System and method for reverse command shell detection

1. A method for tracking a reverse command shell intrusion on a user device, the method comprising:

detecting a process starting on the user device;

preparing the process to monitor Application Programming Interface (API) calls between the process and an operating system of the user device;

determining whether the process is associated with a reverse command shell intrusion based on information associated with the process and/or the API calls; and

executing security policies against the process associated with the reverse command shell intrusion;

wherein determining whether the process is associated with a reverse command shell intrusion based upon the information associated with the process and/or the API calls comprises:

determining whether the process is a command shell process and analyzing a parent process of the command shell process and determining a possible existence of a reverse shell intrusion in response to determining that the process is a command shell process and that the parent process of the command shell process is a command shell process, a user login process, or a desktop process; or

determining whether the process is a command shell process and analyzing a parent process of the command shell process, analyzing a connection of the parent process, and determining a possible existence of reverse shell intrusion in response to determining that the connection of the parent process has a connection to a network application located in a network that is remote; or

determining that the process is a command shell process and analyzing a parent process of the command shell process, detecting a readFile( ) API call, determining that a file descriptor of the readFile( ) API call matches a handle to a stdin stream of the command shell process, identifying commands passed by the parent process to the command shell process in the stdin stream of the command shell process, and concluding whether the process is a reverse command shell intrusion based on the commands; or

determining that the process is a command shell process and analyzing a parent process of the command shell process, detecting a readConsole( ) API call, determining based on the readConsole( ) API call that the parent process is reading from a stdin stream of the command shell process, identifying commands passed by the parent process to the command shell process in the stdin stream of the command shell process, and concluding whether the process is a reverse command shell intrusion based on the commands.

2. A user device including system memory and hardware components, the user device executing a system for tracking a reverse command shell intrusion on the user device, the system comprising:

an endpoint telemetry aggregation system that stores security policies for remediating processes executing on the user device that are associated with a reverse command shell intrusion; and

a security agent executing on the user device that:

prepares a process to monitor Application Programming Interface (API) calls between the process and an operating system of the user device;

receives information associated with the process and/or the API calls, sent from the process;

determines whether the process is associated with a reverse command shell intrusion based on the information associated with the process and/or the API calls;

requests the security policies from the endpoint telemetry aggregation system; and

executes the security policies against the process associated with the reverse command shell intrusion;

wherein the security agent determines whether the process is associated with a reverse command shell intrusion by:

determining whether the process is a command shell process and analyzing a parent process of the command shell process and determining a possible existence of a reverse shell intrusion in response to determining that the process is a command shell process and that the parent process of the command shell process is a command shell process, a user login process, or a desktop process; or

determining whether the process is a command shell process and analyzing a parent process of the command shell process, analyzing a connection of the parent process, and determining a possible existence of reverse shell intrusion in response to determining that the connection of the parent process has a connection to a network application located in a network that is remote; or

determining that the process is a command shell process and analyzing a parent process of the command shell process, detecting a readFile( ) API call, determining that a file descriptor of the readFile( ) API call matches a handle to a stdin stream of the command shell process, identifying commands passed by the parent process to the command shell process in the stdin stream of the command shell process, and concluding whether the process is a reverse command shell intrusion based on the commands; or

determining that the process is a command shell process and analyzing a parent process of the command shell process, detecting a readConsole( ) API call, determining based on the readConsole( ) API call that the parent process is reading from a stdin stream of the command shell process, identifying commands passed by the parent process to the command shell process in the stdin stream of the command shell process, and concluding whether the process is a reverse command shell intrusion based on the commands.

3. The user device of claim 2 , wherein the process associated with the reverse command shell intrusion is a command-line interpreter program that is native to the operating system of the user device, a script interpreter program, and/or a database application that takes Software Query Language (SQL) commands as input for accessing a database.