Detecting kernel exploits
Monitoring is performed for the activation of a set of one or more previously attached Kprobes. A determination is made that a strategy pattern match has occurred. The strategy pattern comprises a set of one or more behaviors including the activation of the at least one Kprobe included in the set of Kprobes. A remedial action is taken in response to the determination. Examples of such remedial actions include generating an alert and terminating a network connection.
1. A system, comprising:
a memory storing instructions; and
a processor configured by the instructions stored in the memory to:
monitor a kernel of a computing node for the activation of a set of one or more previously attached Kprobes;
determine that a strategy pattern match has occurred by detecting, with an activation of at least one of the previously attached Kprobes, a modification to a bit in a control register of the computing node that disables execution prevention or access prevention in a memory of the kernel of the computing node; and
take a remedial action in response to the determination that the strategy pattern has been matched.
2. The system of claim 1 wherein the processor is further configured to set a debugging tracepoint.
3. The system of claim 1 wherein the remedial action includes generating an alert.
4. The system of claim 1 wherein the remedial action includes terminating a network connection.
5. The system of claim 1 wherein the strategy pattern is associated with setting a CR4 control register.
6. The system of claim 1 wherein the strategy pattern is associated with a function being called with a return address in userland.
7. The system of claim 1 wherein the strategy pattern is associated with credential preparation.
8. The system of claim 1 wherein the processor is further configured to scan kernel memory to determine whether a security mechanism has been disabled.
9. The system of claim 1 wherein a filter for a magic cookie value is applied as a function argument to determine whether a security mechanism has been disabled.
10. The system of claim 1 wherein at least one Kprobe included in the set of Kprobes is periodically triggered by a Sensor.
11. A method, comprising:
monitoring a kernel of a computing node for the activation of a set of one or more previously attached Kprobes;
determining that a strategy pattern match has occurred by detecting, with an activation of at least one of the previously attached Kprobes, a modification to a bit in a control register of the computing node that disables execution prevention or access prevention in a memory of the kernel of the computing node; and
taking a remedial action in response to the determination that the strategy pattern has been matched.
12. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
monitoring a kernel of a computing node for the activation of a set of one or more previously attached Kprobes;
determining that a strategy pattern match has occurred by detecting, with an activation of at least one of the previously attached Kprobes, a modification to a bit in a control register of the computing node that disables execution prevention or access prevention in a memory of the kernel of the computing node; and
taking a remedial action in response to the determination that the strategy pattern has been matched.
13. The method of claim 11 further including setting a debugging tracepoint.
14. The method of claim 11 wherein the remedial action includes generating an alert.
15. The method of claim 11 wherein the remedial action includes terminating a network connection.
16. The method of claim 11 wherein the strategy pattern is associated with setting a CR4 control register.
17. The method of claim 11 wherein the strategy pattern is associated with a function being called with a return address in userland.
18. The method of claim 11 wherein the strategy pattern is associated with credential preparation.
19. The method of claim 11 further including scanning kernel memory to determine whether a security mechanism has been disabled.
20. The method of claim 11 further including applying a filter for a magic cookie value as a function argument to determine whether a security mechanism has been disabled.