Granted Patent B2

US 11,695,800 · App. 16/849,813 · Granted Jul 4, 2023

Inventors: Venu Vissamsetty (San Jose, CA); Anil Gupta (Bangalore, IN); Harinath Vishwanath Ramchetty (Bangalore, IN)

Assignee: SENTINELONE, INC.

H04L63/1491H04L41/12H04L61/4505H04L61/5007

Abstract

Claims (65)

1. A method comprising:

replacing in a first system call, by a computer system, a reference to a target function with a reference to a detour function, such that the first system call calls the detour function instead of the target function;

receiving, by the computer system, the first system call from a first source function to obtain information regarding a remote network resource;

evaluating, by the detour function, whether the first source function is sanctioned;

determining, by the computer system, that the first source function is not sanctioned;

in response to determining that the first source function is not sanctioned, returning, by the detour function, a response to the first system call having the information regarding the remote network resource replaced with information regarding a decoy server;

replacing in a second system call, by a computer system, a reference to the target function with a reference to the detour function, such that the second system call calls the detour function instead of the target function;

receiving, by the computer system, the second system call from a second source function;

evaluating, by the detour function, whether the second source function is sanctioned;

determining, by the computer system, that the second source function is sanctioned; and

in response to determining that the second source function is sanctioned, invoking, by the detour function, the target function,

wherein the target function is in a dynamic link library.

2. The method of claim 1 , further comprising:

invoking, by the detour function, the target function in response to the first system call;

receiving, by the detour function, a result from the target function;

modifying, by the detour function, the result to obtain a modified result referencing the decoy server;

replacing, by the decoy function, a first reference in the response to the first system call with a second reference referencing a decoy server to obtain a modified response;

returning, by the detour function, the modified response to the first system call.

3. The method of claim 1 , further comprising:

modifying, by the decoy function, an argument of the first system call to replace a domain name service (DNS) address with an internet protocol (IP) address of the decoy server to obtain a modified argument;

invoking, by the decoy function, the target function in response to the first system call with the modified argument;

receiving, by the decoy function, a result from the target function; and

returning, by the decoy function, the result to the first system call.

4. The method of claim 1 , wherein the first system call is an instruction to list network shares mounted to the computer system.

5. The method of claim 1 , wherein the first system call is an instruction to list credentials for network services stored on the computer system.

6. The method of claim 1 , wherein the first system call is an instruction to list domain controllers.

7. The method of claim 1 , wherein the first system call is an instruction to enumerate network computers.

8. The method of claim 1 , wherein the first system call is an instruction to list users and groups, the method further comprising:

generating, by the computer system, a first response including references to a decoy group defined on the decoy server;

returning, by the computer system, the first response to the first source function;

receiving, by the computer system from the first source function, a request for information regarding the decoy group;

in response to the request for information regarding the decoy group, returning a second response to the first system call, the second response including decoy account information for a decoy user in the decoy group.

9. A system comprising:

a computer system including one or more processing devices and one or more memory devices operably coupled to the one or more processing devices, the one or more memory devices storing executable code that, when executed by the one or more processing devices, causes the one or more processing devices to:

replace in a first system call a reference to a target function with a reference to a detour function, such that the system call calls the detour function instead of the target function;

receive the system call from a first source function to obtain information regarding a remote network resource;

evaluate whether the first source function is sanctioned;

determine that the first source function is not sanctioned;

in response to determining that the first source function is not sanctioned, return a response to the first system call having the information regarding the remote network resource replaced with information regarding a decoy server;

replace in a second system call a reference to the target function with a reference to the detour function, such that the second system call calls the detour function instead of the target function;

receive the second system call from the second source function;

determine that the second source function is sanctioned; and

in response to determining that the second source function is sanctioned, invoke, by the detour function, the target function,

wherein the target function is in a dynamic link library.

10. The system of claim 9 , wherein the executable code, when executed by the one or more processing devices, further causes the one or more processing devices to:

invoke, by the detour function, the target function in response to the first system call;

receive, by the detour function, a result from the target function;

modify, by the detour function, the result to obtain a modified result referencing the decoy server;

replace, by the detour function, a first reference in the response with a second reference referencing a decoy server to obtain a modified response;

return, by the decoy function, the modified response to the first system call.

11. The system of claim 9 , wherein the executable code, when executed by the one or more processing devices, further causes the one or more processing devices to:

modify an argument of the first system call to replace a domain name service (DNS) address with an internet protocol (IP) address of the decoy server to obtain a modified argument;

invoke, by the decoy function, the target function in response to the first system call with the modified argument;

receive, by the decoy function, a result from the target function; and

return, by the decoy function, the result to the first system call.

12. The system of claim 9 , wherein the first system call is an instruction to list network shares mounted to the computer system.

13. The system of claim 9 , wherein the first system call is an instruction to list credentials for network services stored on the computer system.

14. The system of claim 9 , wherein the first system call is an instruction to list domain controllers.

15. The system of claim 9 , wherein the first system call is an instruction to enumerate network computers.

16. The system of claim 9 , wherein the first system call is an instruction to list users and groups;

wherein the executable code, when executed by the one or more processing devices, further causes the one or more processing devices to:

generate a first response including references to a decoy group defined on the decoy server;

return the first response to the first system call;

receive a request for information regarding the decoy group;

in response to the request for information regarding the decoy group, return a second response to the first system call, the second response including decoy account information for a decoy user in the decoy group.

Assignments (2)

Continuity (3)

Cited By (11)

US 12,235,962 US 12,244,626 US 12,259,967 US 12,363,151 US 12,418,565 US 12,450,351 US 12,452,273 US 12,468,810 US 12,579,268 US 12,621,331 US 12,664,258