Providing security features in write filter environments
A security client can provide security features in write filter environments. To prevent improper modifications to a protected volume, the security client can be employed to differentiate between direct I/O requests and reparsed I/O requests that are directed to a shadow volume and to block any direct I/O requests. Alternatively or additionally, the security client can be configured to determine whether an I/O request that is directed to the shadow volume targets an artifact in the write filter's exclusion list, and if not, block the I/O request. Alternatively or additionally, the security client can be configured to monitor registry operations to determine whether a modifying registry operation targets the write filter's persistent shadow registry hive, and if so, allow the modifying registry operation only if it targets a registry key in the write filter's exclusion list.
1. A method, performed by a security client on a computing device, for providing security features in a write filter environment that includes a protected I/O stack on which a write filter is loaded to prevent modification to artifacts on a protected volume and an unprotected I/O stack by which the write filter enables excluded artifacts to be modified, the method comprising:
receiving, at a minifilter of the security client that is loaded on the unprotected I/O stack, an I/O request;
determining, by the minifilter, whether the I/O request is a reparsed I/O request or a direct I/O request;
when the minifilter determines that the I/O request is a reparsed I/O request, allowing the I/O request to be passed down the unprotected I/O stack; and
when the minifilter determines that the I/O request is a direct I/O request, blocking the I/O request.
2. The method of claim 1 , wherein determining that the I/O request is a reparsed I/O request comprises determining that the I/O request includes a tag that was added by another minifilter that is loaded on the protected I/O stack.
3. The method of claim 2 , wherein the tag comprises Extended Create Parameters of the I/O request.
4. The method of claim 2 , further comprising:
prior to the minifilter receiving the I/O request, receiving, by the other minifilter that is loaded on the protected I/O stack, the I/O request; and
adding, by the other minifilter, the tag to the I/O request.
5. The method of claim 4 , wherein the other minifilter adds the tag to the I/O request upon determining that the write filter has reparsed the I/O request.
6. The method of claim 4 , wherein the other minifilter is the write filter and adds the tag to the I/O request as part of reparsing the I/O request.
7. The method of claim 1 , wherein determining that the I/O request is a reparsed I/O request comprises determining that the I/O request targets an excluded artifact.
8. The method of claim 7 , wherein determining that the I/O request targets an excluded artifact comprises:
evaluating the I/O request to identify an artifact that the I/O request targets;
comparing the identified artifact to an exclusion list; and
determining that the identified artifact is included in the exclusion list.
9. The method of claim 8 , further comprising:
receiving, by the minifilter and from a service, the exclusion list; and
storing, by the minifilter, the exclusion list.
10. The method of claim 1 , further comprising:
receiving, at a registry filter of the security client, a registry operation;
determining, by the registry filter, that the registry operation targets a persistent shadow registry hive that the write filter employs to enable excluded registry keys to be modified;
determining, by the registry filter, that the registry operation does not target an excluded registry key; and
blocking, by the registry filter, the registry operation.
11. The method of claim 10 , wherein determining that the registry operation targets the persistent shadow registry hive comprises:
determining a path of a registry key that the registry operation targets; and
determining that the persistent shadow registry hive encompasses the path.
12. The method of claim 11 , wherein determining that the registry operation does not target an excluded registry key comprises:
comparing the registry key to a registry exclusion list; and
determining that the registry key is not included in the registry exclusion list.
13. One or more computer storage media storing computer executable instructions which when executed on a computing device implement a security client that is configured to provide security features in a write filter environment that includes a protected I/O stack on which a write filter is loaded to prevent modification to artifacts on a protected volume and an unprotected I/O stack by which the write filter enables excluded artifacts to be modified, the security client providing the security features by performing a method comprising:
receiving, at a minifilter of the security client that is loaded on the unprotected I/O stack, a first I/O request;
determining, by the minifilter, that the first I/O request is a direct I/O request;
in response to determining that the first I/O request is a direct I/O request, blocking the first I/O request;
receiving, at the minifilter, a second I/O request;
determining, by the minifilter, that the second I/O request is a reparsed I/O request; and
in response to determining that the second I/O request is a reparsed I/O request, allowing the second I/O request.
14. The computer storage media of claim 13 , wherein determining that the first I/O request is a direct I/O request and that the second I/O request is a reparsed I/O request comprises one of:
determining that the second I/O request includes a tag that was added by another minifilter and that the first I/O request does not include the tag; or
determining that first I/O request does not target an excluded artifact and that the second I/O request targets an excluded artifact.
15. The computer storage media of claim 13 , wherein the method further comprises:
receiving, at a registry filter of the security client, a registry operation;
determining, by the registry filter, that the registry operation targets a persistent shadow registry hive that the write filter employs to enable excluded registry keys to be modified;
determining, by the registry filter, that the registry operation does not target an excluded registry key; and
blocking, by the registry filter, the registry operation.
16. The computer storage media of claim 15 , wherein determining that the registry operation targets the persistent shadow registry hive comprises:
determining a path of a registry key that the registry operation targets; and
determining that the persistent shadow registry hive encompasses the path; and
wherein determining that the registry operation does not target an excluded registry key comprises:
comparing the registry key to a registry exclusion list; and
determining that the registry key is not included in the registry exclusion list.
17. A method, performed by a security client on a computing device, for providing security features in a write filter environment that includes a protected I/O stack on which a write filter is loaded to prevent modification to artifacts on a protected volume and an unprotected I/O stack by which the write filter enables excluded artifacts to be modified, the method comprising:
receiving, at a first minifilter of the security client that is loaded on the protected I/O stack, a first I/O request;
detecting, by the first minifilter, that the first I/O request is reparsed;
in response to detecting that the first I/O request is reparsed, adding, by the first minifilter, a tag to the first I/O request;
receiving, at a second minifilter of the security client that is loaded on the unprotected I/O stack, the first I/O request;
determining, by the second minifilter, that the first I/O request includes the tag; and
in response to determining that the first I/O request includes the tag, allowing the first I/O request.
18. The method of claim 17 , further comprising:
receiving, at the second minifilter, a second I/O request;
determining, by the second minifilter, that the second I/O request does not include the tag; and
in response to determining that the second I/O request does not include the tag, blocking the second I/O request.
19. The method of claim 18 , wherein the tag comprises Extra Create Parameters.
20. The method of claim 18 , wherein the first minifilter is one of:
loaded above the write filter;
loaded above the write filter and an overlay optimizer; or
the write filter.