with the file, wherein the endpoint device has been infected by the malware; capturing information regarding a first series of actions performed by the malware, wherein the capturing is done based at least in part upon receiving the file and the contextual information; generating a remediation script specifying a second series of actions that are configured to restore the endpoint device to a pre-infected state representing a state of the endpoint device prior to being infected by the malware, wherein the generating is based at least in part on the first series of actions; transferring the remediation script to an endpoint agent executing on the endpoint device via the communication network; and causing the endpoint device to execute the remediation script. ### Claim 14 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the contextual information is captured by the endpoint security solution responsive to detection of a suspicious or malicious event detected by the endpoint security solution that relates to a process running on the endpoint device that is associated with the file. ### Claim 15 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the contextual information includes: command line information associated with the process; an execution chain associated with the process; a memory dump associated with the process; information indicative of an application with which the process is associated; information identifying an end user associated with the process; or environment variables associated with the process. ### Claim 16 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the sandbox service is in a form of a virtual sandbox appliance. ### Claim 17 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the second series of actions are based on reverse actions of the first series of actions. ### Claim 18 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein each action of the first series of action is associated with an undo recipe that is used to generate the remediation script specifying the second series of actions. ### Claim 19 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the first series of actions include one or more of: a change in a registry file of the endpoint device; a change in a system file of the endpoint device; addition of a new user account on the endpoint device; addition of a new firewall rule; and a change to an existing firewall rule. ### Claim 20 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the sandbox service captures the information regarding the first series of actions based on at least one of static analysis or dynamic analysis of the file. ### Claim 21 (depends on 13) The non-transitory computer readable medium of claim 13, wherein executing the remediation script returns the endpoint device to the pre-infected state. ### Claim 22 (depends on 13) The non-transitory computer readable medium of claim 13, wherein each action of the first series of actions is associated with a time stamp. ### Claim 23 A system for malware recovery, the system comprising: a processing resource associated with a sandbox service; and a non-transitory computer medium embodying accessible by the processing resource, wherein the non-transitory computer readable medium includes a set of instructions, which when executed by one or more processing resources associated with a sandbox service, causes the one or more processing resources to perform a method comprising: receiving a file containing malware via a communication network from an endpoint device and contextual information associated with the file, wherein the endpoint device has been infected by the malware; capturing information regarding a first series of actions performed by the malware, wherein the capturing is done based at least in part upon receiving the file and the contextual information; generating a remediation script specifying a second series of actions that are configured to restore the endpoint device to a pre-infected state representing a state of the endpoint device prior to being infected by the malware, wherein the generating is based at least in part on the first series of actions; transferring the remediation script to an endpoint agent executing on the endpoint device via the communication network; and causing the endpoint device to execute the remediation script. ### Claim 24 (depends on 23) The system of claim 23, wherein executing the remediation script returns the endpoint device to the pre-infected state. ### Claim 25 (depends on 23) The system of claim 23, wherein each action of the first series of actions is associated with a time stamp.