Systems and methods for persistent file protection in endpoint detection and response

A system for persistent file protection, the system comprising:

• a persistent file cache (PFC) in user mode, the PFC configured to store historical file operation information and comprising:
• a session cache that invalidates after computing device restart, and a persistent cache;
• at least one processor and a memory and operably coupled to the at least one processor;
• instructions that, when executed by the at least one processor, cause the at least one processor to implement:
• an EDR manager configured to determine an incident on a computing device,
• an EDR driver configured to intercept a file operation in a kernel mode based on the incident,
• a persistent file cache (PFC) configured to store historical file operation information and comprising:
• a session cache portion that invalidates after system restart, and a persistent cache portion,
• a cache logic engine configured to store evidence of a file change between system shutdown and system restart on the persistent cache portion,
• a remediation engine configured to receive, from the EDR manager, a remediation action including a request to remediate the file, wherein the request is based on the incident and perform remediation of the file using the file information stored in the persistent cache portion by instructing one or more remediation handlers, and
• a file protector configured to determine the file change.

A file protector implemented in kernel mode and comprising instructions that, when executed by at least one processor, cause the file protector to provide persistent protection of a file, including:

• comparing file information for the file stored in a persistent file cache (PFC) to an update sequence number (USN) journal;
• identifying a change to the file between system shutdown and system restart based on the compare;
• conducting a hash comparison by:
• hashing a volume-level file map including a file extent before restart as a pre-restart hash and storing the pre-restart hash in the PFC, and
• upon restart, hashing the volume-level file map as a post-restart hash,
• comparing the pre-restart hash and the post-restart hash;
• and
• determining continuity tracking can resume safely based on the hash comparison.