Preventing execution of task scheduled malware
View Patent ↗A method for preventing malware attacks includes the steps of detecting an attempt on an electronic device to access a task scheduler, determining an entity associated with the attempt to access the task scheduler, determining a malware status of the entity, and, based on the malware status of the entity, allowing or denying the attempted access to the task scheduler. The task scheduler is configured to launch one or more applications at a specified time or interval.
1. A system for preventing malware attacks, comprising:
a processor;
a memory;
an anti-malware module including machine-readable instructions in the memory, the instructions, when read and executed by the processor, configure the anti-malware module to:
detect an attempt on an electronic device to access a task scheduler by determining information to be added to the task scheduler, the task scheduler to launch an application at a specified time;
determine an entity associated with the attempt to access the task scheduler based upon the information to be added to the task scheduler, including determining a network destination to be accessed as a result of adding the information to the task scheduler;
determine a malware status of the entity by determining a malware status of the network destination; and
based on the malware status of the entity, allow or deny the attempted access to the task scheduler.
2. The system of claim 1 , wherein the anti-malware module is further configured to determine the malware status of the entity further based upon changes to the task scheduler in the information to be added to the task scheduler.
3. The system of claim 1 , wherein the anti-malware module is further configured to determine the malware status of the entity further based upon behavior of information to be added to the task scheduler.
4. The system of claim 1 , wherein:
determining the entity associated with the attempt further includes:
identifying a process attempting to access the task scheduler; and
identifying a relationship between the process and the network destination; and
determining the malware status of the entity further includes independently determining the malware status of the process and the network destination.
5. The system of claim 1 , wherein the anti-malware module is further configured to:
determine that the network destination or the process is not malicious; and
deny the attempted access to the task scheduler.
6. The system of claim 1 , wherein determining the entity associated with the attempt further includes:
identifying a source of a process attempting to access the task scheduler; and
identifying a relationship between the source of the process and the network destination; and
determining the malware status of the entity further includes independently determining the malware status of the source of the process and the network destination.
7. The system of claim 1 , wherein the anti-malware module is further configured to:
determine that the network destination or the source of the process is not malicious; and
deny the attempted access to the task scheduler.
8. The system of claim 1 , wherein:
determining the entity associated with the attempt further includes:
identifying a destination file to be launched as a result of the attempt to access the task scheduler; and
identifying a relationship between the destination file to be launched as a result of the attempt to access the task scheduler and the network destination; and
determining the malware status of the entity further includes independently determining the malware status of the source of the destination file to be launched as a result of the attempt to access the task scheduler and the network destination.
9. The system of claim 1 , wherein the anti-malware module is further configured to:
determine that the network destination or the destination file to be launched as a result of the attempt to access the task scheduler is not malicious; and
deny the attempted access to the task scheduler.
10. The system of claim 1 , wherein:
the task scheduler is to launch one or more applications under a specified user profile;
the information to be added to the task scheduler job includes a designation of the specified user profile; and
determining the malware status of the entity is further based upon the designation of the specified user profile.
11. An article of manufacture, comprising:
a non-transitory computer readable medium; and
computer-executable instructions carried on the non-transitory computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
detect an attempt on an electronic device to access a task scheduler by determining information to be added to the task scheduler, the task scheduler to launch an application at a specified time;
determine an entity associated with the attempt to access the task scheduler based upon the information to be added to the task scheduler, including determining a network destination to be accessed as a result of adding the information to the task scheduler;
determine a malware status of the entity by determining a malware status of the network destination; and
based on the malware status of the entity, allow or deny the attempted access to the task scheduler.
12. The article of claim 11 , further comprising instructions for causing the processor to determine the malware status of the entity further based upon changes to the task scheduler in the information to be added to the task scheduler.
13. The article of claim 11 , further comprising instructions for causing the processor to determine the malware status of the entity further based upon behavior of information to be added to the task scheduler.
14. The article of claim 11 , wherein:
determining the entity associated with the attempt further includes:
identifying a process attempting to access the task scheduler; and
identifying a relationship between the process and the network destination; and
determining the malware status of the entity further includes independently determining the malware status of the process and the network destination.
15. The article of claim 11 , further comprising instructions for causing the processor to:
determine that the network destination or the process is not malicious; and
deny the attempted access to the task scheduler.
16. The article of claim 11 , wherein determining the entity associated with the attempt further includes:
identifying a source of a process attempting to access the task scheduler; and
identifying a relationship between the source of the process and the network destination; and
determining the malware status of the entity further includes independently determining the malware status of the source of the process and the network destination.
17. The article of claim 11 , further comprising instructions for causing the processor to:
determine that the network destination or the source of the process is not malicious; and
deny the attempted access to the task scheduler.
18. The article of claim 11 , wherein:
determining the entity associated with the attempt further includes:
identifying a destination file to be launched as a result of the attempt to access the task scheduler; and
identifying a relationship between the destination file to be launched as a result of the attempt to access the task scheduler and the network destination; and
determining the malware status of the entity further includes independently determining the malware status of the source of the destination file to be launched as a result of the attempt to access the task scheduler and the network destination.
19. The article of claim 11 , further comprising instructions for causing the processor to:
determine that the network destination or the destination file to be launched as a result of the attempt to access the task scheduler is not malicious; and
deny the attempted access to the task scheduler.
20. The article of claim 11 , further comprising instructions for causing the processor to determine the malware status of the entity is further based upon the designation of the specified user profile, wherein:
the task scheduler is to launch one or more applications under the specified user profile; and
the information to be added to the task scheduler job includes a designation of the specified user profile; and
determining the malware status of the entity is further based upon the designation of the specified user profile.