# US 9,436,826 B2 · Discovering malicious input files and performing automatic and distributed remediation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,436,826 B2 - Document ID: US9436826B2 - Status: Granted - Kind: B2 - Application number: 13/161,950 - Filed: 2011-06-16 - Published: 2012-11-22 - Granted: 2016-09-06 - Earliest claimed: 2011-05-16 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Vishal Kapoor; Jonathan Mark Keller; Ajith Kumar; Adrian M. Marinescu; Marc E. Seinfeld; Anil Francis Thomas; Michael Sean Jarrett; Joseph J. Johnson; Joseph L. Faulhaber - Inventors: Vishal Kapoor; Jonathan Mark Keller; Ajith Kumar; Adrian M. Marinescu; Marc E. Seinfeld; Anil Francis Thomas; Michael Sean Jarrett; Joseph J. Johnson; Joseph L. Faulhaber - Web page: https://patentgrep.com/patent/US9436826B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/568: {eliminating virus, restoring damaged files} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 2221/2101: Auditing as a secondary aspect - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The subject disclosure is directed towards detecting malware or possible malware in an input file by allowing the input file to be opened, and by monitoring for one or more behaviors corresponding to the open file that likely indicate malware. Only certain executable files and/or file types opened thereby may be monitored, with various collected event data used for antimalware purposes when improper behavior is observed. Example behaviors include writing of a file to storage, generation of network traffic, injection of a process, running of script, and/or writing system registry data. Telemetry data and/or a sample of the file may be sent to an antimalware service, and malware remediation may be performed. Data (e.g., the collected events) may be distributed to other nodes for use in antimalware detection, e.g., to block execution of a similar file. ## Claims ### Claim 1 In a computing environment, a method performed at least in part on at least one processor, comprising: intercepting, by a real time protection component, a file open event by a program corresponding to an input file; allowing the input file to be opened by the program during normal user operation; responsive to the input file being opened normally by the program, initiating monitoring of the program for one or more behaviors that indicate possible malware; recording events initiated by the program corresponding to the input file and a source associated with the input file; responsive to the program closing the input file, scanning the input file to generate scan results and terminating the monitoring of the program; and analyzing the recorded events, the source associated with the input file, and the scan results to determine a potential source of an infection, including by identifying the one or more behaviors of the program that indicate possible malware using the analysis. ### Claim 2 (depends on 1) The method of claim 1 wherein said monitoring for the one or more behaviors comprises watching for writing of a file to storage by the program that opened the input file or a process related to the program that opened the input file. ### Claim 3 (depends on 1) The method of claim 1 wherein said monitoring for the one or more behaviors comprises watching for generation of network traffic by the program that opened the input file or a process related to the program that opened the input file. ### Claim 4 (depends on 1) The method of claim 1 wherein said monitoring for the one or more behaviors comprises watching for injection of at least one process by the program that opened the input file or a process related to the program that opened the input file. ### Claim 5 (depends on 1) The method of claim 1 wherein said monitoring for the one or more behaviors comprises watching for running of one or more scripts by the program that opened the input file or a process related to the program that opened the input file. ### Claim 6 (depends on 1) The method of claim 1 wherein said monitoring for the one or more behaviors comprises watching for writing of data to a system registry by the program that opened the input file or a process related to the program that opened the input file. ### Claim 7 (depends on 1) The method of claim 1 further comprising: distributing information regarding malware corresponding to the input file to at least one other machine comprising a node in a distributed or virtualized computing environment. ### Claim 8 (depends on 1) The method of claim 1 further comprising: taking action to remediate malware corresponding to the input file. ### Claim 9 (depends on 1) The method of claim 1 further comprising: taking action to remediate malware corresponding to the input file, including quarantining the input file. ### Claim 10 (depends on 1) The method of claim 1 wherein said monitoring for the one or more behaviors comprises watching for writing of a dropped file to storage by the program that opened the input file or a process related to the program that opened the input file, and further comprising: taking action to remediate malware corresponding to the input file, including quarantining the dropped file. ### Claim 11 (depends on 1) The method of claim 1 further comprising: reporting telemetry data based upon malware corresponding to the input file to an antimalware service. ### Claim 12 (depends on 1) The method of claim 1 further comprising: sending a sample comprising at least part of the input file to an antimalware service. ### Claim 13 In a computing environment, a system comprising: a malware protection engine configured to: collect information corresponding to program behaviors and input files; and take action directed towards at least one of reporting data corresponding to the collected information or performing remediation with respect to the information; and a real time protection component communicatively coupled to the malware protection engine and configured to: intercept a file open event by a program requesting to open an input file; allow the program to open the input file normally; responsive to the input file being opened normally by the program, initiate monitoring operations of the program for one or more behaviors indicative of potential malware; record events initiated by the program that correspond to the input file and a source associated with the input file; notify the malware protection engine at least based on at least one of detection of the input file opened by the program having a file type associated with malware exploit behavior or detection of the one or more behaviors indicative of the potential malware during the operations by the program; and responsive to the program closing the input file, terminating the monitoring of the program. ### Claim 14 (depends on 13) The system of claim 13 wherein at least part of the information corresponding to the program behaviors and the input files is distributed to one or more nodes in a distributed or virtualized computing environment. ### Claim 15 (depends on 13) The system of claim 13 wherein the real time protection component is configured to evaluate the program that is opening the file type associated with malware exploit behavior against a predetermined list to determine whether the file type is associated with malware exploit behavior. ### Claim 16 (depends on 13) The system of claim 13 wherein the behavior indicative of potential malware comprises a particular event, a pattern of events, or a deviation from predetermined proper behavior, or any combination of particular event, a pattern of events, or a deviation from predetermined proper behavior. ### Claim 17 (depends on 13) The system of claim 13 further comprising: an antimalware service, the malware protection engine reporting the collected information to the antimalware service, including sending telemetry data to the antimalware service, or sending at least part of a file to the antimalware service, or both. ### Claim 18 One or more computer storage devices having computer-executable instructions, which on execution by a computer cause the computer to perform operations, comprising: intercepting a file open event by a program corresponding to an input file; allowing the program to open the input file; responsive to the input file being opened by the program, initiating monitoring of the program during normal user operation for one or more behaviors indicative of possible malware during the processing of the input file by the program; recording information corresponding to events initiated by the program with respect to the input file and a source of the input file; detecting a behavior of the program indicative of possible malware; analyzing the recorded information and the source of the input file to determine a potential source of an infection; and responsive to the program closing the input file, terminating the monitoring of the program. ### Claim 19 (depends on 18) The one or more computer storage devices of claim 18 wherein analyzing at least some of the events comprises reporting telemetry data, or distributing data including at least some of the events to at least one other node for use in antimalware detection, or both. ### Claim 20 (depends on 18) The one or more computer storage devices of claim 18 wherein analyzing at least some of the events comprises distributing data including at least some of the events to at least one other node for use in antimalware detection, and having further computer-executable instructions comprising: quarantining the input file based upon the data.