Suspension and characterization of running processes for countering ransomware
Ransomware attacks on computing devices can be thwarted by monitoring runtime execution data associated with processes on a device through an agent. When the agent determines, based on this data, that a process is likely associated with ransomware or other malicious activity—such as by detecting system-call events indicative of file-system encryption or authentication anomalies—it can suspend the process by issuing a kernel-mode thread suspension request that atomically halts all threads. Information about the process can be packaged and later utilized to thwart current and future malicious activity.
1 . A method for implementation by one or more data processors comprising:
monitoring, by an agent executing on a monitored computing device, runtime execution data associated with a process;
determining, based on the runtime execution data, that the process is associated with a ransomware attack, the determining that the process is associated with a ransomware attack comprising detecting a plurality of ransomware-indicative behavioral signals including two or more of: attempts to disable security services, privilege escalation attempts, deletion of backups or shadow copies, high-volume sequential file read/write operations, file renaming with suspicious extensions, or communications with external command-and-control servers;
suspending the process by issuing a kernel-mode thread suspension request that atomically halts all threads of the process while preserving in-memory cryptographic key material;
determining resources used by the process prior to suspension, including enumerating at least memory pages and active network sockets associated with the process; and
creating a package characterizing the process and the determined resources used by the process, the package including a manifest of cryptographic hashes of the enumerated resources and a digital signature generated using a device-specific private key, the package being used to thwart future ransomware attacks.
2 . The method of claim 1 , wherein monitoring the runtime execution data comprises intercepting system-call events indicative of file-system encryption behavior.
3 . The method of claim 1 , wherein suspending the process comprises issuing a kernel-mode thread suspension request that atomically halts all threads of the process.
4 . The method of claim 1 , wherein determining resources comprises enumerating at least one of: memory pages, loaded executable modules, open file handles, registry keys, named pipes, mutexes, and active network sockets associated with the process.
5 . The method of claim 1 , wherein creating the package further comprises computing a cryptographic hash of each enumerated resource and embedding the hashes within a manifest of the package.
6 . The method of claim 1 , further comprising digitally signing the package with a device-specific private key to enable subsequent integrity verification.
7 . The method of claim 1 , further comprising transmitting the package to a remote analysis service over a mutually authenticated secure channel established using mutual Transport Layer Security with client certificate validation.
8 . The method of claim 7 , further comprising, at the remote analysis service, reconstructing an in-memory image of the suspended process from the package and automatically extracting cryptographic keys used by the ransomware attack.
9 . The method of claim 8 , further comprising disseminating the extracted cryptographic keys to a plurality of additional computing devices to decrypt data encrypted by the ransomware attack, wherein disseminating comprises transmitting a surveyor package containing decryptor logic specific to the identified ransomware variant to each of the plurality of additional computing devices over respective mutually authenticated secure channels.
10 . The method of claim 1 , further comprising, after creating the package, terminating the suspended process to prevent continuation of the ransomware attack.
11 . The method of claim 1 , wherein creating the package further comprises compressing and encrypting the package using symmetric encryption with an AES-256 session key, the session key being wrapped by a public-key infrastructure certificate tied to a security operations center account using RSA-OAEP or ECIES key encapsulation.
12 . The method of claim 1 , wherein the package includes a replay script operable to recreate the process in a sandbox environment for behavioral analysis.
13 . The method of claim 1 , wherein determining that the process is associated with a ransomware attack comprises applying a machine-learning classifier trained on historical ransomware execution profiles.
14 . The method of claim 1 , further comprising updating a ransomware-detection model based on behavioral features extracted from the package, wherein updating the ransomware-detection model comprises retraining at least one machine-learning classifier using behavioral embeddings derived from API call sequences and memory access patterns captured in the package.
15 . The method of claim 1 , wherein the agent stores a reference to a temporal data-protection journal such that, upon extraction of decryption keys from the package, encrypted files are rolled back to a pre-encryption state.
16 . A method for transactionally suspending and archiving a suspected ransomware process on a computing device, the method being implemented by one or more data processors and comprising:
monitoring runtime events associated with a process and, responsive to determining that the process exhibits behavior indicative of ransomware initiating a suspension protocol, the monitored runtime events including two or more of: attempts to disable security services, privilege escalation attempts, deletion of backups or shadow copies, high-volume sequential file read/write operations, file renaming with suspicious extensions, or communications with external command-and-control servers;
during the suspension protocol, issuing a kernel-mode request that atomically halts all threads of the process while preserving in-memory cryptographic key material;
prior to or contemporaneously with the suspension, storing, in a temporal data-protection journal, information sufficient to roll back file modifications associated with the process;
determining resources used by the process prior to suspension; and
creating a package that characterizes the process and the determined resources, the package including a manifest of cryptographic hashes of the resources and a digital signature and being usable to thwart ransomware activity.
