Hook-based technique for countering ransomware
An injected module (IM) is deployed in a process space executing on a computing device. The IM is then executed to inspect resources of the computing device and determine, based on the inspection of the resources, at least one hook to install in response to a ransomware attack. The process space then install the hook(s) to intercept calls within the process space. The hook(s) captures parameters characterizing techniques used in the ransomware attack. The process space reports at least a portion of the reported parameters to an anti-ransomware monitoring platform. An agent executed on the computing device can receive a decryption package from the anti-ransomware monitoring platform. This decryption package being responsive to the reported captured parameters. The agent can then decrypt one or more files in a computing environment associated with the computing device using the decryption package. Related apparatus, systems, techniques and articles are also described.
1 . A computer-implemented method comprising:
deploying, in a process space executing on a computing device, an injected module (IM) by mapping the IM into an address space of a monitored application process;
executing the IM to (i) inspect resources of the computing device by scanning memory blocks in the process space to identify code signatures of known modules or functions and (ii) determine, based on the inspection of the resources, at least one hook to install in response to a ransomware attack, the at least one hook being determined using rules which associate the identified code signatures of known modules or functions with a specific type of malware and selecting hook locations within an executable code section of a loaded module;
installing, by the process space, the determined at least one hook to intercept calls within the process space;
capturing, by the at least one hook, parameters characterizing techniques used in the ransomware attack including one or more of register values, stack values, handles, referenced memory blocks, or sizes of memory blocks associated with an intercepted call;
reporting, by the process space, at least a portion of the captured parameters to an anti-ransomware monitoring platform by transmitting the captured parameters via an intermediate driver to an agent that forwards the captured parameters to the anti-ransomware monitoring platform;
receiving, by an agent executing on the computing device from the anti-ransomware monitoring platform, a decryption package responsive to the reported captured parameters, the decryption package comprising decryptor logic generated based on key material included in the reported captured parameters; and
decrypting, by the agent, one or more files in a computing environment associated with the computing device using the decryption package by executing the decryption package as a standalone component run by the agent to extend functionality of the agent.
2 . The method of claim 1 further comprising:
causing, by the agent, the decrypted one or more files to be transported from the computing environment to a safe computing environment.
3 . The method of claim 1 , wherein the inspected resources comprise one or more cryptography libraries.
4 . The method of claim 1 , wherein the inspected resources comprise one or more data exfiltration and networking libraries.
5 . The method of claim 1 , wherein the determination of at least one hook to install is based on the captured parameters indicating calls to exported functions by way of a particular type of library.
6 . The method of claim 1 , wherein the determination of at least one hook to install is based on the captured parameters indicating calls to non-exported functions.
7 . The method of claim 6 , wherein the non-exported functions are of a known type.
8 . The method of claim 6 , wherein the non-exported functions are inline.
9 . The method of claim 1 , wherein the determination of at least one hook to install is based on a policy.
10 . The method of claim 9 , wherein the policy specifies which hook to install in response to a particular type of ransomware attack and actions for the hook to undertake.
11 . The method of claim 10 , wherein the actions for the hook to undertake include one or more of: reporting requested parameters to the process space, changing control or parameters of a pre-installed hook, returning an error to a caller, or taking no action.
12 . The method of claim 9 further comprising:
bypassing scanning of executable modules identified as excluded by the policy.
13 . The method of claim 9 further comprising:
registering, by the IM, a module load notification configured to scan new executable modules upon loading pursuant to the policy.
14 . The method of claim 13 further comprising:
determining, as part of the scanning, a confidence level for hook locations in the new executable modules upon loading.
15 . The method of claim 13 further comprising:
identifying, as part of the scanning and by the IM, a function entry point or code signature in one of the new executables.
16 . The method of claim 15 further comprising:
determining, by the IM, the policy for one of the new executable modules based on the identified function entry point or code signature.
17 . The method of claim 16 further comprising:
notifying, by the IM, the at least one hook that a function entry point or code signature was discovered.
18 . The method of claim 17 further comprising:
mapping information associated with the notification into the hook.
19 . The method of claim 18 , wherein the mapped information comprises one or more of location specific information, policy, calls required by the hook, and addresses of hooked functions.
20 . The method of claim 1 , wherein the ransomware monitoring platform is executing on a server remote from the computing device or is executing on the computing device.
