Back to results
US 11,943,238 B1Granted
Process tree and tags
AssigneeCapsule8, Inc.
InventorBrandon M. Edwards
Life of this patent
Estimating the term…
Abstract
Information associated with a process is received. At least a portion of the received information is used to modify a Process Tree. Modifying the Process Tree includes at least one of: (1) adding a Tag to the Process Tree and (2) modifying a Tag in the Process Tree. An Alert is generated based at least in part in response to determining that a Strategy has been matched.
Claims20
A system, comprising:
- a memory storing instructions:
- and
- a processor coupled to the memory and configured by the instructions to:
- receive information associated with a process event including a transition;
- use at least a portion of the received information to modify a Process Tree_by propagating tag information according to tag propagation logic, wherein modifying the Process Tree includes at least one of:
- (1) adding a Tag to the Process Tree for a process created by the process event, and
- (2) modifying an original authorized shell Tag in the Process Tree for an existing process exited by the process event;
- determine that at least a portion of the Process Tree matches a malware pattern:
- and
- generate an Alert, based at least in part in response to determining that the malware pattern has been matched.
7 more elements
A method, comprising:
- receiving information associated with a process event including a transition;
- using at least a portion of the received information to modify a Process Tree_by propagating tag information according to tag propagation logic, wherein modifying the Process Tree includes at least one of:
- (1) adding a Tag to the Process Tree for a process created by the process event, and
- (2) modifying an original authorized shell Tag in the Process Tree for an existing process exited by the process event;
- determining that at least a portion of the Process Tree matches a malware pattern:
- and
- generating an Alert, based at least in part in response to determining that the malware pattern has been matched.
4 more elements
A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- receiving information associated with a process event including a transition;
- using at least a portion of the received information to modify a Process Tree by propagating tag information according to tag propagation logic, wherein modifying the Process Tree includes at least one of:
- (1) adding a Tag to the Process Tree for a process created by the process event, and
- (2) modifying an original authorized shell Tag in the Process Tree for an existing process exited by the process event;
- determining that at least a portion of the Process Tree matches a malware pattern;
- and
- generating an Alert, based at least in part in response to determining that the malware pattern has been matched.
4 more elements
Dependencies are inferred from the claim text.