Security privilege escalation exploit detection and mitigation
Examples of the present disclosure describe systems and methods for monitoring the security privileges of a process. In aspects, when a process is created, the corresponding process security token and privilege information is detected and recorded. At subsequent “checkpoints,” the security token is evaluated to determine whether the security token has been replaced, or whether new or unexpected privileges have been granted to the created process. When a modification to the security token is determined, a warning or indication of the modification is generated and the process may be terminated to prevent the use of the modified security token.
1. A system comprising:
at least one processor; and
memory coupled to the at least one processor, the memory comprising computer executable instructions that, when executed by the at least one processor, performs a method comprising:
receiving a notification associated with a process;
identifying a security token associated with the process;
evaluating a current state of the security token at one or more checkpoints and determining that the current state of the security token has been modified, wherein determining that the current state of the security token has been modified comprises identifying a privilege escalation exploit; and
based on determining that the current state of the security token has been modified, performing one or more actions related to the process.
2. The system of claim 1 , the method further comprising registering to receive the notification from an operating system of the system.
3. The system of claim 1 , wherein the notification is indicative of at least one of: a creation of the process, a creation of a thread, a DLL loading event, or a system registry activity.
4. The system of claim 1 , wherein identifying the security token comprises at least one of; parsing the notification, accessing a security token data store, or accessing a token issuing authority.
5. The system of claim 1 , wherein the security token is associated with a security context describing a set of credentials for the process.
6. The system of claim 1 , wherein identifying the security token comprises identifying an initial state of the security token.
7. The system of claim 6 , wherein identifying the initial state of the security token comprises at least one of: determining an address of the security token, determining a privilege level of the security token, determining an integrity level of the security token, or determining a current execution environment executing the process.
8. The system of claim 6 , wherein evaluating the current state of the security token comprises comparing the current state of the security token to the initial state of the security token.
9. The system of claim 1 , wherein the one or more actions comprise at least one of: displaying warnings indicating the current state of the security token has been modified, deleting the security token, replacing the security token with a previous version of the security token, or terminating the process.
10. A method comprising:
receiving a notification associated with a process;
identifying a security token associated with the process, wherein the identifying comprises determining an initial state of the security token;
evaluating a current state of the security token at one or more checkpoints and determining that the current state of the security token has been modified, wherein determining that the current state of the security token has been modified comprises identifying a privilege escalation exploit; and
based on determining that the current state of the security token has been modified, performing one or more actions related to the process.
11. The method of claim 10 , further comprising registering to receive the notification from an operating system of a computing device.
12. The method of claim 10 , wherein the notification is indicative of the one or more checkpoints.
13. The method of claim 12 , wherein the one or more checkpoints correspond to at least one of: a creation of the process, a creation of a thread, a DLL loading event, or a system registry activity.
14. The method of claim 10 , wherein identifying the security token comprises at least one of: parsing the notification, accessing a security token data store, or accessing a token issuing authority.
15. The method of claim 10 , wherein the security token is associated with a security context describing a set of credentials for the process.
16. The method of claim 15 , wherein the security context for the process is associated with a low privilege for the initial state of the security token and a high privilege for the current state of the security token.
17. The method of claim 10 , wherein the one or more actions comprise at least one of: displaying warnings indicating the current state of the security token has been modified, deleting the security token, replacing the security token with a previous version of the security token, or terminating the process.
18. A non-transitory computer readable media encoding computer executable instructions which, when executed by at least one processor, performs a method comprising:
receiving a notification associated with a process;
identifying a security token associated with the process, wherein the identifying comprises determining an initial state of the security token;
evaluating a current state of the security token at one or more checkpoints and determining that the current state of the security token has been modified, wherein determining that the current state of the security token has been modified comprises identifying a privilege escalation exploit; and
based on determining that the current state of the security token has been modified, performing one or more actions related to the process.