System and method for identifying and mitigating cyberattacks through malicious position-independent code execution
A computing system including a processor and a memory, which includes a first memory region operating as a kernel space and a second memory region operating as a user space. Maintained within the kernel space, a first logic unit receives a notification identifying a newly created thread and extracts at least meta-information associated with the newly created thread. Maintained within the user space, a second logic unit receives at least the meta-information associated with the newly created thread and conducts analytics on at least the meta-information to attempt to classify the newly created thread. An alert is generated by the second logic unit upon classifying the newly created thread as a cyberattack associated with a malicious position independent code execution based at least on results of the analytics associated with the meta-information associated with the newly created thread.
1. A system, comprising:
one or more processors; and
a memory communicatively coupled to the one or more processors, the memory including a first memory region operating as a kernel space and a second memory region operating as a user space, the memory comprises
a first logic unit maintained within the kernel space, the first logic unit to (i) receive a thread creation notification via an Application Programming Interface identifying a newly created thread, (ii) determine a thread type associated with the newly created thread to determine whether the newly created thread is a filtered thread type of one or more filtered thread types, and (iii) extract, within the kernel space, at least meta-information associated with the newly created thread included as part of the threat creation notification, provided the newly created thread is a thread type other than the one or more filtered thread types, and
a second logic unit maintained within the user space, the second logic unit to receive at least the meta-information associated with the newly created thread and conduct analytics on at least the meta-information to attempt to classify the newly created thread,
wherein an alert is generated by the second logic unit upon classifying the newly created thread as a cyberattack associated with a malicious position independent code execution based at least on results of the analytics associated with the meta-information associated with the newly created thread.
2. The system of claim 1 , wherein the malicious position independent code execution corresponding to either (i) a malicious remote injection in which malicious code associated with the newly created thread is inserted into a process that includes the newly created thread or (ii) a malicious local reflection in which a malicious thread is created and invoked by the process that includes the newly created thread.
3. The system of claim 1 , wherein the filtered thread type of the one or more filtered thread types includes a system thread being a thread generated in the kernel space and the first logic unit is configured to detect newly created threads and filter threads being any of the one or more filtered thread types to produce a reduced set of newly created threads including the newly created thread.
4. The system of claim 1 , wherein the second logic unit to conduct the analytics on the meta-information associated with the newly created thread by determining whether at least a particular level of correlation exists between the meta-information and meta-information associated with known malicious code execution events.
5. The system of claim 1 , wherein the one or more filtered threads includes one or more threads created in the kernel space, one or more threads created through remote injection, or one or more threads created through local reflection.
6. The system of claim 1 , wherein the first logic unit further extracting thread code associated with the newly created thread and the second logic unit to conduct the analytics on the meta-information associated with the newly created thread by determining whether at least a first level of correlation exists between the meta-information and meta-information associated with known malicious code execution events or a second level of correlation exists between a representation of the thread code and a representation of shellcode.
7. The system of claim 6 , wherein the representation of the thread code includes at least a hash value of at least a portion of the thread code and the representation of the shellcode includes at least a hash value of at least a portion of the shellcode.
8. The system of claim 7 , wherein the second logic unit to provide at least the meta-information associated with the newly created thread and the thread code associated with the newly created thread to a centralized system that performs an emulation operation or other in-depth analyses on at least one of the meta-information associated with the newly created thread or the thread code associated with the newly created thread in order to analyze potential effects caused by execution of the newly created thread by the computing system.
9. The system of claim 1 , wherein the system is operating as a cloud service with the one or more processors corresponding to one or more virtual processors.
