Protecting computer systems used in virtualization environments against fileless malware
Techniques for protecting a computer system against fileless malware are described. One technique includes a virtual machine (VM) locker logic/module implemented by one or more processors receiving information about input/output (I/O) requests associated with injection of data into a process. The logic/module can generate or update an information log to reflect that the process includes data from an external source. The data from the external source can include fileless malware. The technique also includes the logic/module intercepting an execution request by a process (e.g., the process that includes data from an external source, another process, etc.), where an execute privilege located in an operating system mediated access control mechanism approves the request. Next, the logic/module determines that the process requesting execution is included in the log and removes an execute privilege located in a hypervisor mediated access control mechanism to deny the request. Other advantages and embodiments are described.
1. A machine readable storage device or storage disk comprising instructions to protect a computer system used in a virtualization environment against fileless malware, the instructions, when executed, cause the computer system to, at least:
receive, by a virtual machine (VM) locker implemented by one or more processors of the computer system, information including input/output (I/O) requests associated with injection of data from an external source into a running instance of a first process associated with a guest operating system (OS) of a VM implemented by the computer system, the injected data including shellcode, and a filter driver to monitor and intercept the I/O requests;
generate an information log corresponding to the injection of data, the log including (a) an indication that the first process includes the injected data from the external source, (b) an indication of memory regions corresponding to the first process and (c) corresponding sizes of the memory regions associated with the first process;
detect a change of an execute privilege initially set by an OS mediated access controller, the change invoked by a second process to permit the execute privilege;
intercept a kernel-mode execution request by the second process;
compare memory regions and sizes of the kernel-mode execution request by the second process to the memory regions and the corresponding sizes associated with the first process in the information log; and
remove, by the VM locker, the execute privilege in response to the kernel-mode execution request and a match of (a) the memory regions and (b) the corresponding sizes associated with the first process, the removal of the execution privilege to cause a denial of the kernel-mode execution request.
2. The machine readable storage device or storage disk of claim 1 , wherein the filter driver includes at least one of a network filter driver or a disk filter driver.
3. The machine readable storage device or storage disk of claim 1 , wherein the filter driver monitors the input/output (I/O) requests using hooking techniques.
4. The machine readable storage device or storage disk of claim 1 , further including a hypervisor mediated access controller based on at least one of an extended page table or rapid virtualization indexing, the hypervisor mediated access controller to store the execute privilege.
5. The machine readable storage device or storage disk of claim 1 , wherein the OS mediated access controller is based on at least one of a page table or a translation lookaside buffer.
6. A method for protecting a computer system used in a virtualization environment against fileless malware, the method comprising, at least:
receiving, by a virtual machine (VM) locker implemented by one or more processors of the computer system, information including input/output (I/O) requests associated with injection of data from an external source into a running instance of a first process associated with a guest operating system (OS) of a VM implemented by the computer system, the injected data including shellcode, and a filter driver to monitor and intercept the I/O requests;
generating an information log corresponding to the injection of data, the log including (a) an indication that the first process includes the injected data from the external source, (b) an indication of memory regions corresponding to the first process and (c) corresponding sizes of the memory regions associated with the first process;
detecting a change of an execute privilege initially set by an OS mediated access controller, the change invoked by a second process to permit the execute privilege;
intercepting a kernel-mode execution request by the second process;
comparing memory regions and sizes of the kernel-mode execution request by the second process to the memory regions and the corresponding sizes associated with the first process in the information log;
and
removing, by the VM locker, the execute privilege in response to the kernel-mode execution request and a match of (a) the memory regions and (b) the corresponding sizes associated with the first process, the removal of the execution privilege to cause a denial of the kernel-mode execution request.
7. The method of claim 6 , wherein the filter driver includes at least one of a network filter driver or a disk filter driver.
8. The method of claim 6 , wherein the filter driver monitors the I/O requests using hooking techniques.
9. The method of claim 6 , wherein the OS mediated access controller is based on a page table and a translation lookaside buffer.
10. A computer system used in a virtualization environment to protect itself against fileless malware, the computer system comprising at least:
one or more processors; and
memory storing executable instructions that, when executed, cause the one or more processors to:
receive, by a virtual machine (VM) locker implemented by the one or more processors, information including input/output (I/O) requests associated with injection of data from an external source into a running instance of a first process associated with a guest operating system (OS) of a VM implemented by the computer system, the injected data including shellcode, and a filter driver to monitor and intercept the I/O requests;
generate an information log corresponding to the injection of data, the log including (a) an indication that the first process includes the injected data from the external source;
detect a change of an execute privilege initially set by an OS mediated access controller, the change invoked by a second process to permit the execute privilege;
intercept a kernel-mode execution request by the second process;
compare memory regions and sizes of the kernel-mode execution request by the second process to the memory regions and the corresponding sizes associated with the first process in the information log; and
remove, by the VM locker, the execute privilege in response to the kernel-mode execution request and a match of (a) the memory regions and (b) the corresponding sizes associated with the first process, the removal of the execution privilege to cause a denial of the kernel-mode execution request.
11. The computer system of claim 10 , wherein the filter driver includes at least one of a network filter driver or a disk filter driver.
12. The computer system of claim 10 , wherein the filter driver monitors the I/O requests using hooking techniques.
13. The computer system of claim 10 , wherein the OS mediated access controller is based on a page table and a translation lookaside buffer.