Tracing system operations across remote procedure linkages to identify request originators

1. A computing device comprising:

one or more processors; and

a security agent configured to be operated by the one or more processors to perform operations including:

receiving one or more event notifications respectively associated with one or more kernel-mode events;

determining, based on the one or more event notifications, that the one or more kernel-mode events are associated with user-mode processing by a remote-procedure-call-utilizing (RPC-utilizing) process of a request message;

retrieving the request message based on information included in one or more remote procedure call (RPC) data structures and based on the one or more event notifications, wherein the retrieving includes:

determining a thread environment block (TEB) of a worker thread that is associated with the user-mode processing by the RPC-utilizing process of the request message, and

tracing from the TEB to the request message through an RPC-specific field of an operating system (OS) data structure; and

identifying an originator of the request message based on metadata of the request message.

2. The computing device of claim 1 , wherein the security agent includes an engine configured to perform the retrieving and the identifying and an engine plug-in for each type of request message.

3. The computing device of claim 2 , wherein the security agent includes a correlation mechanism to accumulate event notification(s) of the one or more event notifications and to alert the engine when the one or more event notifications have all been received.

4. A method implemented by a security agent on a computing device, the method comprising:

receiving one or more event notifications respectively associated with one or more kernel-mode events;

determining, based on the one or more event notifications, that the one or more kernel-mode events are associated with user-mode processing by a remote-procedure-call-utilizing (RPC-utilizing) process of a request message;

retrieving the request message based on information included in one or more remote procedure call (RPC) data structures and based on the one or more event notifications; and

identifying an originator of the request message based on metadata of the request message.

5. The method of claim 4 , wherein the one or more kernel-mode events include at least one of process creation, thread creation, writing to a registry, reading from the registry, creating a file, opening a file, reading a file, writing a file, or mapping a file, sending or receiving a network packet, creating or opening a handle to an object, or performing registry operations.

6. The method of claim 4 , wherein the determining is based at least in part on a configuration of the security agent.

7. The method of claim 4 , wherein the request message is a domain name service query, a request to print a document, a request to change a firewall setting, or a request to create a new account.

8. The method of claim 4 , wherein the determining further comprises comparing A) information included a kernel-mode request message associated with one of the one or more kernel-mode events or B) state information retained by the security agent and/or the OS to expected information to prevent false positives.

9. The method of claim 4 , wherein the retrieving comprises:

determining a thread environment block (TEB) of a worker thread that is associated with the user-mode processing by the RPC-utilizing process of the request message, and

tracing from the TEB to the request message through an RPC-specific field of an operating system (OS) data structure,

wherein the RPC data structures include the TEB and the RPC-specific field.

10. The method of claim 9 , wherein the tracing comprises:

retrieving the request message from the RPC-specific field.

11. The method of claim 4 , wherein the request message is received by the RPC-utilizing process from a command shell, and the method further comprises repeating the retrieving and identifying until the originator is identified.

12. The method of claim 4 , wherein the retrieving comprises:

retrieving an intermediate request message based on information included in the RPC data structures and based on the one or more event notifications;

determining that an originator of the intermediate request message is an intermediate thread invoked by another thread of a same process;

retrieving the request message based on information included in additional one or more RPC data structures associated with the other thread.

13. The method of claim 4 , wherein the identifying includes determining a named pipe, a socket address, or an advanced local procedure call (ALPC) port or connection associated with the request message and utilizing the named pipe, the socket address, or the ALPC port or connection to retrieve a process identifier of the originator, a thread identifier of the originator, a remote client computer name or IP address of the originator, or any combination of the process identifier, the thread identifier, and/or the remote client computer name or IP address.

14. The method of claim 4 , wherein the identifying includes determining a named pipe or ALPC port or connection associated with the request message and utilizing the named pipe or the ALPC port or connection to retrieve an identifier of the originator from a kernel-mode copy of metadata of the request message.

15. The method of claim 4 , further comprising determining whether originator is local or remote based on the metadata of the request message.

16. The method of claim 4 , further comprising demarshalling a payload of the request message to retrieve one or more parameters.

17. The method of claim 4 , further comprising halting processing of the request message by the RPC-utilizing process or stopping execution of the originator or a process associated with the originator.

18. The method of claim 4 , further comprising taking action to mislead the originator.

19. A non-transitory computer-readable medium having executable instructions implementing a security agent stored thereon that, when executed by a computing device, perform operations comprising:

receiving one or more event notifications respectively associated with one or more kernel-mode events;

determining, based on the one or more event notifications, that the one or more kernel-mode events are associated with user-mode processing by a remote-procedure-call-utilizing (RPC-utilizing) process of a request message;

retrieving the request message based on information included in one or more remote procedure call (RPC) data structures and based on the one or more event notifications; and

identifying an originator of the request message, wherein the identifying includes utilizing a named pipe or an advanced local procedure call (ALPC) port or connection associated with the request message to retrieve an identifier of the originator from a kernel-mode copy of metadata of the request message.

20. The non-transitory computer-readable medium of claim 19 , further comprising retrieving a payload of the request message from the kernel-mode copy of the request message.

21. The non-transitory computer-readable medium of claim 19 , wherein the retrieving comprises:

determining a thread environment block (TEB) of a worker thread that is associated with the user-mode processing by the RPC-utilizing process of the request message, and

tracing from the TEB to the request message through an RPC-specific field of an operating system (OS) data structure,

wherein the RPC data structures include the TEB and the RPC-specific field.