Techniques for tracking executable images across forking operations
AssigneeCrowdStrike, Inc.
InventorsMartin Kelly, Jayasankar Divakarla
Life of this patent
Estimating the term…
Abstract
A creation of a first process is detected in a kernel space of the operating system executing on a computing device. An exec parent of the first process is determined. The exec parent identifies a second process within an ancestry of the first process that last performed an exec operation prior to the creation of the first process. A unique process identifier (UPID) associated with a process identifier (PID) of the first process is generated. The UPID is associated with the exec parent in a first mapping store that maps the PID to the UPID. Process activity of the first process executing in the operating system is tracked to generate process activity data that comprises the exec parent.
Claims20
A method comprising:
- detecting, in a kernel space of an operating system executing on a computing device, a creation of a first process;
- determining, by a processing device, an exec parent of the first process, the exec parent identifying a second process, within an ancestry of the first process, that last performed an exec operation, prior to the creation of the first process, the exec operation comprising a system call that replaces at least a portion of an instruction space of the second process while maintaining the identity of the second process, and wherein the exec parent is a nearest ancestor that has performed the system call prior to the creation of the first process;
- generating a unique process identifier (UPID) associated with a process identifier (PID) of the first process;
- associating the UPID with the exec parent in a first mapping store that maps the PID to the UPID;
- and
- tracking process activity of the first process executing in the operating system to generate process activity data that comprises the exec parent.
A system comprising:
- a memory;
- and
- a processing device, operatively coupled to the memory, to:
- detect, in a kernel space of an operating system executing on a computing device, a creation of a first process;
- determine an exec parent of the first process, the exec parent identifying a second process, within an ancestry of the first process, that last performed an exec operation, prior to the creation of the first process, the exec operation comprising a system call that replaces at least a portion of an instruction space of the second process while maintaining the identity of the second process, and wherein the exec parent is a nearest ancestor that has performed the system call prior to the creation of the first process;
- generate a unique process identifier (UPID) associated with a process identifier (PID) of the first process;
- associate the UPID with the exec parent in a first mapping store that maps the PID to the UPID;
- and
- track process activity of the first process executing in the operating system to generate process activity data that comprises the exec parent.
A non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to:
- detect, in a kernel space of an operating system executing on a computing device, a creation of a first process;
- determine, by the processing device, an exec parent of the first process, the exec parent identifying a second process, within an ancestry of the first process, that last performed an exec operation, prior to the creation of the first process, the exec operation comprising a system call that replaces at least a portion of an instruction space of the second process while maintaining the identity of the second process, and wherein the exec parent is a nearest ancestor that has performed the system call prior to the creation of the first process;
- generate a unique process identifier (UPID) associated with a process identifier (PID) of the first process;
- associate the UPID with the exec parent in a first mapping store that maps the PID to the UPID;
- and
- track process activity of the first process executing in the operating system to generate process activity data that comprises the exec parent.
Dependencies are inferred from the claim text.