System and method for detecting and remediating a cybersecurity attack
According to one embodiment, a computerized method is directed to neutralizing callback malware. This method involves intercepting a message directed to an endpoint device, where the message is in response to a callback message sent from callback malware operating on the endpoint device. Thereafter, a first portion of information within the message is substituted with a second portion of information. The second portion of information includes code that is configured to overwrite at least a portion of the callback malware and cause the callback malware to become inoperable or mitigate its operability.
1. A computerized method, comprising:
intercepting a message directed to an endpoint device, the message is in response to a first message sent from a malware operating on the endpoint device prior to the intercepting of the message; and
substituting a first portion of information within the message with a second portion of information prior to execution of the first portion of the information and prior to receipt of the message by the endpoint device, the second portion of information includes code that is configured to overwrite at least a portion of the malware and neutralize the malware by causing the malware to become inoperable or mitigate its operability.
2. The computerized method of claim 1 , wherein prior to intercepting the message, the method further comprises
determining whether a portion of the message matches a callback signature, the callback signature being generated in response to a prior detection of the malware within an object associated with monitored network traffic.
3. The computerized method of claim 2 , wherein the prior detection of the malware comprises detecting one or more anomalous behaviors indicative of the malware during execution of a second object associated with the monitored network traffic different from the object within a virtual machine.
4. The computerized method of claim 1 , wherein prior to intercepting the incoming message, the method further comprises:
determining whether a portion of the message violates at least one callback rule, the callback rule being generated in response to a prior detection of the malware within an object associated with monitored network traffic.
5. The computerized method of claim 1 , wherein the substituting of the first portion of information with the second portion of information comprises
uploading the code to overwrite the portion of the malware, the code being a neutralized version of code forming at least part of the malware that, when executed as part of the malware, mitigates operability of the malware.
6. The computerized method of claim 5 , wherein prior to substituting the first portion of information within the message with the second portion of information, the method further comprises accessing a data store to determine whether the data store includes the neutralized version of the code for the malware.
7. The computerized method of claim 5 , wherein prior to the uploading of the code to overwrite the portion of the malware, the method further comprises generating the neutralized version of code forming at least part of the malware is configured to modify a callback identifier included within the message.
8. The computerized method of claim 5 , wherein the malware becomes inoperable upon overwriting at least a portion of the malware with the code.
9. The computerized method of claim 1 , wherein the substituting of the first portion of information with the second portion of information further comprises
determining whether the message includes a command from a Command and Control (CnC) server.
10. The computerized method of claim 9 , wherein the command from the Command and Control (CnC) server causes the endpoint device to attempt to exfiltrate sensitive information.
11. The computerized method of claim 1 , wherein the substituting of the first portion of information with the second portion of information comprises determining whether the incoming message is a code update from a Command and Control (CnC) server that causes the endpoint device to attempt to exfiltrate sensitive information.
12. The computerized method of claim 1 , further comprising:
forwarding the message including the second portion of the information to the endpoint device, wherein the second portion of the information is configured to overwrite at least the portion of the malware at the endpoint device and neutralizes the malware.
13. The computerized method of claim 12 , wherein the intercepting of the message, the substituting of the first portion of information, and the forwarding of the message are conducted by an intrusion protection system (IPS) logic.
14. The computerized method of claim 12 , wherein the second portion of the information neutralizes the malware by delaying further callback messages from the malware operating in the endpoint device.
15. The computerized method of claim 12 , wherein the second portion of the information neutralizes the malware by redirecting further callback messages from the malware operating in the endpoint device.
16. The computerized method of claim 12 , wherein the second portion of the information neutralizes the malware by disabling further callback messages from the malware operating in the endpoint device.
17. A computerized method comprising:
scanning memory of an endpoint device;
performing an analysis on information obtained from the scanned memory to (1) determine that the information includes malware and (2) generate callback check information corresponding to the malware;
in response to a malicious callback session being detected based on the callback check information,
intercepting a message directed to the endpoint device, the message being a response to a callback message from malware already operating on the endpoint device prior to intercepting the message,
substituting a first portion of information within the message with a second portion of information prior to execution of the first portion of the information and prior to receipt of the message by the endpoint device, and
providing the message including the second portion of the information to the endpoint device,
wherein the second portion of information is configured to overwrite a portion of the malware and at least mitigate operability of the malware by at least (i) disabling further callback messages from the malware operating in the endpoint device, (ii) delaying further callback messages from the malware operating in the endpoint device, or (iii) redirecting further callback messages from the malware operating in the endpoint device.
18. The computerized method of claim 17 , wherein the callback check information includes one or more callback signatures.
19. A system comprising:
one or more hardware processors; and
a non-transitory storage medium comprises:
an interface to receive an incoming message directed to an endpoint device, the endpoint device being previously detected as including a malware associated with a malicious callback-based attack, and
a first analysis engine in communication with the interface, the first analysis engine to substitute a first portion of information within the incoming message with a second portion of information prior to execution of the first portion of the information and prior to receipt of the message by the endpoint device, the second portion of information is configured to overwrite at least a portion of the malware and cause the malware to become inoperable or mitigate its operability.
