System and method for detecting and monitoring persistent events
AssigneeSecureworks Corp.
InventorsRoss R. Kinder, Aaron Hackworth, Matthew K. Geiger, Kevin R. Moore, Timothy M. Vidas
Life of this patent
Estimating the term…
Abstract
A system for collection and analysis of forensic and event data comprising a server and an endpoint agent operating on a remote system. The server is configured to receive event data including process creation data, persistent process data, thread injection data, network connection data, memory pattern data, or any combination thereof, and analyze the event data to detect compromises of a remote system. The endpoint agent is configured to acquire event data, and communicate the event data to the server.
Claims19
A method of monitoring an information handling system, comprising:
- inspecting a persistence location to identify a persistent entry of an executable, the persistent entry causing the executable to be launched automatically when the information handling system boots, when a user logs in, or when a trigger event occurs;
- identifying a change in or addition of the persistent entry;
- determining if the persistent entry changes when or how the executable is triggered;
- and
- when the persistent entry is not a change in when or how a previously logged executable is triggered:
- logging the persistent entry of the executable;
- evaluating the executable based on a set of rules;
- determining the executable is malicious or compromised;
- and
- removing the persistent entry when the executable is determined to be malicious or compromised.
An endpoint agent for monitoring persistent locations for malicious activity, comprising:
- a memory containing a set of instructions for a communications engine configured to:
- receive a set of rules from a cloud service;
- and
- send information about an executable with a new persistence entry to the cloud service;
- and
- a persistence process monitor configured to:
- identify the new persistence entry;
- determine the executable launched by the new persistence entry;
- determine if the new persistence entry changes when or how the executable is triggered;
- and
- when the new persistence entry is not a change in when or how a previously logged executable is triggered:
- log the new persistence entry and the executable;
- compare the executable to the set of rules;
- determine if the new persistence entry is allowable based on the comparison of the executable to the set of rules;
- and
- remove the new persistence entry if the new persistence entry is not allowable;
- and
- a processor for executing the instructions.
A non-transitory computer-readable medium including code that when executed by a processor causes the processor to perform a method, the method comprising:
- inspecting a persistence location to identify a persistent entry for an executable, the persistent entry causing the executable to be launched automatically when an information handling system boots, when a user logs in, or when a trigger event occurs;
- identifying a change in or addition of the persistent entry;
- determining if the persistent entry changes when or how the executable is triggered;
- and
- when the persistent entry is not a change in when or how a previously logged executable is triggered:
- logging the persistent entry of the executable;
- evaluating the executable based on a set of rules;
- determining the executable is malicious or compromised by evaluating a behavior of the executable against known and general malware behavior patterns;
- and
- removing the persistent entry when the executable is determined to be malicious or compromised.
Dependencies are inferred from the claim text.