Preventing EDR termination using vulnerable drivers
Methods, storage systems and computer program products implement embodiments of the present invention that include deploying, in a memory used by an operating system kernel of a computer, a hooked version of a syscall that is configured to modify an execution status of processes executing on the computer. Subsequent to one or more protected processes being specified, a notification of a call to the syscall from the hooked version of the syscall is received, the call requesting to change the execution status of a given process executing on the computer. Finally, upon ascertaining that the given process is one of the protected processes, execution of the syscall is inhibited.
1 . A method for protecting a computer, comprising:
deploying, in a memory of the computer and used by an operating system kernel of the computer, a hooked version of a syscall that is configured to modify an execution status of processes executing on the computer;
specifying one or more protected processes belonging to a security software application executing on the computer;
receiving, from the hooked version of the syscall, a notification of a call to the syscall requesting to change the execution status of a given process executing on the computer by terminating execution of the given process, wherein the hooked version of the syscall comprises injected program instructions configured to generate the notification in response to the call to the syscall; and
in response to receiving the notification and upon ascertaining that the given process is one of the protected processes, i) inhibiting execution of the hooked version of the syscall, ii) identifying a given driver that conveyed the call to the syscall, identifying a first process that loaded the given driver to the memory, and identifying a second process that instructed the given driver to call the syscall to terminate the execution of the given process, and iii) inhibiting execution of the identified given driver, the identified first process, and the identified second process.
2 . The method according to claim 1 , wherein deploying the hooked version of the syscall comprises injecting, into the syscall, program instructions that are configured to convey the notification in response to the call to the syscall.
3 . The method according to claim 1 , wherein the syscall is configured to modify an execution status of a given process by terminating execution of the given process.
4 . The method according to claim 3 , wherein the given process comprises one or more threads, and wherein the syscall is configured to modify an execution status of a given process by terminating execution of a given thread.
5 . The method according to claim 1 , wherein the syscall is configured to modify an execution status of a given process by suspending execution of the given process.
6 . The method according to claim 3 , wherein the given process comprises one or more threads, and wherein the syscall is configured to modify an execution status of a given process by suspending execution of a given thread.
7 . The method according to claim 1 , wherein the syscall is configured to modify an execution status of a given process by closing a handle of the given process.
8 . The method according to claim 1 , wherein the syscall is configured to manipulate a registry key for a software application executing on the computer.
9 . The method according to claim 8 , wherein the software application comprises a security software application.
10 . The method according to claim 1 , further comprising inhibiting execution of the identified driver.
11 . The method according to claim 10 , wherein the memory comprises multiple drivers comprising respective load dates, and wherein identifying the given driver comprises identifying that the given driver has a most recent load date.
12 . The method according to claim 10 , and further comprising identifying a given process that loaded the driver to the memory, and inhibiting execution of the identified process.
13 . The method according to claim 10 , wherein the given driver called the syscall in response to a request the given driver received from a given process, and further comprising identifying the given process, and inhibiting execution of the given process.
14 . The method according to claim 1 , wherein the steps of deploying, specifying, receiving, ascertaining and inhibiting are performed by an endpoint agent executing on the computer.
15 . The method according to claim 1 , wherein the specified process belongs to a security software application executing on the computer.
16 . The method according to claim 15 , wherein the security software comprises an endpoint agent.
17 . A computer, comprising:
a memory; and
a processor configured:
to deploy, in the memory used by an operating system kernel of the computer, a hooked version of a syscall that is configured to modify an execution status of processes executing on the computer,
to specify one or more protected processes belonging to a security software application executing on the computer,
to receive, from the hooked version of the syscall, a notification of a call to the syscall requesting to change the execution status of a given process executing on the computer by terminating execution of the given process, wherein the hooked version of the syscall comprises injected program instructions configured to generate the notification in response to the call to the syscall, and
in response to receiving the notification and upon ascertaining that the given process is one of the protected processes, to i) inhibit execution of the hooked version of the syscall, ii) identify a given driver that conveyed the call to the syscall, identify a first process that loaded the given driver to the memory, and identify a second process that instructed the given driver to call the syscall to terminate the execution of the given process, and iii) inhibit execution of the identified given driver, the identified first process, and the identified second process.
18 . A computer software product for protecting a computer, the computer software product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by the computer, cause the computer:
to deploy, in a memory of the computer and used by an operating system kernel of the computer, a hooked version of a syscall that is configured to modify an execution status of processes executing on the computer;
to specify one or more protected processes belonging to a security software application executing on the computer;
to receive, from the hooked version of the syscall, a notification of a call to the syscall requesting to change the execution status of a given process executing on the computer by terminating execution of the given process, wherein the hooked version of the syscall comprises injected program instructions configured to generate the notification in response to the call to the syscall; and
in response to receiving the notification and upon ascertaining that the given process is one of the protected processes, to i) inhibit execution of the hooked version of the syscall, ii) identify a given driver that conveyed the call to the syscall, identify a first process that loaded the given driver to the memory, and identify a second process that instructed the given driver to call the syscall to terminate the execution of the given process, and iii) inhibit execution of the identified given driver, the identified first process, and the identified second process.