Elevated security execution mode for network-accessible devices

1 . A computer-implemented method to automatically elevate security measures on a user device, the method comprising:

scanning a plurality of file storage locations on the user device to identify one or more files that include a code segment that is one or more of:

readable and writeable during execution,

marked for simultaneous read, write, and execute access,

has an association with a shared library of an operating system of the user device,

or combinations thereof:

responsive to identifying the one or more files, implementing one or more pre-execution flags in the identified one or more files;

monitoring a plurality of processes executing on the user device to identify a pre-execution flag associated with at least one process of the plurality of processes, wherein the at least one process is associated with a code segment included in the one or more files, and wherein the monitoring the plurality of processes comprises monitoring memory of the user device; and

responsive to identifying the pre-execution flag:

receiving an indication of a security threat to the user device, the indication of the security threat associated with the at least one process and a device threat type;

responsive to the receiving the indication of the security threat, elevating security measures associated with the user device for a first time period; and

after the elevating, automatically remediating the security threat on the user device within the first time period.

2 . The computer-implemented method of claim 1 , wherein the pre-execution flag indicates that the at least one process is associated with a code segment which is vulnerable to a code-injection threat.

3 . The computer-implemented method of claim 1 , further comprising determining that the device threat type associated with the security threat is a code-injection threat to the user device.

4 . The computer-implemented method of claim 3 , wherein the remediating the security threat on the user device comprises identifying injected code, and performing one or more of isolating, deleting, or remediating the injected code.

5 . The computer-implemented method of claim 1 , wherein the shared library is associated with library linking between programs executing on the user device.

6 . The computer-implemented method of claim 1 , wherein the shared library is a dynamic-linked library (DLL) file.

7 . The computer-implemented method of claim 1 , wherein the shared library is associated with memory sharing between programs executing on the operating system.

8 . The computer-implemented method of claim 1 , wherein the receiving the indication of the security threat comprises at least one of:

receiving the indication of the security threat on the user device from security software that executes on the user device; or

receiving the indication of the security threat on the user device from a remote device in operative communication with the user device over a network, the indication of the security threat based upon network activity from the user device detected by the remote device.

9 . The computer-implemented method of claim 1 , wherein the device threat type is automatically monitored by at least one of: security software that executes on the user device, or a remote device in operative communication with the user device over a network.

10 . The computer-implemented method of claim 1 , wherein the device threat type is a computer security threat associated with a plurality of known and unknown security threats to computer networks.

11 . The computer-implemented method of claim 1 , wherein the elevating security measures associated with the user device comprises configuring the user device to prevent at least one of:

network access from the user device during the first time period;

execution of untrusted software on the user device during the first time period;

creation of new user accounts on the user device during the first time period;

creation of a service in a safe mode on the user device; or

reboot of the user device into the safe mode during the first time period.

12 . The computer-implemented method of claim 1 , wherein the automatically remediating the security threat comprises:

configuring security software that executes on the user device to implement a remediation technique on the user device that remediates the security threat.

13 . The computer-implemented method of claim 1 , further comprising:

determining, after the elevating, that the device threat type for the user device is remediated; and

responsive to the determining that the device threat type is remediated, updating the device security measures associated with the user device to a normal security level, wherein the normal security level is associated with disabling one or more of the security measures implemented in the first time period.

14 . The computer-implemented method of claim 1 , further comprising:

determining, after expiration of the first time period, that the device threat type for the user device has not been remediated; and

responsive to the determining that the device threat type has not been remediated, maintaining the elevated security measures for a second time period.

15 . The computer-implemented method of claim 1 , wherein the receiving the indication of the security threat is based on security software that executes on the user device determining that at least one behavioral rule of a plurality of behavioral rules is satisfied, wherein the plurality of behavioral rules include rules to detect one or more hacking toolsets.

16 . A non-transitory computer-readable medium with instructions stored thereon that, responsive to execution by a processing device, causes the processing device to perform operations comprising:

scanning a plurality of file storage locations on a user device to identify one or more files that include a code segment that is one or more of:

readable and writeable during execution,

marked for simultaneous read, write, and execute access,

has an association with a shared library of an operating system of the user device,

or combinations thereof;

responsive to identifying the one or more files, implementing one or more pre-execution flags in the identified one or more files;

monitoring a plurality of processes executing on the user device to identify a pre-execution flag associated with at least one process, wherein the at least one process is associated with a code segment included in the one or more files, and wherein the monitoring the plurality of processes comprises monitoring memory of the user device; and

responsive to identifying the pre-execution flag:

receiving an indication of a security threat to the user device, the indication of the security threat associated with the at least one process and a device threat type;

responsive to the receiving the indication of the security threat, elevating security measures associated with the user device for a first time period; and

after the elevating, automatically remediating the security threat on the user device within the first time period.

17 . The non-transitory computer-readable medium of claim 16 , wherein the pre-execution flag indicates that:

the at least one process is associated with a code segment which is vulnerable to a code-injection threat.

18 . The non-transitory computer-readable medium of claim 16 , wherein the operations further comprise determining that the device threat type associated with the security threat is a code-injection threat to the user device.

19 . The non-transitory computer-readable medium of claim 18 , wherein the remediating the security threat on the user device comprises identifying injected code, and performing one or more of isolating, deleting, or remediating the injected code.

20 . A threat management computer system to manage active security threats on an enterprise network, comprising:

a memory with instructions stored thereon;

a processing device, coupled to the memory, the processing device configured to access the memory and execute the instructions; and

a network device coupled to the processing device and configured to receive indications of security threats from a plurality of user devices, wherein the instructions cause the processing device or the network device to perform operations including:

scanning a plurality of file storage locations on a user device to identify one or more files that include a code segment that is one or more of:

readable and writeable during execution,

marked for simultaneous read, write, and execute access,

has an association with a shared library of an operating system of the user device,

or combinations thereof;

responsive to identifying the one or more files, implementing one or more pre-execution flags in the identified one or more files;

monitoring a plurality of processes executing on the user device of the plurality of user devices to identify a pre-execution flag associated with at least one process, wherein the at least one process is associated with a code segment included in the one or more files, and wherein the monitoring the plurality of processes comprises monitoring memory of the user device; and

responsive to identifying the pre-execution flag:

receiving an indication of a security threat to the user device, the indication of the security threat associated with the at least one process and a device threat type;

responsive to the receiving the indication of the security threat, elevating security measures associated with the user device for a first time period; and

after the elevating, automatically remediating the security threat on the user device within the first time period.