Systems and methods for delaying termination of a process to capture data relating to a potential threat
View Patent ↗A computer-implemented method for delaying termination of a process to capture data relating to a potential threat is described. A process that executes an event that indicates a threat is monitored. The event is allowed to execute on the process until a predetermined indicator is triggered. Data associated with the execution of the event is recorded when the predetermined indicator is triggered. The recorded data is transmitted to a processing system for analysis. The process is terminated from continuing to execute the event.
1. A computer-implemented method for delaying termination of a process to capture data relating to a potential threat, comprising:
monitoring a process that executes an event that indicates a threat;
allowing the event to execute on the process until a predetermined indicator is triggered;
recording data associated with the execution of the event when the predetermined indicator is triggered;
transmitting the recorded data to a processing system for analysis; and
terminating the process from continuing to execute the event.
2. The method of claim 1 , wherein the event comprises accessing an exploit uniform resource locator (URL) that includes a download URL.
3. The method of claim 2 , wherein the download URL is configured to download a file.
4. The method of claim 1 , wherein the event comprises accessing a message box that comprises a message requesting confirming input from a user.
5. The method of claim 4 , further comprising accessing an information requesting URL upon receiving the confirming input from the user.
6. The method of claim 5 , wherein the information requesting URL is configured to download an information requesting form.
7. The method of claim 6 , further comprising analyzing a pattern of data that is input to the information requesting form.
8. The method of claim 7 , further comprising terminating the process from continuing to execute the event if the patter of data matches a predetermined pattern of data.
9. The method of claim 1 , further comprising terminating the process when a file is downloaded.
10. The method of claim 1 , further comprising terminating the process if a call to a predetermined application programming interface (API) call is executed.
11. The method of claim 1 , further comprising terminating the process if a call to a predetermined API call sequence is executed.
12. A computing device configured to delay termination of a process to capture data relating to a potential threat, comprising:
a processor;
memory in electronic communication with the processor;
a monitoring module configured to:
monitor a process that executes an event that indicates a threat;
allow the event to execute on the process until a predetermined indicator is triggered;
record data associated with the execution of the event when the predetermined indicator is triggered;
terminate the process from continuing to execute the event; and
a reporting module configured to transmit the recorded data to a processing system for analysis.
13. The computing device of claim 12 , wherein the event comprises accessing an exploit uniform resource locator (URL) that includes a download URL.
14. The computing device of claim 13 , wherein the download URL is configured to download a file.
15. The computing device of claim 12 , wherein the event comprises accessing a message box that comprises a message requesting confirming input from a user.
16. The computing device of claim 15 , wherein the process is configured to access an information requesting URL upon receiving the confirming input from the user.
17. The computing device of claim 16 , wherein the information requesting URL is configured to download an information requesting form.
18. The computing device of claim 17 , wherein the monitoring module is further configured to analyze a pattern of data that is input to the information requesting form.
19. The computing device of claim 18 , wherein the monitoring module is further configured to terminate the process from continuing to execute the event if the pattern of data matches a predetermined pattern of data.
20. A computer-program product for delaying termination of a process to capture data relating to a potential threat, the computer-program product comprising a non-transitory computer-readable medium having instructions thereon, the instructions comprising:
code programmed to monitor a process that executes an event that indicates a threat;
code programmed to allow the event to execute on the process until a predetermined indicator is triggered;
code programmed to record data associated with the execution of the event when the predetermined indicator is triggered;
code programmed to transmit the recorded data to a processing system for analysis; and
code programmed to terminate the process from continuing to execute the event.