10. A non-transitory storage medium including code including a first logic unit to operate in a kernel space of a memory and a second logic unit configured to operate in a user space of the memory that, upon execution by one or more processors, performs operations comprising:
receiving, by the first logic unit via an Application Programming Interface, a notification identifying a newly created thread;
determining a thread type associated with the newly created thread to determine whether the newly created thread is a predetermined thread type;
extracting, by the first logic unit operating within the kernel space, at least meta-information associated with the newly created thread included as part of the notification when the newly created thread is a thread type other than the predetermined thread type;
receiving, by the second logic unit, at least the meta-information associated with the newly created thread;
conducting, by the second logic unit, analytics on at least the meta-information to attempt to classify the newly created thread; and
issuing an alert, as generated by the second logic unit, upon classifying the newly created thread as a cyberattack associated with a malicious position independent code execution based at least on results of the analytics associated with the meta-information associated with the newly created thread.
11. The non-transitory storage medium of claim 10 , wherein the malicious position independent code execution corresponding to either (i) a malicious remote injection in which malicious code associated with the newly created thread is inserted into a process that includes the newly created thread or (ii) a malicious local reflection in which a malicious thread is created and invoked by the process.
12. The transitory storage medium of claim 10 , wherein the determining of the thread type associated with the newly created thread comprises determining whether the newly created thread is a thread created in the kernel space, a thread created through remote injection, or a thread created through local reflection.
13. The transitory storage medium of claim 10 , wherein the conducting of the analytics on the meta-information associated with the newly created thread comprises determining whether at least a particular level of correlation exists between the meta-information and meta-information associated with known malicious code execution events.
14. The transitory storage medium of claim 10 , wherein the first logic unit of the code, upon execution by the one or more processors, further comprises extracting thread code associated with the newly created thread.
15. The transitory storage medium of claim 14 , wherein the second logic unit of the code, upon execution by the one or more processors, conducting of the analytics on the meta-information associated with the newly created thread by at least determining whether at least a first level of correlation exists between the meta-information and meta-information associated with known malicious code execution events or a second level of correlation exists between a representation of the thread code and a representation of shellcode.
16. The transitory storage medium of claim 15 , wherein the representation of the thread code includes at least a hash value of at least a portion of the thread code and the representation of the shellcode includes at least a hash value of at least portion of the shellcode.
17. The transitory storage medium of claim 16 , wherein the second logic unit, upon execution by the one or more processors, to provide at least the meta-information associated with the newly created thread and the thread code associated with the newly created thread to a centralized system that performs an emulation operation or other in-depth analyses on at least one of the meta-information associated with the newly created thread or the thread code associated with the newly created thread in order to analyze potential effects caused by execution of the newly created thread by the computing system.
18. The transitory storage medium of claim 16 , wherein the second logic unit, upon execution by the one or more processors, to provide at least the meta-information associated with the newly created thread and the thread code associated with the newly created thread to a centralized system to perform enrichment operations to determine additional context with respect to the newly created thread.
19. The transitory storage medium of claim 10 and the one or more processors being deployed within a cloud service with the one or more processors corresponding to one or more virtual processors.
20. A method for detecting malicious position independent code execution, the method comprising:
receiving, via an Application Programming Interface, a notification identifying a newly created thread by a first logic unit stored within a kernel space of a memory;
determining a thread type associated with the newly created thread to determine whether the newly created thread is a predetermined thread type, wherein the predetermined thread type includes a thread created in the kernel space;
extracting, by the first logic unit operating within the kernel space, at least meta-information associated with the newly created thread included as part of the notification when the newly created thread is a thread type other than the predetermined thread type;
receiving at least the meta-information associated with the newly created thread by a second logic unit stored within user space of the memory;
conducting analytics on at least the meta-information by the second logic unit to attempt to classify the newly created thread; and
issuing an alert, as generated by the second logic unit, upon classifying the newly created thread as a cyberattack associated with the malicious position independent code execution based at least on results of the analytics associated with the meta-information associated with the newly created thread.
21. The method of claim 20 , wherein the malicious position independent code execution corresponding to either a malicious remote injection in which malicious code associated with the newly created thread is inserted into a process that includes the newly created thread or a malicious local reflection in which a malicious thread is created and invoked by the process that includes the newly created thread.