System and method for intercepting process creation events
View Patent ↗A system for detecting creation of a program instance includes an interceptor routine that obtains a parameter corresponding to a characteristic of a program instance and an interceptor module that can be injected into a native operating system process. In certain examples, the interceptor module can replace an address of a selected routine in an address table with an address to the interceptor routine, such that the native operating system process can call the interceptor routine in place of the selected routine. Additionally, the system can include a comparison module that compares the parameter to a set of identified programs to determine whether the program instance corresponds to at least one of the identified programs. The system can also include a security module that can modify execution of the program instance based at least in part on a determination that the program instance corresponds to at least one identified program.
1. A computer-implemented method of detecting creation of processes, the method comprising:
injecting an interceptor module into a native operating system process responsible for process creation;
said injecting comprising replacing, with the interceptor module, an address of a selected routine in an address table with an address to an interceptor routine of the interceptor module such that the native operating system process is configured to call the interceptor routine in place of the selected routine, wherein the address table is an import table of a software library configured to be linked into the native operating system process;
detecting, with the interceptor routine, creation of a new process by the native operating system process;
in response to said detecting creation of the new process, obtaining at least one parameter from the native operating system process using the interceptor routine, wherein the at least one parameter comprises a name of the new process;
analyzing the at least one parameter to determine whether the name of the new process corresponds to a program that is to be controlled based on a user-defined policy; and
controlling the new process in response to determining that the new process is to be controlled based on the user-defined policy, wherein said controlling comprises:
saving the at least one parameter,
causing the new process to terminate to thereby prevent the new process from executing, and
automatically creating, with a system account, a third process having the at least one parameter, thereby enabling the system account to receive full access rights to the third process instead of a user who started the new process having the full access rights, thereby preventing the user from being able to create a malicious child thread from the third process.
2. The method of claim 1 , wherein the native operating system process is a Client/Server Runtime Subsystem Service (csrss.exe) process in a Microsoft Windows® operating system.
3. The method of claim 1 , wherein the native operating system process is a Local Security Authority Subsystem Service (lsass.exe) process in a Microsoft Windows® operating system.
4. The method of claim 1 , wherein controlling the second process comprises creating a security token for the second process.
5. The method of claim 4 , wherein creating the security token for the second process comprises providing non-administrator access rights to the security token.
6. The method of claim 1 , wherein the address table is an import table of a software library configured to be linked into the native operating system process.
7. The method of claim 1 , wherein obtaining the at least one parameter comprises reading at least one routine parameter passed into the interceptor routine.
8. The method of claim 1 , wherein analyzing at least one parameter comprises comparing a name of the process to a whitelist of program names.
9. The method of claim 1 , wherein the interceptor module analyzes the at least one parameter.
10. The method of claim 1 , wherein the interceptor module controls the second process.
11. The method of claim 1 , further comprising receiving the user-defined policy from a management server remote to a computing device comprising the native operating system process and the interceptor module, the user-defined policy providing rules for controlling the new process.
12. The method of claim 1 , wherein the method is implemented by a computer system comprising computer hardware.
13. The method of claim 12 , wherein the computer system comprises a plurality of computing devices.
14. A system for detecting creation of a program instance, the system comprising:
a computer hardware within a computer system, the computer system configured to implement;
an interceptor module configured to be injected into a native operating system process responsible for creating program instances, the interceptor module further configured to replace an address of a selected routine in an address table with an address of an interceptor routine, such that the native operating system process calls the interceptor routine in place of the selected routine during creation of the program instance, the interceptor routine configured to detect creation of a program instance and to obtain a name of the program instance in response to detecting creation of the program instance;
a comparison module configured to compare the name of the program instance to a set of identified programs to determine whether the program instance corresponds to at least one of the identified programs; and
a security module configured to modify execution of the program instance based at least in part on a determination that the program instance corresponds to at least one of the identified programs, wherein the security module is configured to:
save the name of the program instance,
halt execution of the program instance, and
automatically create, with a system account, a new program instance having the name of the program instance, thereby enabling the system account to receive full access rights to the new program instance instead of a user who started the program instance having the full access rights, thereby preventing the user from being able to create a malicious child thread from the new program instance;
wherein the interceptor module, the comparison module, and the security module are implemented by the computer system comprising computer hardware.
15. The system of claim 14 , wherein the native operating system process is a Client/Server Runtime Subsystem Service (csrss.exe) process in a Microsoft Windows® operating system.
16. The system of claim 14 , wherein the native operating system process is a Local Security Authority Subsystem Service (lsass.exe) process in a Microsoft Windows® operating system.
17. The system of claim 14 , wherein the security module comprises the comparison module.
18. The system of claim 14 , wherein the interceptor module comprises the comparison module.
19. The system of claim 14 , wherein the security module is further configured to inject the interceptor module into the native operating system process.
20. The system of claim 14 , wherein the security module is further configured to create a security token for the program instance in response to determining that the program instance corresponds to at least one of the identified programs.
21. The system of claim 14 , wherein the interceptor module is further configured to:
store the address of the selected routine prior to replacing the address of the selected routine in the address table with the address of the interceptor routine; and
restore the address of the selected routine to the address table upon completion of the interceptor routine.
22. The system of claim 14 , further comprising a management server in network communication with a computing device executing the native operating system process, the management server further comprising policies providing rules for modifying execution of the program instance.
23. The system of claim 22 , wherein the security module is further configured to receive the policies from the management server.
24. Non-transitory physical computer storage comprising computer-executable instructions stored thereon that, when executed by one or more processors, are configured to implement components for detecting creation of a program instance, the components comprising:
an interceptor module configured to be injected into a native operating system process responsible for creating program instances, the interceptor module further configured to replace an address of a selected routine in an address table with an address of an interceptor routine, such that the native operating system process calls the interceptor routine in place of the selected routine during creation of the program instance, the interceptor routine configured to detect creation of a program instance and to obtain a name of the program instance in response to detecting creation of the program instance;
a comparison module configured to compare the name of the program instance to a set of identified programs to determine whether the program instance corresponds to at least one of the identified programs; and
a security module configured to modify execution of the program instance based at least in part on a determination that the program instance corresponds to at least one of the identified programs, wherein the security module is configured to:
save the name of the program instance,
halt execution of the program instance, and
automatically create, with a system account, a new program instance having the name of the program instance, thereby enabling the system account to receive full access rights to the new program instance instead of a user who started the program instance having the full access rights, thereby preventing the user from being able to create a malicious child thread from the new program instance.
25. The non-transitory physical computer storage of claim 24 , wherein the components further comprise a management server comprising functionality for a user to define a policy providing rules for execution of the program instance.
26. The non-transitory physical computer storage of claim 24 , wherein the security module is further configured to access the policy from the management server and perform said modification of the execution of the program instance based on the policy.
27. The non-transitory physical computer storage of claim 24 , in combination with a computer system comprising computer hardware.