# US 12,192,214 B2 · Mitigating threats associated with tampering attempts > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,214 B2 - Document ID: US12192214B2 - Status: Granted - Kind: B2 - Application number: 17/308,500 - Filed: 2021-05-05 - Published: 2022-11-10 - Granted: 2025-01-07 - Earliest claimed: 2021-05-05 - Assignees: Sophos Limited - Applicants: Sophos Limited - Inventors: Richard Paul Cosgrove - Web page: https://patentgrep.com/patent/US12192214B2 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/554: {involving event detection and direct action} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB} - H04L 9/3247: {involving digital signatures} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/126: {the source of the received data} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An enterprise security system is improved by taking remedial actions responsive to detecting attempts at tampering with computing resources. When a tamper detection instrument detects an attempt at tampering, information about the attempt at tampering may be used to identify one or more candidate types of threats and/or candidate threats. One or more remedial actions associated with the threat or type of threat can be identified and applied in ten enterprise network environment. ## Claims ### Claim 1 A computer program product comprising computer executable code embodied in a non-transitory computer-readable medium that, when executing on one or more computing devices, performs the steps of: storing a cache in a kernel space of an endpoint of an enterprise network, the cache including one or more entries identifying one or more tamper-protected computing objects, each of the one or more entries in the cache cryptographically signed by an external trust authority; instrumenting the endpoint to detect an attempted modification to one of the tamper-protected computing objects based on an interaction with the cache corresponding to the one of the tamper-protected computing objects; and in response to detecting the attempted modification to the one of the tamper-protected computing objects: determining a process associated with the attempted modification to the one of the tamper-protected computing objects; determining that the process associated with the attempted modification is not one of the tamper-protected computing objects identified in an entry in the cache and cryptographically signed by the external trust authority; determining a remediation action for mitigating at least one threat associated with the attempted modification; and applying the remediation action to mitigate the at least one threat in the enterprise network, wherein the remediation action references the process associated with the attempted modification. ### Claim 2 (depends on 1) The computer program product of claim 1, wherein determining the remediation action is based on an association of the tamper-protected computing object with one or more known threats stored in a database of threats for the enterprise network. ### Claim 3 (depends on 1) The computer program product of claim 1, wherein determining the remediation action is based on a classification of the tamper-protected computing object as one of a system computing object and a user computing object. ### Claim 4 (depends on 1) The computer program product of claim 1, wherein determining the remediation action for mitigating the at least one threat is based on an association of a source of the attempted modification derived from the process with one or more known threats. ### Claim 5 (depends on 1) The computer program product of claim 1, wherein determining the remediation action for mitigating the at least one threat is based on at least one of a source of the attempted modification, a form of the attempted modification, and information descriptive of the tamper-protected computing object. ### Claim 6 (depends on 1) The computer program product of claim 1, wherein applying the remediation action to mitigate the at least one threat includes adding the process to a list of potentially compromised processes. ### Claim 7 (depends on 6) The computer program product of claim 6, wherein applying the remediation action to mitigate the at least one threat includes revoking keys to the process. ### Claim 8 (depends on 1) The computer program product of claim 1, wherein applying the remediation action to mitigate the at least one threat includes evaluating a system configuration of the endpoint for potential compromise. ### Claim 9 (depends on 1) The computer program product of claim 1, wherein applying the remediation action to mitigate the at least one threat includes applying a threat management coloring descriptor to the tamper-protected computing object. ### Claim 10 (depends on 1) The computer program product of claim 1, wherein applying the remediation action to mitigate the at least one threat includes determining a user associated with the process and logging off each active instance of the user in the enterprise network. ### Claim 11 A method comprising: instrumenting an endpoint of an enterprise network to detect an attempted modification to a tamper-protected computing object of the endpoint identified in a tamper-protection cache; detecting an attempt at modification to the tamper-protected computing object by a non-protected computing object based on an interaction with the tamper-protection cache; and in response to detecting the attempted modification to the tamper-protected computing object identified in the tamper-protection cache: determining attempted modification event information including at least one of a source of the attempted modification, a form of the attempted modification, and information descriptive of the tamper-protected computing object; determining that the source of the attempted modification is not one of the tamper-protected computing objects identified in the cache; determining a remediation action for mitigating at least one threat associated with the attempted modification event information; and applying the remediation action to mitigate the at least one threat in the enterprise network. ### Claim 12 (depends on 11) The method of claim 11, wherein detecting the attempted modification is based on use of the tamper-protection cache in a kernel space of the endpoint, the tamper-protection cache cryptographically secured with reference to a trust authority external to the endpoint. ### Claim 13 (depends on 11) The method of claim 11, wherein the remediation action to mitigate the at least one threat includes causing an application execution instance derivable from the attempted modification event information to be scanned for malware. ### Claim 14 (depends on 11) The method of claim 11, wherein in response to the attempted modification event information identifying the tamper-protected computing object as a system computing object, causing a process that performs a subsequent access of the system computing object to be sandboxed for analysis of an impact of tampering. ### Claim 15 (depends on 11) The method of claim 11, wherein in response to the attempted modification event information identifying the tamper-protected computing object as a file system element, adding the file system element to a list of file system elements for management by a threat management facility. ### Claim 16 (depends on 11) The method of claim 11, wherein the remediation action to mitigate the at least one threat includes restoring the tamper-protected computing object to an untampered condition. ### Claim 17 (depends on 11) The method of claim 11, wherein the remediation action to mitigate the at least one threat includes determining other tamper-protected system resources that are similar to the tamper-protected computing object and performing a threat prevention action for the other tamper-protected system resources. ### Claim 18 A system comprising: a tamper detection facility for monitoring tamper-protected computing resources of an enterprise network identified in a tamper-protection cache for tampering attempts and, in response to detecting a tampering attempt by a computing object other than the tamper-protected computing resources based on determining the computing object other than the tamper-protected computing resource is not identified in the tamper-protection cache, generating an indication of tampering of the tamper-protected computing resource based on an interaction with the tamper-protection cache; and a threat management facility constructed to determine at least one type of threat associated with the tampering attempts, to select a remediation action for mitigating at least one threat associated with the at least one type of threat, and to apply the remediation action to mitigate the at least one threat in the enterprise network. ### Claim 19 (depends on 18) The system of claim 18, further including a tamper protection cache stored in a kernel space of the system and cryptographically secured with reference to a trust authority external to the system, wherein the tamper detection facility references the tamper protection cache in the kernel space when monitoring the tamper-protected computing resources of the enterprise network. ### Claim 20 (depends on 18) The system of claim 18, wherein to determine the at least one type of threat is based on an association of the tamper-protected computing resource with one or more known threats stored in a database of threats that is accessible to the threat management facility.