Back to results
US 12,591,671 B2Granted
Detecting malware activity using kernel-based process discovery detection
AssigneeSophos Limited
InventorTzu-yi Lin
Life of this patent
Estimating the term…
Abstract
Malware attacks seek to identify vulnerabilities that can be exploited by enumerating currently-executing processes in the operating system of a target device for injection of a malicious payload. By detecting process enumeration events occurring at the kernel level, known or suspected malware enumeration activity can be identified and mitigated.
Claims17
A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
- executing a security agent on an endpoint computing device, the security agent including at least one component configured to monitor process object reference events occurring in an operating system kernel on the endpoint computing device;
- detecting a plurality of process object reference events occurring in the operating system kernel, each process object reference event associated with an event tag;
- filtering the plurality of process object reference events based upon (i) the event tag and (ii) data in an operating system structure to identify process enumeration events within the plurality of process object reference events;
- determining whether the filtered process object reference events occurring in the operating system kernel are indicative of malware activity on the endpoint;
- and
- initiating a malware remediation process when the filtered process object reference events occurring in the operating system kernel are indicative of malware activity on the endpoint computing device.
3 more elements
A method of detecting malware activity, the method comprising:
- executing a security agent on an endpoint computing device, the security agent including at least one component configured to monitor process object reference events occurring in an operating system kernel on the endpoint computing device;
- detecting a plurality of process object reference events occurring in the operating system kernel, each process object reference event associated with an event tag;
- filtering the plurality of process object reference events based upon (i) the event tag and (ii) data in an operating system structure to identify process enumeration events within the plurality of process object reference events;
- determining whether the filtered process object reference events occurring in the operating system kernel are indicative of malware activity on the endpoint;
- and
- initiating a malware remediation process when the filtered process object reference events occurring in the operating system kernel are indicative of malware activity on the endpoint computing device.
3 more elements
A system for detecting malware activity, the system comprising:
- an endpoint computing device including a processor and a memory, the processor configured to:
- execute a security agent, the security agent including at least one component configured to monitor process object reference events occurring in an operating system kernel on the endpoint computing device;
- detect a plurality of process object reference events occurring in the operating system kernel, each process object reference event associated with an event tag;
- filtering the plurality of process object reference events based upon (i) the event tag and (ii) data in an operating system structure to identify process enumeration events within the plurality of process object reference events;
- determine whether the filtered process object reference events occurring in the operating system kernel are indicative of malware activity on the endpoint;
- and
- initiate a malware remediation process when the filtered process object reference events occurring in the operating system kernel are indicative of malware activity on the endpoint computing device.
4 more elements
Dependencies are inferred from the claim text.