Detection of indicators of attack
An information handling system includes a basic input/output system (BIOS), a memory, and a processor. The processor scans a current state of each BIOS attribute in the BIOS, and stores one or more changed attributes in a secure event log in the memory. The processor converts each changed attribute into a different threat event including a first changed attribute into a first threat event. The processor provides a list of threat events to multiple threat chains, each of which determine whether the threat events match threat criteria in a threat chain policy. In response to the threat event matching a threat criterion in the threat chain policy, the threat chain provides a threat state change to the processor, which in turn provides new threat state changes to a threat state change consumer.
1. An information handling system comprising:
a basic input/output system (BIOS), the BIOS including a plurality of BIOS attributes associated with the information handling system;
a memory to store a secure event log associated with the attributes in the BIOS; and
a processor to communicate with the BIOS and with the memory, the processor to:
scan a current state of each of the BIOS attributes;
store one or more changed attributes in the secure event log, wherein the changed attributes include a first changed attribute;
convert each of the changed attributes into a different threat event, including the first changed attribute into a first threat event;
provide a list of threat events including the first threat event to each of a plurality of threat chains;
determine in each of the threat chains whether the first threat event matches threat criteria in a threat chain policy;
in response to the first threat event matching a threat criterion in the threat chain policy, provide a threat state change; and
provide new threat state changes to a threat state change consumer.
2. The information handling system of claim 1 , wherein the providing of the threat state change includes: the processor to return each threat event that matches a threat criterion in the threat chain policy, to store the matched threat events in a threat event history, and to generate the threat state change based on appearance or clearing of an attack of the information handling system.
3. The information handling system of claim 1 , wherein the processor further to return a single threat state change for each threat chain policy.
4. The information handling system of claim 1 , wherein the processor further to generate an aggregated list of threat state changes.
5. The information handling system of claim 1 , wherein the processor further to retrieve a list of existing threat state changes from the secure event log in the memory, and to remove pre-existing threat state changes from the aggregated list of threat state changes.
6. The information handling system of claim 1 , wherein a threat state for the threat chain indicates a full match when each threat criteria for a particular threat chain is matched.
7. The information handling system of claim 1 , wherein the first threat event includes an attribute name and a current value for the attribute.
8. The information handling system of claim 1 , wherein each of the threat chains corresponds to a different type of attack on the information handling system.
9. A method comprising:
scanning, by a processor of an information handling system, a current state of each basic input/output system (BIOS) attribute in a BIOS of the information handling system;
storing one or more changed attributes in a secure event log of a memory of the information handling system, wherein the change attributes include a first changed attribute;
converting, by the processor, each of the changed attributes into a different threat event, including the first changed attribute into a first threat event;
providing a list of threat events including the first threat event to each of a plurality of threat chains;
determining, by each of the threat chains, whether the first threat event matches threat criteria in a threat chain policy; and
in response to the first threat event matching a threat criterion in the threat chain policy, generating a threat state change.
10. The method of claim 9 , wherein the providing of the threat state change further comprises:
returning each threat event that matches a threat criterion in the threat chain policy;
storing the matched threat events in a threat event history; and
generating the threat state change based on appearance or clearing of an attack of the information handling system.
11. The method of claim 9 , further comprising returning a single threat state change for each threat chain policy.
12. The method of claim 9 , further comprising generating an aggregated list of threat state changes.
13. The method of claim 9 , further comprising:
retrieving a list of existing threat state changes from the secure event log in the memory; and
removing pre-existing threat state changes from the aggregated list of threat state changes.
14. The method of claim 9 , wherein a threat state for the threat chain indicates a full match when each threat criteria for a particular threat chain is matched.
15. The method of claim 9 , wherein the first threat event includes an attribute name and a current value for the attribute.
16. The method of claim 9 , wherein each of the threat chains corresponds to a different type of attack on the information handling system.
17. A method comprising: scanning, by a processor of an information handling system, a current state of each basic input/output system (BIOS) attribute in a BIOS of the information handling system; storing one or more changed attributes in a secure event log of a memory of the information handling system, wherein the change attributes include a first changed attribute; converting, by the processor, each of the changed attributes into a different threat event, including the first changed attribute into a first threat event; providing a list of threat events including the first threat event to each of a plurality of threat chains; determining, by each of the threat chains, whether the first threat event matches threat criteria in a threat chain policy; when the first threat event matches a threat criterion in the threat chain policy, then: returning each threat event that matches a threat criterion in the threat chain policy; storing the matched threat events in a threat event history; and generating a threat state change based on appearance or clearing of an attack of the information handling system; retrieving a list of existing threat state changes from the secure event log in the memory; and removing pre-existing threat state changes from the aggregated list of threat state changes.
18. The method of claim 17 , wherein a threat state for the threat chain indicates a full match when each threat criteria for a particular threat chain is matched.
19. The method of claim 17 , wherein the first threat event includes an attribute name and a current value for the attribute.
20. The method of claim 17 , wherein each of the threat chains corresponds to a different type of attack on the information handling system.