Detecting malware by linking background intelligent transfer service (BITS) and scheduled task service (STS) activities to a source program
Detecting malware by linking Background Intelligent Transfer Service (BITS) and Scheduled Task Service (STS) activities to a source program. Using send Advanced Local Procedure Call (ALPC) messages and receive ALPC messages, source programs that initiate the creation of temporary files and perform defined operations may be identified. If the source programs responsible for the temporary files and defined operations are determined to be malware programs, a security action may be performed on the source programs.
1. A computer-implemented method for detecting malware by linking transfer service activities to source programs, at least a portion of the method performed by a computing device comprising one or more processors, a memory, and an operating system stored within the memory, the computer-implemented method comprising:
buffering, in a detection buffer within the memory, a plurality of send Advanced Local Procedure Call (ALPC) messages and a plurality of receive ALPC messages created by the operating system when a Background Intelligent Transfer Service (BITS) of the operating system is used to download one or more files to the computing device from a network;
identifying a first send ALPC message within the plurality of send ALPC messages and a first receive ALPC message within the plurality of receive ALPC messages, wherein the first send ALPC message and the first receive ALPC message have a first common message ID;
pairing the first send ALPC message and the first receive ALPC message to create a first ALPC message pair, wherein the first ALPC message pair includes:
a first timestamp field having a value corresponding to a time of creation of at least one of the first send ALPC message and the first receive ALPC message,
a first ALPC source process ID corresponding to a send process ID of the first send ALPC message,
a first ALPC source thread ID corresponding to a send thread ID of the first send ALPC message,
a first ALPC destination process ID corresponding to a receive process ID of the first receive ALPC message, and
a first ALPC destination thread ID corresponding to a receive thread ID of the first receive ALPC message;
receiving a notification that a temporary file has been created by the BITS, the temporary file created as part of a file download initiated by the source program;
determining that (1) the value in the first timestamp field corresponds to a time of creation of the temporary file, and (2) the first ALPC destination process ID corresponds to a process ID of the temporary file, and (3) the first ALPC destination thread ID corresponds to a thread ID of the temporary file;
evaluating the first ALPC source process ID to identify the source program responsible for initiating the creation of the temporary file;
determining, based at least in part on the temporary file, that the source program is a malware program; and
performing a security action on the source program.
2. The method of claim 1 , further comprising:
receiving a notification that the BITS has renamed the temporary file using a new file name; and
assigning the new file name to the source program.
3. The method of claim 1 , further comprising:
identifying a second send ALPC message within the plurality of send ALPC messages and a second receive ALPC message within the plurality of receive ALPC messages, wherein the second send ALPC message and the second receive ALPC message have a second common message ID;
pairing the second send ALPC message and the second receive ALPC message to create a second ALPC message pair, wherein the second ALPC message pair includes:
a second timestamp field having a value corresponding to a time of creation of at least one of the second send ALPC message and the second receive ALPC message,
a second ALPC source process ID corresponding to a send process ID of the second send ALPC message,
a second ALPC source thread ID corresponding to a send thread ID of the second send ALPC message,
a second ALPC destination process ID corresponding to a receive process ID of the second receive ALPC message, and
a second ALPC destination thread ID corresponding to a receive thread ID of the second receive ALPC message;
receiving a notification that a temporary file has been created by the BITS, the temporary file created as part of a file download initiated by the source program;
determining that (1) the value in the second timestamp field does not correspond to a time of creation of the temporary file, or (2) the second ALPC destination process ID does not correspond to a process ID of the temporary file, or (3) the second ALPC destination thread ID does not correspond to a thread ID of the temporary file; and
discarding the second ALPC message pair.
4. The method of claim 1 , wherein the source program is determined to be a malware program by evaluating the temporary file and determining that the temporary file is a malware file.
