Detection of malicious thread suspension
View Patent ↗In an example, there is disclosed a computing apparatus having one or more logic elements providing a security agent operable for: detecting that a first process has launch a second process and placed the second process in a suspended state; detecting that the first process has modified or attempted to modify the second process; classifying the modification as potentially malicious; and taking a remedial action. There is also disclosed one or more computer-readable storage mediums having stored thereon executable instructions for providing the security agent, and a computer-executable method of providing the security agent.
1. A computing apparatus, comprising:
a processor;
a memory; and
one or more logic elements comprising a security agent configured to:
first detect that a first process has launched a second process and placed the second process in a suspended state, comprising identifying a create-suspended flag, and further comprising detecting that no “resume” instruction has been issued for the process;
second detect that after placing the second process in the suspended state, the first process has modified or attempted to modify the second process, comprising detecting that the first process has modified an import address table;
classify the first process as potentially malicious, based at least in part on the first detecting in combination with the second detecting; and
take a remedial action.
2. The computing apparatus of claim 1 , wherein the security agent is further configured to classify the modification as non-malicious, and permitting the first process to execute.
3. The computing apparatus of claim 1 , wherein detecting that the first process has placed the second process in a suspended state comprises detecting that a number-of-threads counter has been set to zero.
4. The computing apparatus of claim 1 , wherein detecting that the first process has placed the second process in a suspended state comprises inserting operating system hooks.
5. The computing apparatus of claim 1 , wherein detecting that the first process has placed the second process in a suspended state comprises inserting application-level hooks.
6. The computing apparatus of claim 1 , wherein classifying the first process as potentially malicious comprises determining that the first process has overwritten an entry point of the second process.
7. The computing apparatus of claim 1 , wherein classifying the first process as potentially malicious comprises detecting that the first process has introduced a jump or branching instruction at or near an entry point of the second process.
8. The computing apparatus of claim 1 , wherein classifying the first process as potentially malicious comprises detecting that the first process has created a remote thread on the second process.
9. The computing apparatus of claim 1 , wherein classifying the first process as potentially malicious comprises providing an operating system or user-mode hook.
10. The computing apparatus of claim 1 , wherein classifying the first process as potentially malicious comprises detecting that the first process has launched a plurality of processes that together effect a modification to the second process.
11. One or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions for providing a security engine configured to:
first detecting that a first process has launched a second process and placed the second process in a suspended state, comprising identifying a create-suspended flag, and further comprising detecting that no “resume” instruction has been issued for the process;
second detecting that after placing the second process in the suspended state, the first process has modified or attempted to modify the second process, comprising detecting that the first process has modified an import address table;
classifying the first process as potentially malicious, based at least in part on the first detecting in combination with the second detecting; and
taking a remedial action.
12. The one or more tangible, non-transitory computer-readable storage mediums of claim 11 , wherein detecting that the first process has placed the second process in a suspended state comprises detecting that a number-of-threads counter has been set to zero.
13. The one or more tangible, non-transitory computer-readable storage mediums of claim 11 , wherein detecting that the first process has placed the second process in a suspended state comprises inserting operating system hooks.
14. The one or more tangible, non-transitory computer-readable storage mediums of claim 11 , wherein detecting that the first process has placed the second process in a suspended state comprises inserting application-level hooks.
15. The one or more tangible, non-transitory computer-readable storage mediums of claim 11 , wherein classifying the first process as potentially malicious comprises determining that the first process has overwritten an entry point of the second process.
16. The one or more tangible, non-transitory computer-readable storage mediums of claim 11 , wherein classifying the first process as potentially malicious comprises detecting that the first process has introduced a jump or branching instruction at or near an entry point of the second process.
17. The one or more tangible, non-transitory computer-readable storage mediums of claim 11 , wherein classifying the first process as potentially malicious comprises detecting that the first process has created a remote thread on the second process.
18. A computer-executable method of providing a security agent, comprising:
first detecting that a first process has launched a second process and placed the second process in a suspended state, comprising identifying a create-suspended flag, and further comprising detecting that no “resume” instruction has been issued for the process;
second detecting that after placing the second process in the suspended state, the first process has modified or attempted to modify the second process, comprising detecting that the first process has modified an import address table;
classifying the first process as potentially malicious, based at least in part on the first detecting in combination with the second detecting; and
taking a remedial action.