17 . The method of claim 16 , wherein monitoring the runtime events comprises intercepting system-call events indicative of file-system encryption behavior and detecting authentication anomalies comprising at least one of failed login attempts exceeding a threshold count within a time window or logins from geographically anomalous locations.
18 . The method of claim 16 , wherein determining the resources comprises enumerating at least one of: memory pages, loaded executable modules, open file handles, registry keys, named pipes, mutexes, and active network sockets associated with the process.
19 . The method of claim 16 , wherein the package further comprises a replay script operable to recreate the process in a sandbox environment for behavioral analysis.
20 . The method of claim 16 , further comprising transmitting the package to a remote analysis service over a mutually authenticated secure channel established using mutual Transport Layer Security with client certificate validation and, at the remote analysis service, reconstructing an in-memory image of the suspended process from the package to automatically extract cryptographic keys used by the process.
21 . The method of claim 20 , further comprising disseminating the extracted cryptographic keys to additional computing devices to decrypt data encrypted by the process, wherein disseminating comprises transmitting a surveyor package containing decryptor logic specific to the identified ransomware variant to each of the additional computing devices over respective mutually authenticated secure channels, and instructing the computing device to terminate the suspended process.
22 . A method for coordinated ransomware response performed by a monitoring platform, the method being implemented by one or more data processors and comprising:
receiving telemetry from a plurality of computing devices, the telemetry including runtime execution data associated with processes;
deriving, based on the telemetry, a risk level indicating a likelihood that a particular process on a particular computing device is associated with a ransomware attack, wherein deriving the risk level comprises aggregating behavioral signals across the plurality of computing devices and applying a multi-factor scoring algorithm that weights at least process privilege level, cryptographic API invocation frequency, and network egress anomalies;
responsive to the risk level exceeding a threshold, transmitting a command to an agent on the particular computing device to suspend the particular process by issuing a kernel-mode thread suspension request that atomically halts all threads while preserving in-memory cryptographic key material, determine resources used by the process prior to suspension, and generate a package characterizing the process and the determined resources;
receiving the package from the particular computing device;
reconstructing, from the package, an in-memory image of the suspended process and automatically extracting cryptographic keys used by the ransomware attack; and
disseminating the extracted cryptographic keys to one or more computing devices to decrypt data encrypted by the ransomware attack, the disseminating comprising transmitting a surveyor package containing decryptor logic specific to the identified ransomware variant to each of the one or more computing devices.
23 . The method of claim 22 , wherein deriving the risk level comprises aggregating telemetry across the plurality of computing devices including at least one of: login timestamps, login failure counts, login locations, network folder access requests, network file enumeration requests, privileged process access requests, and modifications to system settings.
24 . The method of claim 22 , wherein the transmitted command further causes the agent to store a reference to a temporal data-protection journal such that, upon receipt of the disseminated cryptographic keys, encrypted files are rolled back to a pre-encryption state.
25 . The method of claim 22 , further comprising generating decryptor logic as a surveyor package and delivering the surveyor package to the agent to cause decryption of encrypted files on the particular computing device.
26 . The method of claim 22 , further comprising, responsive to the risk level exceeding the threshold, adjusting authentication techniques for at least one application, process, or computing device via an authentication platform, wherein adjusting authentication techniques comprises dynamically escalating from single-factor authentication to multi-factor authentication requiring at least a hardware token or biometric verification.
27 . The method of claim 22 , wherein reconstructing the in-memory image comprises rehydrating the process in a sandbox environment and executing a replay script included in the package.
28 . The method of claim 22 , wherein disseminating the extracted cryptographic keys to the one or more computing devices is performed over a mutually authenticated secure channel established using mutual Transport Layer Security with client certificate validation.
29 . The method of claim 22 , further comprising updating a ransomware-detection model based on behavioral features extracted from the package, wherein updating the ransomware-detection model comprises retraining at least one machine-learning classifier using behavioral embeddings derived from API call sequences and memory access patterns captured in the package, and transmitting an updated model to at least a subset of the plurality of computing devices.
30 . The method of claim 22 , further comprising, after dissemination of the extracted cryptographic keys or completion of decryption, transmitting an instruction to the agent on the particular computing device to terminate the suspended process.