Malware mitigation based on runtime memory allocation
A compute instance is instrumented to detect certain kernel memory allocation functions, in particular functions that allocate heap memory and/or make allocated memory executable. Dynamic shell code exploits can then be detected when code executing from heap memory allocates additional heap memory and makes that additional heap memory executable.
1. A computer program product for malware mitigation based on runtime memory allocation behavior, the computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
instrumenting a compute instance to detour a first kernel memory management routine for allocating memory to a first malware check;
instrumenting the compute instance to detour a second kernel memory management routine for controlling memory permissions to a second malware check;
detecting, with the first malware check, a memory allocation by a first code segment executing in a first memory range of a heap memory, the memory allocation allocating a second memory range in the heap memory;
detecting, with the first malware check or the second malware check, a memory mapping of the second memory range as executable; and
based on the memory allocation, by the first code segment executing in the first memory range of the heap memory, of the second memory range in the heap memory, as detected with the first malware check detoured from the first kernel memory management routine for allocating memory, and based on the memory mapping of the second memory range as executable, as detected by first malware check or by the second malware check detoured from the second kernel memory management routine for controlling memory permissions, terminating execution of the first code segment.
2. The computer program product of claim 1 wherein the first kernel memory management routine for allocating memory includes a VirtualAlloc( ) call of an operating system.
3. The computer program product of claim 1 wherein the second kernel memory management routine for controlling memory permissions includes a VirtualProtect( ) call of an operating system.
4. The computer program product of claim 1 wherein detecting, with the first malware check or the second malware check, the memory mapping of the second memory range as executable includes detecting an allocation by the first kernel memory management routine for allocating memory with the first malware check, the allocation initially allocating the second memory range as executable.
5. The computer program product of claim 1 wherein detecting, with the first malware check or the second malware check, the memory mapping of the second memory range as executable includes detecting a change in protection to the second memory range with the second kernel memory management routine for controlling memory permissions, the change in protection including changing the second memory range to executable.
6. The computer program product of claim 5 wherein detecting the change in protection includes detecting the change in protection by a second calling process different from a first calling process that allocated the second memory range with the first code segment.
7. The computer program product of claim 1 further comprising code that performs the step of detecting a second memory allocation of a third memory range in the heap memory by a second code segment executing in the second memory range.
8. The computer program product of claim 7 further comprising code that performs the step of intercepting behavior by the first code segment for malware mitigation based on the memory allocation, the memory mapping and the second memory allocation.
9. The computer program product of claim 7 wherein intercepting behavior by the first code segment for malware mitigation includes evaluating a suspiciousness of the first code segment based on a chain of allocations of executable memory from the first code segment.
10. The computer program product of claim 1 wherein terminating execution of the first code segment includes terminating a process associated with the first code segment.
11. A method comprising:
detecting an allocation of a memory range in a heap memory by code executing in the heap memory;
detecting a mapping of the memory range as executable by the code executing in the heap memory; and
identifying the code as suspicious and terminating execution of the code based on the allocation of the memory range in the heap memory by code executing in the heap memory and the mapping of the memory range as executable by the code executing in the heap memory.
12. The method of claim 11 further comprising instrumenting a compute instance to detour a kernel memory management routine for allocating memory allocation to a malware check.
13. The method of claim 12 wherein detecting the allocation of the memory includes detecting the allocation of the memory on the compute instance with the malware check.
14. The method of claim 12 wherein detecting the mapping of the memory as executable includes detecting, with the malware check, the allocation of the memory as executable by the kernel memory management routine for allocating memory.
15. The method of claim 11 further comprising instrumenting a compute instance to detour a kernel memory management routine for controlling memory permissions to a malware check.
16. The method of claim 15 wherein detecting the mapping of the memory as executable includes detecting a change in protection for the memory to executable using the kernel memory management routine for controlling memory permissions.
17. The method of claim 11 wherein the mapping of the memory as executable includes enabling execute access to a memory region committed by the allocation.
18. The method of claim 11 further comprising intercepting behavior by code executing in the memory that is identified as suspicious based on detecting the allocation of the memory and detecting the mapping of the memory as executable.
19. The method of claim 18 further comprising withholding intercepting behavior by code executing in the memory when the code is associated with a whitelisted process.
20. A system comprising:
a processor and a physical memory;
an operating system stored in the physical memory and configured to execute on the processor, the operating system configured to provide access to a heap memory by processes executing on the processor using a first memory management routine for allocating memory and a second memory management routine for controlling memory permissions;
a first malware check configured to receive a detour of kernel calls to the first memory management routine for allocating memory and a second malware check configured to receive a detour of kernel calls to the second memory management routine for controlling memory permissions; and
a malware detection process configured to terminate execution of code executing in the heap memory when detecting that the code allocates additional memory within the heap memory based on a first detour of at least one kernel call to the first memory management routine for allocating memory, and when further detecting that the code enables execute access to the additional memory based on a second detour of at least one kernel call to the second memory management routine for controlling memory permissions.