Detection and remediation of malware in virtual machines using software enclaves

A non-transitory computer readable storage medium having stored thereon program code executable by a hypervisor of a computer system, the program code causing the hypervisor to execute a method comprising:

• creating a software enclave for a virtual machine (VM), the software enclave being a secure execution environment for running program code that has visibility into the VM but is isolated from guest processes of the VM;
• loading an enclave security agent into the software enclave, the enclave security agent being a component of an endpoint detection and response (EDR) system that is configured to collect information regarding events occurring within the VM and to detect malware in the VM based on the information;
• and
• initiating execution of the enclave security agent within the software enclave.

A computer system comprising:

• a processor;
• a hypervisor;
• and
• a non-transitory computer readable medium having stored thereon program code that, when executed by the processor, causes the hypervisor to:
• create a software enclave for a virtual machine (VM), the software enclave being a secure execution environment for running program code that has visibility into the VM but is isolated from guest processes of the VM;
• load an enclave security agent into the software enclave, the enclave security agent being a component of an endpoint detection and response (EDR) system that is configured to collect information regarding events occurring within the VM and to detect malware in the VM based on the information;
• and
• initiate execution of the enclave security agent within the software enclave.