Process tree and tags
Information associated with a process is received. At least a portion of the received information is used to modify a Process Tree. Modifying the Process Tree includes at least one of: (1) adding a Tag to the Process Tree and (2) modifying a Tag in the Process Tree. An Alert is generated based at least in part in response to determining that a Strategy has been matched.
1. A system, comprising:
a memory storing instructions: and
a processor coupled to the memory and configured by the instructions to:
receive information associated with a process event including a transition;
use at least a portion of the received information to modify a Process Tree_by propagating tag information according to tag propagation logic, wherein modifying the Process Tree includes at least one of:
(1) adding a Tag to the Process Tree for a process created by the process event, and
(2) modifying an original authorized shell Tag in the Process Tree for an existing process exited by the process event;
determine that at least a portion of the Process Tree matches a malware pattern: and
generate an Alert, based at least in part in response to determining that the malware pattern has been matched.
2. The system of claim 1 , wherein the received information indicates that the process has been forked.
3. The system of claim 1 , wherein the received information indicates that the process has been initialized.
4. The system of claim 1 , wherein the received information indicates that the process has been exited.
5. The system of claim 1 , wherein, in response to receiving the information, the processor is configured to determine whether any Tags are associated with the process.
6. The system of claim 5 , wherein the processor is further configured to determine whether any Tags determined to be associated with the process expect to have a callback associated with an Event.
7. The system of claim 1 , wherein the information includes a change to at least one of a UID and a GID.
8. The system of claim 1 , wherein the Alert indicates that an insecure privilege escalation has occurred.
9. The system of claim 1 , wherein the Alert indicates an original user that is different from a user currently associated with the process.
10. The system of claim 1 , wherein the Process Tree uses a timeout-driven hash map.
11. The system of claim 1 , wherein the information is received from a sensor executing in a user space without kernel modification.
12. The system of claim 1 , wherein the information is read out of a ring buffer.
13. The system of claim 1 , wherein the processor is further configured to propagate an Alert group to children of the process.
14. The system of claim 1 , wherein the malware pattern comprises a cross-node Strategy.
15. The system of claim 1 , wherein the Alert includes a lineage associated with the process.
16. The system of claim 1 , wherein, in response to the Alert being generated, a remedial action is taken.
17. The system of claim 16 , wherein the remedial action includes contacting a user associated with the process.
18. A method, comprising:
receiving information associated with a process event including a transition;
using at least a portion of the received information to modify a Process Tree_by propagating tag information according to tag propagation logic, wherein modifying the Process Tree includes at least one of:
(1) adding a Tag to the Process Tree for a process created by the process event, and
(2) modifying an original authorized shell Tag in the Process Tree for an existing process exited by the process event;
determining that at least a portion of the Process Tree matches a malware pattern: and
generating an Alert, based at least in part in response to determining that the malware pattern has been matched.
19. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving information associated with a process event including a transition;
using at least a portion of the received information to modify a Process Tree by propagating tag information according to tag propagation logic, wherein modifying the Process Tree includes at least one of:
(1) adding a Tag to the Process Tree for a process created by the process event, and
(2) modifying an original authorized shell Tag in the Process Tree for an existing process exited by the process event;
determining that at least a portion of the Process Tree matches a malware pattern; and
generating an Alert, based at least in part in response to determining that the malware pattern has been matched.
20. The computer program product of claim 19 , wherein, in response to receiving the information, determining whether any Tags are associated with the process.