Automatic detection of software that performs unauthorized privilege escalation

1. An article of manufacture comprising machine readable instructions that, when executed by one or more processors, cause the one or more processors to at least:

parse a first event generated by an event logger to determine a process and a first privilege level for the process, the first privilege level to represent an expected privilege level for the process, the first event associated with a start of execution of the process;

identify, based on a second event, an attempt to escalate the process from the expected privilege level to a second privilege level, the second privilege level higher than the expected privilege level, the attempt to escalate to occur during the execution of the process;

at least one of 1) continue using the first privilege level to represent the expected privilege level in response to a third event indicating the attempt to escalate failed, or 2) use the second privilege level to represent the expected privilege level in response to the third event indicating the attempt to escalate succeeded;

compare a third privilege level for the process to the expected privilege level, the third privilege level corresponding to a fourth event after the third event; and

block execution of the process in response to the third privilege level being higher than the expected privilege level.

2. The article of manufacture of claim 1 , wherein the event logger is included in an operating system and the event logger is a kernel level process.

3. The article of manufacture of claim 1 , wherein the instructions cause the one or more processors to retrieve the expected privilege level from memory.

4. The article of manufacture of claim 1 , wherein the instructions cause the one or more processors to block execution of the process by at least one of terminating or pausing the process.

5. The article of manufacture of claim 1 , wherein the instructions cause the one or more processors to parse a plurality of events generated by the event logger to determine whether the events are related to the process, the plurality of events including the first, second, third and fourth events.

6. The article of manufacture of claim 1 , wherein the instructions cause the one or more processors to build a list of currently executing processes.

7. A method for detecting unauthorized privilege escalation of a process executing on one or more processors, the method comprising:

identifying, by executing an instruction with the one or more processors, a first event from an event logger, the first event associated with a start of execution of the process, the first event to identify the process and a first privilege level of the process at the start of execution, the first privilege level to represent an expected privilege level for the process;

detecting, based on a second event from the event logger, an attempt to escalate the process from the expected privilege level to a second privilege level, the second privilege level higher than the expected privilege level, the attempt to escalate occurring during the execution of the process;

at least one of 1) continuing to use the first privilege level to represent the expected privilege level in response to the attempt to escalate having failed, or 2) using the second privilege level to represent the expected privilege level in response to the attempt to escalate having succeeded;

determining the process is operating at a third privilege level in association with a third event after the second event;

comparing the third privilege level to the expected privilege level; and

blocking execution of the process when the third privilege level is higher than the expected privilege level.

8. The method of claim 7 , wherein the event logger is included in an operating system and the event logger is a kernel level process.

9. The method of claim 7 , wherein the first level is associated with a user account.

10. The method of claim 7 , wherein the blocking of the execution of the process includes terminating or pausing the process.

11. The method of claim 7 , further including parsing a plurality of events generated by the event logger to determine whether the events are related to the process, the plurality of events including the first, second, and third and fourth events.

12. The method of claim 7 , further including generating a list of currently executing processes.

13. An apparatus to detect unauthorized privilege escalation of a process, the apparatus comprising:

memory including instructions; and

one or more processors to execute the instructions to:

identify a first event from an event logger, the first event associated with a start of execution of the process, the first event to identify the process operating on the apparatus and a first privilege level of the process at the start of execution, the first privilege level to represent an expected privilege level at which the process is authorized to operate;

detect, based on a second event from the event logger, an attempt to escalate the expected privilege level to a second privilege level, the second privilege level higher than the expected privilege level, the attempt to escalate to occur during the execution of the process;

at least one of 1) continue to use the first privilege level to represent the expected privilege level in response to the attempt to escalate having failed, or 2) use the second privilege level to represent the expected privilege level in response to the attempt to escalate having succeeded;

determine the process is operating at a third privilege level in association with a third event after the second event, the third event from the event logger;

compare the third privilege level for the process to the expected privilege level; and

block execution of the process when the third privilege level for the process is higher than the expected privilege level.

14. The apparatus of claim 13 , wherein the event logger is included in an operating system and the event logger is a kernel level process.

15. The apparatus of claim 13 , wherein the expected privilege level is based on a user account.

16. The apparatus of claim 13 , wherein the one or more processors are to parse a plurality of events generated by the event logger to determine whether the events are related to the process, the plurality of events including the first, second, and third events.

17. The apparatus of claim 13 , wherein the one or more processors are to generate a list of currently executing processes.