System and method for operating malicious marker detection software on management controller of protected system
View Patent ↗An information handling system includes a processor and a management controller separate from the processor. The management controller is operable to store an anti-virus program and a malicious marker detection program in a memory of the management controller, and to execute the malicious marker detection program. The malicious marker detection program operates to detect a state of a device of the information handling system, determine that the information handling system is under attack from a malicious program in response to detecting the state of the device, and send an alert to a management system coupled to the information handling system, the alert indicating that the information handling system is under attack from the malicious program.
1. An information handling system, comprising:
a processor to provide a host processing environment; and
a management controller separate from the processor and on a common board with the processor, the management controller operable to:
store an anti-virus program and a malicious marker detection program in a memory of the management controller; and
execute the malicious marker detection program to:
detect a state of a device of the information handling system;
determine that the host processing environment is under attack from a malicious program in response to detecting the state of the device; and
send an alert to a management system coupled to the information handling system, the alert indicating that the host processing environment is under attack from the malicious program.
2. The information handling system of claim 1 , wherein in detecting the state of the device the malicious marker detection program is further executed to:
read a status register of the device.
3. The information handling system of claim 2 , wherein in determining that the host processing environment is under attack the malicious marker detection program is further executed to:
detect that the status register has been changed.
4. The information handling system of claim 1 , wherein in detecting the state of the device the malicious marker detection program is further executed to:
read a memory of the information handling system.
5. The information handling system of claim 1 , wherein in detecting the state of the device the malicious marker detection program is further executed to:
detect a network destination of network traffic on the information handling system.
6. The information handling system of claim 1 , wherein in detecting the state of the device the malicious marker detection program is further executed to:
detect a malicious packet in network traffic on the information handling system.
7. The information handling system of claim 1 , wherein:
the device comprises a network storage device; and
in detecting the state of the device the malicious marker detection program is further executed to read data from the storage device.
8. The information handling system of claim 1 , wherein the management controller is further operable to:
receive an update to the malicious marker detection program from the management system; and
store the update to the malicious marker detection program in the memory of the management controller.
9. The information handling system of claim 8 , wherein, prior to receiving the update to the malicious marker detection program, the management controller is further operable to:
determine that the malicious marker detection program is out of date.
10. The information handling system of claim 1 , wherein the malicious marker detection program is further executed to:
determine that the attack from the malicious program can be mitigated; and
mitigate the attack from the malicious program.
11. A method comprising:
storing an anti-virus program and a malicious marker detection program in a memory of a management controller on an information handling system; and
executing by the management controller the malicious marker detection program, wherein executing the malicious marker detection program comprises:
detecting a state of a device of the information handling system;
determining that a host processing environment instantiated on a processor of the information handling system is under attack from a malicious program in response to detecting the state of the device, wherein the management controller is on a common board with the processor; and
sending an alert to a management system coupled to the information handling system, the alert indicating that the host processing environment is under attack from the malicious program.
12. The method of claim 11 , wherein in detecting the state of the device the malicious marker detection program, executing the malicious marker detection program further comprises:
reading a status register of the device.
13. The method of claim 12 , wherein in determining that the host processing environment is under attack, executing the malicious marker detection program further comprises:
detecting that the status register has been changed.
14. The method of claim 11 , wherein in detecting the state of the device, executing the malicious marker detection program further comprises:
reading a memory of the information handling system.
15. The method of claim 11 , wherein:
the device comprises a network storage device; and
in detecting the state of the device, executing the malicious marker detection program further comprises reading data from the storage device.
16. The method of claim 11 , further comprising:
receiving by the management controller an update to the malicious marker detection program from the management system; and
storing the update to the malicious marker detection program in the memory of the management controller.
17. The method of claim 16 , further comprising:
determine that the malicious marker detection program is out of date, prior to receiving the update to the malicious marker detection program.
18. A non-transitory computer-readable medium including code for carrying out a method, the method comprising:
storing an anti-virus program and a malicious marker detection program in a memory of a management controller; and
executing the malicious marker detection program, wherein executing the malicious marker detection program comprises:
detecting a state of a device of an information handling system;
determining that a host processing environment instantiated on a processor of the information handling system is under attack from a malicious program in response to detecting the state of the device, wherein the management controller is on a common board with the processor; and
sending an alert to a management system coupled to the information handling system, the alert indicating that the host processing environment is under attack from the malicious program.
19. The computer-readable medium of claim 18 , wherein in detecting the state of the device the malicious marker detection program, executing the malicious marker detection program further comprises:
reading a status register of the device.
20. The computer-readable medium of claim 19 , wherein in determining that the host processing environment is under attack, executing the malicious marker detection program further comprises:
detecting that the status register has been changed.