Technique for verifying exploit/malware at malware detection appliance through correlation with endpoints
A technique verifies a determination of an exploit or malware in an object at a malware detection system (MDS) appliance through correlation of behavior activity of the object running on endpoints of a network. The appliance may analyze the object to render a determination that the object is suspicious and may contain the exploit or malware. In response, the MDS appliance may poll the endpoints (or receive messages pushed from the endpoints) to determine as to whether any of the endpoints may have analyzed the suspect object and observed its behaviors. If the object was analyzed, the endpoints may provide the observed behavior information to the appliance, which may then correlate that information, e.g., against correlation rules, to verify its determination of the exploit or malware. In addition, the appliance may task the endpoints to analyze the object, e.g., during run time, to determine whether it contains the exploit and provide the results to the appliance for correlation.
1. A method comprising:
acquiring an object at an appliance coupled to a network;
conducting an analysis of the object at the appliance to render an initial determination that the object is suspicious;
polling each endpoint of a plurality of endpoints coupled to the network to (i) determine whether an endpoint performed a cybersecurity analysis on the object and observed behaviors of the object during the cybersecurity analysis and (ii) provide behavior information of the object to the appliance, the behavior information including the observed behaviors by the endpoint;
correlating the behavior information provided by the plurality of endpoints at the appliance to verify a subsequent determination that the object contains at least one of an exploit and malware; and
wherein, responsive to none of the plurality of endpoints performing a cybersecurity analysis on the object, tasking each of the plurality of endpoints to analyze the object to determine whether the object contains the exploit or the malware and return resulting behavior information of the object to the appliance.
2. The method of claim 1 , wherein the polling of each endpoint of the plurality of endpoints includes gathering of the behavior information from the plurality of endpoints.
3. The method of claim 1 , wherein the correlating of the behavior information comprises applying the behavior information against correlation rules to verify whether the object contains the exploit or the malware.
4. The method of claim 3 , wherein the applying of the behavior information against correlation rules provides information associated with a potential spreading of the exploit or malware within the network including the plurality of endpoints.
5. The method of claim 1 , wherein the correlating of the behavior information comprises applying the behavior information against correlation rules to identify a pattern of activity associated with the object throughout the network, where the behavior information provides a sampling size sized to obtain a more complete view of the activity pattern.
6. The method of claim 1 , wherein the appliance is configured to communicate with and instruct the endpoint of the plurality of endpoints, the endpoint and the appliance are in communication via a security information and event manager (SIEM) appliance.
7. The method of claim 1 , wherein prior to polling the plurality of endpoints, the method further comprising:
tasking, by the appliance, at least one endpoint of the plurality of endpoints to analyze the object if the object has not been previously analyzed at the at least one endpoint.
8. A non-transitory storage medium deployed within an appliance that is coupled to a network and includes software that, upon execution, performs a plurality of operations, comprising:
acquiring an object over the network;
conducting an analysis of the object to render a first determination that the object is suspicious;
polling each endpoint of a plurality of endpoints coupled to the network to (i) determine whether an endpoint performed a cybersecurity analysis on the object and observed behaviors of the object during the cybersecurity analysis and (ii) provide behavior information of the object to the appliance, the behavior information including the observed behaviors by the endpoint and the cybersecurity analyses conducted by the plurality of endpoints being independent of the analysis conducted by the appliance; and
correlating the behavior information provided by the plurality of endpoints to verify a second determination, performed subsequent to the first determination, whether the object contains at least one of an exploit and malware.
9. The non-transitory storage medium of claim 8 , wherein the polling of the plurality of endpoints conducted by the software includes gathering of the behavior information from the endpoints.
10. The non-transitory storage medium of claim 8 , wherein the correlating of the behavior information conducted by the software comprises applying the behavior information against correlation rules to verify whether the object contains the exploit or the malware.
11. The non-transitory storage medium of claim 10 , wherein the applying of the behavior information against correlation rules by the software provides information associated with a potential spreading of the exploit or malware within the network including the plurality of endpoints.
12. The non-transitory storage medium of claim 8 , wherein the correlating of the behavior information conducted by the software comprises applying the behavior information against correlation rules to identify a pattern of activity associated with the object throughout the network, where the behavior information provides a sampling size sized to obtain a more complete view of the activity pattern.
13. The non-transitory storage medium of claim 8 being deployed within the appliance configured to communicate with and instruct an endpoint of the plurality of endpoints, the endpoint and the appliance are in communication via a security information and event manager (SIEM) appliance.
14. The non-transitory storage medium of claim 8 including software being further configured to perform operations comprising:
tasking at least one endpoint of the plurality of endpoints to analyze the object if the object has not been previously analyzed at the at least one endpoint.
15. An appliance comprising:
a processor; and
a non-transitory storage medium including software that, upon execution by the processor, performs operations including
acquiring an object over a network,
conducting an analysis of the object to render a first determination that the object is suspicious,
polling each endpoint of a plurality of endpoints coupled to the network to receive behavior information of the object, the behavior information is observed from cybersecurity analyses of the object conducted at each endpoint of the plurality of endpoints and the cybersecurity analyses conducted by the plurality of endpoints being independent of the analysis conducted by the appliance, and
correlating the behavior information provided by the endpoints to verify a second determination, performed subsequent to the first determination, whether the object contains at least one of an exploit and malware.
16. The appliance of claim 15 , wherein the software, upon execution by the processor, is configured to correlate the behavior information conducted by the software by at least applying the behavior information against correlation rules to verify whether the object contains the exploit or the malware.
17. The appliance of claim 16 , wherein the applying of the behavior information against correlation rules by the software provides information associated with a potential spreading of the exploit or malware within the network including the plurality of endpoints.
18. The appliance of claim 15 , wherein the software, upon execution by the processor, is configured to correlate the behavior information by at least applying the behavior information against correlation rules to identify a pattern of activity associated with the object throughout the network, where the behavior information provides a sampling size that is sized to obtain a more complete view of the activity pattern.
19. The appliance of claim 15 , wherein the software, upon execution by the processor, is configured to communicate with and instruct an endpoint of the plurality of endpoints, the endpoint and the appliance are in communication via a security information and event manager (SIEM) appliance.
20. The appliance of claim 15 , where the software, upon execution by the processor, is further configured to perform operations comprising:
tasking at least one endpoint of the plurality of endpoints to analyze the object if the object has not been previously analyzed at the at least one endpoint.