# US 2017/0255778 A1 · Hypervisor-Based Interception of Memory Accesses

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2017/0255778 A1
- Document ID: US20170255778A1
- Status: Published application
- Kind: A1
- Application number: 15/063,086
- Filed: 2016-03-07
- Published: 2017-09-07
- Earliest claimed: 2016-03-07
- Assignees: CrowdStrike, Inc.
- Applicants: CrowdStrike, Inc.
- Inventors: Ion-Alexandru Ionescu
- Web page: https://patentgrep.com/patent/US20170255778A1

## CPC

- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 12/1416: {by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights (G06F12/1458 takes precedence)}
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/54: by adding security routines or objects to programs
- G06F 21/554: {involving event detection and direct action}
- G06F 2009/45583: {Memory management, e.g. access or allocation}
- G06F 2221/034: Test or assess a computer or a system
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A security agent configured to initiate a security agent component as a hypervisor for a computing device is described herein. The security agent is further configured to determine a subset of memory locations in memory of the computing device to be intercepted. The security agent component may then set intercepts for the determined memory locations. Setting such intercepts may include setting privilege attributes for pages which include the determined memory locations so as to prevent specific operations in association with those memory locations. In response to one of those specific operations, the security agent component may return a false indication of success or allow the operation to enable monitoring of the actor associated with the operation. When an operation affects another memory location associated with one of the pages, the security agent component may temporarily reset the privilege attribute for that page to allow the operation.

## Claims

### Claim 1

A system comprising:
a processor;
a memory coupled to the processor;
a security agent configured to be operated by the processor to initiate a security agent component as a hypervisor for the system and determine a subset of memory locations in the memory to be intercepted; and
the security agent component configured to be operated by the processor to set intercepts for memory locations of the determined subset of memory locations.

### Claim 2 (depends on 1)

The system of claim 1, wherein the security agent component is further configured to set the intercepts by setting privilege attributes for pages which include the memory locations of the determined subset of memory locations.

### Claim 3 (depends on 1)

The system of claim 1, wherein the security agent component is further configured to set the intercepts by redirecting from the subset of memory locations to different memory locations.

### Claim 4 (depends on 1)

The system of claim 1, wherein the security agent is further configured to initiate the security agent component as the hypervisor by storing processor state settings in a data structure and instructing the processor to initiate the security agent component as the hypervisor based on the data structure.

### Claim 5 (depends on 4)

The system of claim 4, wherein the security agent includes different routines for different operating systems, each of the different routines fixing as invariant a part of the data structure associated with the respective different operating system.

### Claim 6 (depends on 1)

The system of claim 1, wherein the security agent is further configured to determine the subset of the memory locations based on a security agent configuration received from a security service.

### Claim 7 (depends on 1)

The system of claim 1, wherein the security agent is further configured to intercept page out requests and prevent paging out of memory pages which include the memory locations that are to be intercepted, or to intercept page in requests in order to update knowledge of memory locations.

### Claim 8 (depends on 1)

The system of claim 1, wherein the security agent is further configured to request that an operating system kernel of the system lock page table mappings of the memory locations of the subset of memory locations.

### Claim 9 (depends on 1)

The system of claim 1, wherein the security agent is further configured to determine instructions to be intercepted and the security agent component is further configured to set intercepts for the determined instructions.

### Claim 10 (depends on 1)

The system of claim 1, wherein the security agent component is further configured to remove intercepts corresponding to a process upon termination of the process.

### Claim 11

A non-transitory computer-readable medium having stored thereon executable instructions which, when executed by a computing device, cause the computing device to perform operations comprising:
identifying memory locations of a subset of memory locations in memory of the computing device to be intercepted;
determining pages of the memory which include the identified memory locations;
setting privilege attributes of the pages to prevent specific types of operations from affecting the memory locations;
noting an operation affecting another memory location associated with one of the pages which differs from the identified memory location associated with that page; and
temporarily resetting the privilege attribute of the one of the pages to allow the operation.

### Claim 12 (depends on 11)

The non-transitory computer-readable medium of claim 11, wherein the identified memory locations include a memory location associated with privileges for a process and the setting includes setting the privilege attribute for the page including the memory location to a read only value to prevent writes to the memory location.

### Claim 13 (depends on 11)

The non-transitory computer-readable medium of claim 11, wherein the identified memory locations include a memory location associated with user credentials and the setting includes setting the privilege attribute for the page including the memory location to an inaccessible value to prevent reads of the memory location.

### Claim 14

A computer-implemented method comprising:
identifying memory locations of a subset of memory locations in memory of the computing device to be intercepted;
determining pages of the memory which include the identified memory locations;
setting privilege attributes of the pages to prevent specific types of operations from affecting the memory locations;
noting an operation affecting one of the identified memory locations;
in response to noting the operation, either:
temporarily resetting the privilege attribute of the page including the one of the identified memory locations to allow the operation, or
returning a false indication of success for the operation.

### Claim 15 (depends on 14)

The method of claim 14, wherein the operation is a write operation, the one of the identified memory locations is a memory location associated with privileges for a process and the setting includes setting the privilege attribute for the page including the one of the identified memory locations to a read only value to prevent write operations to the one of the identified memory locations.

### Claim 16 (depends on 15)

The method of claim 15, wherein the returning the false indication of success includes allow the write operation to an alternate memory location and returning an indication that the write operation was successful.

### Claim 17 (depends on 14)

The method of claim 14, wherein the operation is a read operation, the one of the identified memory locations is memory location associated with user credentials and the setting includes setting the privilege attribute for the page including the one of the identified memory locations to an inaccessible value to prevent reads of the one of the identified memory locations.

### Claim 18 (depends on 17)

The method of claim 17, further comprising causing the read operation to be performed on an alternate memory location storing false or deceptive user credentials.

### Claim 19 (depends on 18)

The method of claim 18, further comprising monitoring use of the deceptive credentials.

### Claim 20 (depends on 18)

The method of claim 18, further comprising copying contents of the page including the one of the identified memory locations to a page which includes the alternate memory location storing the false or deceptive user credentials.

### Claim 21 (depends on 14)

The method of claim 14, further comprising identifying a process, thread, or module that requested the operation.

### Claim 22 (depends on 21)

The method of claim 21, further comprising, after temporarily resetting the privilege attribute, monitoring activities of the process, thread, or module.

### Claim 23 (depends on 21)

The method of claim 21, further comprising terminating the process, thread, or module.