Dynamically updating rules for detecting compromised devices
Examples for detecting a compromised device are described. A set of threat detection rules can instruct an application on the client device how to detect whether the client device is compromised. The rules can be updated dynamically and without updating the application that is performing the compromise detection. The rules can be encoded in an interpreted scripting language and executed by a runtime environment that is embedded within the application.
1. A system for detecting a compromised device, comprising:
a client device comprising at least one hardware processor; and
program instructions executable in the client device that, when executed, direct the client device to:
detect a launch condition associated with a threat detection runtime environment, the program instructions being embedded within the application;
retrieve one or more rules from a remotely executed service, the rules specifying how to determine that the client device has been compromised;
execute the threat detection runtime environment within the application;
register an event handler within the threat detection runtime environment based upon the rules, the event handler configured to detect a condition specified by the rules indicating a compromised state; and
detect, using the event handler, the condition by listening for a response to a command executed on the client device that is initiated by the threat detection runtime, wherein the command obtains a property of a file stored on the client device.
2. The system of claim 1 , wherein the condition is detected in response to the file having at least one of a file size, a modified date, or a hash value that is different from an expected value.
3. The system of claim 1 , wherein the condition is detected in response to a system property having a value specified by the rules, wherein the shell command returns a value of the system property to the event handler.
4. The system of claim 1 , wherein the program instructions are embedded within a software development kit (SDK) used to generate the application.
5. The system of claim 1 , wherein rules are defined in a JavaScript file or a WebAssembly file that is interpreted by the threat detection runtime environment.
6. The system of claim 1 , wherein the program instructions direct the client device to take a remedial action in response to detection of the condition corresponding to the compromised condition, the remedial action comprising at least one of: generating a notification user interface element, reporting the condition to a remotely executed management service, or blocking at least one functionality of the application.
7. A non-transitory computer-readable medium for detecting a compromised device embodying program instructions executable in a client device that, when executed by the client device, direct the client device to:
detect a launch condition associated with a threat detection runtime environment, the program instructions being embedded within the application, the program instructions being embedded within the application;
retrieve one or more rules from a remotely executed service, the rules specifying how to determine that the client device has been compromised;
execute the threat detection runtime environment within the application;
register an event handler within the threat detection runtime environment based upon the rules, the event handler configured to detect a condition specified by the rules indicating a compromised state; and
detect, using the event handler, the condition by listening for a response to a command executed on the client device that is initiated by the threat detection runtime, wherein the command obtains a property of a file stored on the client device.
8. The non-transitory computer-readable medium of claim 7 , wherein the condition is detected in response to the file having at least one of a file size, a modified date, or a hash value that is different from an expected value.
9. The non-transitory computer-readable medium of claim 7 , wherein the condition is detected in response to a system property having a value specified by the rules, wherein the shell command returns a value of the system property to the event handler.
10. The non-transitory computer-readable medium of claim 7 , wherein the program instructions are embedded within a software development kit (SDK) used to generate the application.
11. The non-transitory computer-readable medium of claim 7 , wherein the rules are defined in a JavaScript file or a WebAssembly file that is interpreted by the threat detection runtime environment.
12. The non-transitory computer-readable medium of claim 7 , wherein the program instructions direct the client device to take a remedial action in response to detection of the condition corresponding to the compromised condition, the remedial action comprising at least one of: generating a notification user interface element, reporting the condition to a remotely executed management service, or blocking at least one functionality of the application.
13. A method for detecting a compromised client device, comprising:
detecting a launch condition associated with a threat detection runtime environment, the program instructions being embedded within the application;
retrieving one or more rules from a remotely executed service, the rules specifying how to determine that the client device has been compromised;
executing the threat detection runtime environment within the application;
registering an event handler within the threat detection runtime environment based upon the rules, the event handler configured to detect a condition specified by the rules indicating a compromised state; and
detecting, using the event handler, the condition by listening for a response to a command executed on the client device that is initiated by the threat detection runtime, wherein the command obtains a property of a file stored on the client device.
14. The method of claim 13 , wherein the condition is detected in response to the file having at least one of a file size, a modified date, or a hash value that is different from an expected value.
15. The method of claim 13 , wherein the condition is detected in response to a system property having a value specified by the rules, wherein the shell command returns a value of the system property to the event handler.
16. The method of 13 , wherein the rules are defined in a JavaScript file or a WebAssembly file that is interpreted by the threat detection runtime environment.
17. The method of 13 , further comprising taking a remedial action in response to detection of the condition corresponding to the compromised condition, the remedial action comprising at least one of: generating a notification user interface element, reporting the condition to a remotely executed management service, or blocking at least one functionality of the application.