21 . The method of claim 1 , wherein the computing environment associated with the computing device is the computing device.
22 . The method of claim 1 , wherein the computing environment associated with the computing device is a second, different computing device.
23 . The method of claim 1 , wherein the process space communicates with the agent by way of an intermediate driver.
24 . A system comprising:
at least one data processor; and
memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
deploying, in a process space executing on a computing device, an injected module (IM) by mapping the IM into an address space of a monitored application process;
executing the IM to (i) inspect resources of the computing device by scanning memory blocks in the process space to identify code signatures of known modules or functions and (ii) determine, based on the inspection of the resources, at least one hook to install in response to a ransomware attack, the at least one hook being determined using rules which associate the identified code signatures of known modules or functions with a specific type of malware and selecting hook locations within an executable code section of a loaded module;
installing, by the process space, the determined at least one hook to intercept calls within the process space;
capturing, by the at least one hook, parameters characterizing techniques used in the ransomware attack including one or more of register values, stack values, handles, referenced memory blocks, or sizes of memory blocks associated with an intercepted call;
reporting, by the process space, at least a portion of the captured parameters to an anti-ransomware monitoring platform by transmitting the captured parameters via an intermediate driver to an agent that forwards the captured parameters to the anti-ransomware monitoring platform;
receiving, by an agent executing on the computing device from the anti-ransomware monitoring platform, a decryption package responsive to the reported captured parameters, the decryption package comprising decryptor logic generated based on key material included in the reported captured parameters; and
decrypting, by the agent, one or more files in a computing environment associated with the computing device using the decryption package by executing the decryption package as a standalone component run by the agent to extend functionality of the agent.
25 . The system of claim 24 , wherein the inspected resources comprise one or more cryptography libraries and one or more data exfiltration and networking libraries.
26 . The system of claim 24 , wherein the determination of at least one hook to install is based on a policy that specifies which hook to install in response to a particular type of ransomware attack and actions for the hook to undertake.
27 . The system of claim 24 , wherein the determination of at least one hook to install is based on a policy, the operations further comprising: bypassing scanning of executable modules identified as excluded by the policy; and registering, by the IM, a module load notification configured to scan new executable modules upon loading pursuant to the policy.
28 . The system of claim 24 , wherein the determination of at least one hook to install is based on a policy, the operations further comprising: registering, by the IM, a module load notification configured to scan new executable modules upon loading pursuant to the policy; identifying, as part of the scanning and by the IM, a function entry point or code signature in one of the new executables; and determining, by the IM, the policy for one of the new executable modules based on the identified function entry point or code signature.
29 . The system of claim 24 , wherein the anti-ransomware monitoring platform is executing on a server remote from the computing device or is executing on the computing device, the computing environment associated with the computing device is a second, different computing device, and the operations further comprise causing, by the agent, the decrypted one or more files to be transported from the computing environment to a safe computing environment.
30 . A system comprising:
means for deploying, in a process space executing on a computing device, an injected module (IM) by mapping the IM into an address space of a monitored application process;
means for executing the IM to (i) inspect resources of the computing device by scanning memory blocks in the process space to identify code signatures of known modules or functions and (ii) determine, based on the inspection of the resources, at least one hook to install in response to a ransomware attack, the at least one hook being determined using rules which associate the identified code signatures of known modules or functions with a specific type of malware and selecting hook locations within an executable code section of a loaded module;
means for installing, by the process space, the determined at least one hook to intercept calls within the process space;
means for capturing, by the at least one hook, parameters characterizing techniques used in the ransomware attack including one or more of register values, stack values, handles, referenced memory blocks, or sizes of memory blocks associated with an intercepted call;
means for reporting, by the process space, at least a portion of the captured parameters to an anti-ransomware monitoring platform by transmitting the captured parameters via an intermediate driver to an agent that forwards the captured parameters to the anti-ransomware monitoring platform;
means for receiving, by an agent executing on the computing device from the anti-ransomware monitoring platform, a decryption package responsive to the reported captured parameters, the decryption package comprising decryptor logic generated based on key material included in the reported captured parameters; and
means for decrypting, by the agent, one or more files in a computing environment associated with the computing device using the decryption package by executing the decryption package as a standalone component run by the agent to extend functionality of the agent.