Systems and methods for event-based application control
Systems and methods are disclosed for event-based application control. A system extension is configured to leverage an endpoint security API for monitoring event activity within operating system kernel processes. The system extension registers with the endpoint security API particular event types for which the system extension would like to receive notifications. In response to receiving notifications regarding detected events corresponding to the registered event types, the system extension determines if the event, and its corresponding process, are safe and allowable to execute. In various embodiments, the system leverages whitelists, blacklists, and rules policies for making a safeness determination regarding the event notification. The system extension transmits this determination to the operating system via the endpoint security API.
1. A method comprising:
subscribing, via a system extension executed by at least one computing device, for at least one event type with an operating system;
receiving, via the system extension, an event notification comprising metadata associated with an event, the event corresponding to one of the at least one event type;
applying, via the system extension, a policy comprising a plurality of rules to the event notification;
determining, via the system extension, whether to allow the event according to the plurality of rules;
instructing, via the system extension, the operating system whether to allow the event based on the determination;
receiving, via the system extension, a second event notification comprising second metadata associated with a second event;
determining, via the system extension, that a passive mode applies to the second event notification based at least in part on the second metadata; and
generating, via the system extension, an audit log corresponding to a result of the second event notification.
2. The method of claim 1 , further comprising:
generating, via the system extension, a copy of the event notification; and
transmitting, via the system extension, the copy of the event notification to a security service.
3. The method of claim 1 , wherein the system extension is at least one of: a software application with a system extension application type or a software application with access to an endpoint security application programming interface (API).
4. The method of claim 1 , further comprising subsequent to instructing the operating system to deny the event, generating a command to kill a process corresponding to the event.
5. The method of claim 1 , wherein applying the policy comprises:
sending, via the system extension, the event notification with the metadata to a security service;
applying, via the security service, the policy to determine a result; and
receiving, via the system extension, the result from the security service.
6. The method of claim 5 , wherein the security service is a daemon and the system extension and the security service are configured to communicate via interprocess communication.
7. The method of claim 1 , further comprising:
determining, via the system extension, that a predefined time threshold from receipt of the event notification has been exceeded; and
instructing the operating system to deny the event based on the predefined time threshold being exceeded.
8. The method of claim 7 , wherein the predefined time threshold is equal to an operating system timeout corresponding to the event notification minus a predefined offset.
9. The method of claim 8 , wherein the predefined offset is about 5%-10% of the operating system timeout.
10. The method of claim 1 , further comprising:
receiving, via the system extension, a second event notification comprising second metadata associated with a second event;
determining, via the system extension, that the second event corresponds to a whitelisted event according to the second metadata; and
instructing, via the system extension, the operating system to allow the second event in response to the second event corresponding to the whitelisted event.
11. The method of claim 1 , further comprising:
receiving, via the system extension, a second event notification comprising second metadata associated with a second event;
determining, via the system extension, that the second event corresponds to a blacklisted event according to the second metadata; and
instructing, via the system extension, the operating system to deny the second event in response to the second event corresponding to the blacklisted event.
12. The method of claim 1 , wherein the at least one event type comprises an open event and an execution event.
13. The method of claim 1 , further comprising:
receiving, via the system extension, a second event notification comprising second metadata associated with a second event;
sending, via the system extension, the second event notification to a security service;
receiving, via the system extension, second data indicating to allow the second event;
determining, via the system extension, that a modification has occurred to an application associated with the second event notification subsequent to receiving the second event notification; and
instructing, via the system extension, the operating system to deny the event based on the modification.
14. A system comprising:
at least one computing device;
a security service executable by the at least one computing device; and
a system extension in communication with the security service and executable by the at least one computing device, the system extension being configured to:
subscribe with an operating system executed by the at least one computing device for at least one event type;
receive an event notification comprising metadata associated with an event, the event corresponding to one of the at least one event type;
send the event notification to the security service;
receive data indicating whether to allow the event;
instruct the operating system whether to allow the event based on the data indicating whether to allow the event;
receive a second event notification comprising second metadata associated with a second event;
send the second event notification to the security service;
receive second data indicating to allow the second event;
determine that a modification has occurred to an application associated with the second event notification subsequent to receiving the second event notification; and
instruct the operating system to deny the event based on the modification.
15. The system of claim 14 , wherein the security service is configured to apply a policy comprising a plurality of rules to the event notification.
16. The system of claim 14 , wherein the system extension is further configured to:
receive a second event notification comprising second metadata associated with a second event;
determine that a passive mode applies to the second event notification based at least in part on the second metadata; and
generate an audit log corresponding to a result of the second event notification.
17. A system comprising:
at least one computing device;
a security service executable by the at least one computing device; and
a system extension in communication with the security service and executable by the at least one computing device, the system extension being configured to:
subscribe with an operating system executed by the at least one computing device for a plurality of event types with the operating system;
receive a plurality of event notifications from the operating system, wherein each of the plurality of event notifications comprises respective metadata associated with a respective event, each respective event corresponding to one of the plurality of event types;
process a first event notification from the plurality of event notifications by:
sending the first event notification to the security service;
receiving data indicating whether to allow the respective event associated with the first event notification; and
instructing the operating system whether to allow the respective event associated with the first event notification based on the data indicating whether to allow the respective event;
receive a second event notification comprising second metadata associated with a second event;
determine that a passive mode applies to the second event notification based at least in part on the second metadata; and
generate an audit log corresponding to a result of the second event notification.
18. The system of claim 17 , wherein the system extension is further configured to:
store each of the plurality of event notifications in a queue when received; and
process the plurality of event notifications from the queue.
19. The system of claim 17 , wherein the system extension is further configured to:
upon receiving each particular event notification of the plurality of event notifications:
determine whether a whitelist comprises the particular event notification;
determine whether a blacklist comprises the particular event notification; and
in response to neither the whitelist or the blacklist comprising the particular event notification, send the particular event notification to the security service.
20. The system of claim 17 , wherein subscribing with the operating system comprises registering with an endpoint security application programming interface (API) for notifications.
21. The system of claim 20 , wherein the notifications registered with the endpoint security API comprise an ES_EVENT_TYPE_AUTH_OPEN event type and an ES_EVENT_TYPE_AUTH_EXEC event type.