Detecting kernel exploits

A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, causes the one or more computing devices to perform the steps of:

• monitoring a kernel of a computing node for an activation of at least one of a plurality of telemetry collection mechanisms including at least one Kprobe providing an on-demand collection hook for exported kernel symbols and at least one Kretprobe to collect data on function entry to the kernel or on function return from the kernel;
• determining that a strategy pattern match has occurred with a detection strategy for a stack pivot by detecting, with the activation of at least one of the plurality of telemetry collection mechanisms, that a stack pointer has referenced an address outside normal stack bounds;
• and
• in response to the strategy pattern match occurring, taking a remedial action to an exploit chain on the computing node associated with the stack pivot.

A method, comprising:

• monitoring a kernel of a computing node with a sensor for an activation of one or more collection mechanisms associated with the sensor, the one or more collection mechanisms including at least one of a Kprobe and a Kretprobe that provide telemetry data from the kernel for the sensor;
• determining that a strategy pattern match has occurred with a detection strategy for a stack pivot by detecting, with the activation of at least one of the one or more collection mechanisms, that a stack pointer has referenced an address outside normal stack bounds;
• and
• in response to the strategy pattern match occurring, taking a remedial action to an exploit chain on the computing node associated with the stack pivot.

A system, comprising:

• a computing node executing a kernel on a processor;
• a memory on the computing node, the memory storing instructions;
• and
• a sensor on the computing node, the sensor configured to detect an activation of a plurality of collection mechanisms including at least one of a Kprobe and a Kretprobe that provide telemetry data from the kernel;
• wherein the processor is configured by the instructions stored in the memory to perform the steps of:
• monitoring the kernel of the computing node with the sensor,
• determining that a strategy pattern match has occurred with a detection strategy for a stack pivot by detecting, based on the telemetry data from the sensor, that a stack pointer has made a reference to an address outside normal stack bounds, and
• in response to the strategy pattern match occurring, taking a remedial action to an exploit chain on the computing node associated with the stack pivot.