Network containment of compromised machines

1. A method comprising:

installing a kernel-level security agent on a computing device with a firewall policy, but refraining from implementing the firewall policy until an instruction to contain the computing device is received;

observing events associated with activity on the computing device;

sending the events, over a computer network, to a remote security system;

receiving, over the computer network and from the remote security system, the instruction to contain the computing device;

executing instructions to load a user-mode component in user mode of the computing device;

providing the firewall policy to the user-mode component;

using the user-mode component to invoke an application programming interface (API) to implement the firewall policy; and

implementing the firewall policy in kernel mode of the computing device based at least in part on the API invoked using the user-mode component, wherein the firewall policy, upon enforcement, denies outgoing data packets from, and incoming data packets to, the computing device that would have been allowed prior to the implementing of the firewall policy.

2. The method of claim 1 , wherein the firewall policy specifies:

at least one remote network address associated with the remote security system; and

an action to allow outgoing data packets to, and incoming data packets from, the remote security system associated with the at least one remote network address.

3. The method of claim 2 , wherein denying the outgoing data packets and the incoming data packets comprises denying all outgoing data packets and all incoming data packets except the outgoing data packets to, and the incoming data packets from, the remote security system associated with the at least one remote network address.

4. The method of claim 2 , further comprising, after the implementing of the firewall policy:

receiving, over the computer network and from the remote security system, a new version of the kernel-level security agent; and

installing the kernel-level security agent on the computing device.

5. The method of claim 2 , further comprising, after the implementing of the firewall policy:

receiving, over the computer network and from the remote security system, an instruction to perform a remediation action to counter malicious code associated with the events; and performing the remediation action.

6. The method of claim 1 , further comprising:

receiving, over the computer network and from the remote security system, a whitelist including one or more remote network addresses;

dynamically updating the firewall policy to specify:

the one or more remote network addresses; and

an action to allow outgoing data packets to, and incoming data packets from, one or more computer systems associated with the one or more remote network addresses.

7. A computing device comprising:

one or more processors; and

memory storing computer-executable instructions configured to be executed by the one or more processors to install a kernel-level security agent on the computing device with a firewall policy, but refrain from implementing the firewall policy until an instruction to contain the computing device is received, the kernel-level security agent configured to be executed by the one or more processors to:

observe events associated with activity on the computing device;

send the events, over a computer network, to a remote security system;

receive, over the computer network and from the remote security system, the instruction to contain the computing device;

execute instructions to load a user-mode component in user mode of the computing device;

provide the firewall policy to the user-mode component;

use the user-mode component to invoke an application programming interface (API) to implement the firewall policy; and

implement the firewall policy in kernel mode of the computing device based at least in part on the API invoked using the user-mode component, wherein the firewall policy, upon enforcement, denies outgoing data packets from, and incoming data packets to, the computing device that would have been allowed prior to the implementing of the firewall policy.

8. The computing device of claim 7 , wherein the firewall policy specifies:

at least one remote network address associated with the remote security system; and

an action to allow outgoing data packets to, and incoming data packets from, the remote security system associated with the at least one remote network address.

9. The computing device of claim 8 , wherein denying the outgoing data packets and the incoming data packets comprises denying all outgoing data packets and all incoming data packets except the outgoing data packets to, and the incoming data packets from, the remote security system associated with the at least one remote network address.

10. The computing device of claim 8 , wherein the kernel-level security agent is further configured to be executed by the one or more processors to, after implementing the firewall policy:

receive, over the computer network and from the remote security system, an instruction to perform a remediation action to counter malicious code associated with the events; and perform the remediation action.

11. The computing device of claim 7 , wherein the kernel-level security agent is further configured to be executed by the one or more processors to:

receive, over the computer network and from the remote security system, a whitelist including one or more remote network addresses; and

dynamically update the firewall policy to specify:

the one or more remote network addresses; and

an action to allow outgoing data packets to, and incoming data packets from, one or more computer systems associated with the one or more remote network addresses.

12. The computing device of claim 7 , wherein the kernel-level security agent is further configured to be executed by the one or more processors to, after implementing the firewall policy:

send, over the computer network, a current containment status to the remote security system.

13. The computing device of claim 7 , further comprising a display, wherein the kernel-level security agent is further configured to be executed by the one or more processors to, after implementing the firewall policy:

receive, over the computer network and from the remote security system, a notification that the computing device has been contained; and

display the notification on the display of the computing device, the notification including contact information of support personnel.

14. The computing device of claim 7 , wherein the kernel-level security agent is further configured to be executed by the one or more processors to, after implementing the firewall policy:

receive, over the computer network and from the remote security system, an instruction to deactivate containment of the computing device; and

cease the enforcement of the firewall policy on the computing device to allow the outgoing data packets and the incoming data packets.

15. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors of a computing device, cause the computing device to install a kernel-level security agent on the computing device with a firewall policy, but refrain from implementing the firewall policy until an instruction to contain the computing device is received, wherein the kernel-level security agent, when executed by the one or more processors, causes the computing device to perform operations comprising:

observing events associated with activity on the computing device;

sending the events, over a computer network, to a remote security system;

receiving, over the computer network and from the remote security system, the instruction to contain the computing device;

executing instructions to load a user-mode component in user mode of the computing device;

providing the firewall policy to the user-mode component;

using the user-mode component to call an application programming interface (API) to implement the firewall policy; and

implementing the firewall policy in kernel mode of the computing device based at least in part on the API called by the user-mode component, wherein the firewall policy, upon enforcement, denies outgoing data packets from, and incoming data packets to, the computing device that would have been allowed prior to the implementing of the firewall policy.

16. The one or more non-transitory computer-readable media of claim 15 , the operations further comprising, after the implementing of the firewall policy:

sending, over the computer network, a current containment status to the remote security system.

17. The one or more non-transitory computer-readable media of claim 15 , the operations further comprising, after the implementing of the firewall policy:

receiving, over the computer network and from the remote security system, an instruction to deactivate containment of the computing device; and

ceasing the enforcement of the firewall policy on the computing device to allow the outgoing data packets and the incoming data packets.

18. The one or more non-transitory computer-readable media of claim 15 , wherein a kernel-mode component of the kernel-level security agent maintains a configuration of the kernel-level security agent, the configuration specifying the user-mode component.