Security privilege escalation exploit detection and mitigation
AssigneeOpen Text Corporation
InventorsAndrew Sandoval, Eric Klonowski
Life of this patent
Estimating the term…
Abstract
Examples of the present disclosure describe systems and methods for monitoring the security privileges of a process. In aspects, when a process is created, the corresponding process security token and privilege information is detected and recorded. At subsequent “checkpoints,” the security token is evaluated to determine whether the security token has been replaced, or whether new or unexpected privileges have been granted to the created process. When a modification to the security token is determined, a warning or indication of the modification is generated and the process may be terminated to prevent the use of the modified security token.
Claims20
A computer-implemented method of exploit protection comprising:
- registering, by a software package, with an operating system of a device to receive selected types of notifications;
- receiving, by the software package from the operating system based on the registering, a notification associated with a process executing on the device;
- identifying, by the software package, a current access token that is associated with the process;
- evaluating, by the software package, a current state of the current access token, the current state of the current access token comprising a current attribute associated with the current access token, wherein evaluating the current state of the current access token comprises:
- accessing, by the software package, state information of a first access token that is associated with the process from a memory, the state information of the first access token comprising a first attribute that corresponds to the current attribute;
- and
- evaluating, by the software package, the current attribute against the first attribute and determining that the current attribute does not match the first attribute;
- and
- based on the determination that the current attribute does not match the first attribute, performing, by the software package, a corrective action relating to the execution of the process on the device.
A non-transitory, computer-readable media encoding computer executable instructions which, when executed by a processor, performs a method comprising:
- registering, by a software package, with an operating system of a device to receive selected types of notifications;
- receiving, by the software package from the operating system based on the registering, a notification associated with a process executing on the device;
- identifying, by the software package, a current access token that is associated with the process;
- evaluating, by the software package, a current state of the current access token, the current state of the current access token comprising a current attribute associated with the current access token, wherein evaluating the current state of the current access token comprises:
- accessing, by the software package, state information of a first access token that is associated with the process from a memory, the state information of the first access token comprising a first attribute that corresponds to the current attribute;
- and
- evaluating, by the software package, the current attribute against the first attribute and determining that the current attribute does not match the first attribute;
- and
- based on the determination that the current attribute does not match the first attribute, performing, by the software package, a corrective action relating to the execution of the process on the device.
Dependencies are inferred from the claim text.