20. The system of claim 19 , wherein the first analysis engine is logic within an intrusion prevention system (IPS) device.
21. The system of claim 19 , wherein the first analysis engine intercepts the incoming message by extracting one or more objects from the incoming message and determining that the one or more object matches callback check information corresponding to the malware.
22. The system of claim 21 , further comprising a second analysis engine that, prior to receipt of the incoming message by the system, detects one or more anomalous behaviors indicative of the malware during execution of an object associated with network traffic within a virtual machine and generates the callback check information based on detection of the malware.
23. The system of claim 19 , wherein the first analysis engine to substitute the first portion of information with the second portion of information by the first analysis engine by at least includes uploading a neutralized version of at least a portion of the malware as the second portion of information into the incoming message, the neutralized version being code that modifies at least the portion of the malware operating in the endpoint device to cause the malware to mitigate operability of the malware.
24. The system of claim 23 , wherein the second portion of the information mitigates operability of the malware by disabling further callback messages from the malware operating in the endpoint device.
25. The system of claim 23 , wherein the second portion of the information mitigates operability of the malware by redirecting further callback messages from the malware operating in the endpoint device.
26. A non-transitory storage medium including one or more software modules that, upon execution by circuitry, performs a plurality of operations, comprising:
intercepting a message directed to an endpoint device, the message is in response to a first message sent from a malware operating on the endpoint device prior to the intercepting of the message; and
substituting a first portion of information within the message with a second portion of information prior to execution of the first portion of the information and prior to receipt of the message by the endpoint device, the second portion of information includes code that is configured to overwrite at least a portion of the malware and neutralize the malware by causing the malware to become inoperable or mitigate its operability.
27. The non-transitory storage medium of claim 26 , wherein prior to intercepting the message, the one or more software modules, upon execution by the circuitry, further perform one or more operations comprising:
determining whether a portion of the message matches a callback signature, the callback signature being generated in response to a prior detection of the malware within an object associated with monitored network traffic.
28. The non-transitory storage medium of claim 27 , wherein the prior detection of the malware comprises detecting one or more anomalous behaviors indicative of the malware during execution of a second object associated with the monitored network traffic different from the object within a virtual machine.
29. The non-transitory storage medium of claim 26 , wherein prior to intercepting the message, the one or more software modules, upon execution by the circuitry, further perform one or more operations comprising:
determining whether a portion of the message violates at least one callback rule, the callback rule being generated in response to a prior detection of the malware within an object associated with monitored network traffic.
30. The non-transitory storage medium of claim 26 , wherein the substituting of the first portion of information with the second portion of information comprises
uploading the code to overwrite the portion of the malware, the code being a neutralized version of code forming at least part of the malware that, when executed as part of the malware, mitigates operability of the malware.
31. The non-transitory storage medium of claim 30 , wherein prior to substituting the first portion of information within the message with the second portion of information, the one or more software modules, upon execution by the circuitry, further perform one or more operations comprising:
accessing a data store to determine whether the data store includes the neutralized version of the code for the malware.
32. The non-transitory storage medium of claim 30 , wherein prior to the uploading of the code to overwrite the portion of the malware, the one or more software modules, upon execution by the circuitry, further perform one or more operations comprising:
generating the neutralized version of code forming at least part of the malware is configured to modify a callback identifier included within the message.
33. The non-transitory storage medium of claim 30 , wherein the malware becomes inoperable upon overwriting at least a portion of the malware with the code.
34. The non-transitory storage medium of claim 26 , wherein the substituting of the first portion of information with the second portion of information by the one or more software modules, upon execution by the circuitry, comprises determining whether the message includes a command from a Command and Control (CnC) server.
35. The non-transitory storage medium of claim 34 , wherein the command from the CnC server causes the endpoint device to attempt to exfiltrate sensitive information.
36. The non-transitory storage medium of claim 26 , wherein the substituting of the first portion of information with the second portion of information by the one or more software modules, upon execution by the circuitry, comprises determining whether the message is a code update from a Command and Control (CnC) server that causes the endpoint device to attempt to exfiltrate sensitive information.
37. The non-transitory storage medium of claim 26 , wherein the one or more software modules, upon execution by the circuitry, further performs one or more operations comprising:
forwarding the message including the second portion of the information to the endpoint device, wherein the second portion of the information is configured to overwrite at least the portion of the malware at the endpoint device and neutralizes the malware.
38. The non-transitory storage medium of claim 37 , wherein the intercepting of the message, the substituting of the first portion of information, and the forwarding of the message are conducted by an intrusion protection system (IPS) logic corresponding to the one or more software modules.
39. The non-transitory storage medium of claim 37 , wherein the second portion of the information neutralizes the malware by delaying further callback messages from the malware operating in the endpoint device.
40. The non-transitory storage medium of claim 37 , wherein the second portion of the information neutralizes the malware by redirecting further callback messages from the malware operating in the endpoint device.
41. The non-transitory storage medium of claim 37 , wherein the second portion of the information neutralizes the malware by disabling further callback messages from the malware operating in the endpoint device.