5. The method of claim 1 , wherein the security action is quarantining the source program.
6. The method of claim 1 , wherein the security action is deleting the source program.
7. One or more non-transitory computer-readable media comprising one or more computer-readable instructions that, when executed by one or more processors of a computing device, cause the computing device to perform a method for detecting malware by linking transfer service activities to source programs, the method comprising:
buffering, in a detection buffer within a memory, a plurality of send Advanced Local Procedure Call (ALPC) messages and a plurality of receive ALPC messages created by an operating system when a Background Intelligent Transfer Service (BITS) of the operating system is used to download one or more files to the computing device from a network;
identifying a first send ALPC message within the plurality of send ALPC messages and a first receive ALPC message within the plurality of receive ALPC messages, wherein the first send ALPC message and the first receive ALPC message have a first common message ID;
pairing the first send ALPC message and the first receive ALPC message to create a first ALPC message pair, wherein the first ALPC message pair includes:
a first timestamp field having a value corresponding to a time of creation of at least one of the first send ALPC message and the first receive ALPC message,
a first ALPC source process ID corresponding to a send process ID of the first send ALPC message,
a first ALPC source thread ID corresponding to a send thread ID of the first send ALPC message,
a first ALPC destination process ID corresponding to a receive process ID of the first receive ALPC message, and
a first ALPC destination thread ID corresponding to a receive thread ID of the first receive ALPC message;
receiving a notification that a temporary file has been created by the BITS, the temporary file created as part of a file download initiated by the source program;
determining that (1) the value in the first timestamp field corresponds to a time of creation of the temporary file, and (2) the first ALPC destination process ID corresponds to a process ID of the temporary file, and (3) the first ALPC destination thread ID corresponds to a thread ID of the temporary file;
evaluating the first ALPC source process ID to identify the source program responsible for initiating the creation of the temporary file;
determining, based at least in part on the temporary file, that the source program is a malware program; and
performing a security action on the source program.
8. The one or more non-transitory computer-readable media of claim 7 , further comprising:
receiving a notification that the BITS has renamed the temporary file using a new file name; and
assigning the new file name to the source program.
9. The one or more non-transitory computer-readable media of claim 7 , further comprising:
identifying a second send ALPC message within the plurality of send ALPC messages and a second receive ALPC message within the plurality of receive ALPC messages, wherein the second send ALPC message and the second receive ALPC message have a second common message ID;
pairing the second send ALPC message and the second receive ALPC message to create a second ALPC message pair, wherein the second ALPC message pair includes:
a second timestamp field having a value corresponding to a time of creation of at least one of the second send ALPC message and the second receive ALPC message,
a second ALPC source process ID corresponding to a send process ID of the second send ALPC message,
a second ALPC source thread ID corresponding to a send thread ID of the second send ALPC message,
a second ALPC destination process ID corresponding to a receive process ID of the second receive ALPC message, and
a second ALPC destination thread ID corresponding to a receive thread ID of the second receive ALPC message;
receiving a notification that a temporary file has been created by the BITS, the temporary file created as part of a file download initiated by the source program;
determining that (1) the value in the second timestamp field does not correspond to a time of creation of the temporary file, or (2) the second ALPC destination process ID does not correspond to a process ID of the temporary file, or (3) the second ALPC destination thread ID does not correspond to a thread ID of the temporary file; and
discarding the second ALPC message pair.
10. The one or more non-transitory computer-readable media of claim 7 , wherein the source program is determined to be a malware program by evaluating the temporary file and determining that the temporary file is a malware file.
11. The one or more non-transitory computer-readable media of claim 7 , wherein the security action is quarantining the source program.
12. The one or more non-transitory computer-readable media of claim 7 , wherein the security action is deleting the source program.
13. A computer-implemented method for detecting malware by linking scheduled task activities to source programs, at least a portion of the method performed by a computing device comprising one or more processors, a memory, and an operating system stored within the memory, the computer-implemented method comprising:
buffering, in a detection buffer within the memory, a plurality of send Advanced Local Procedure Call (ALPC) messages and a plurality of receive ALPC messages created by the operating system when a Scheduled Task Service (STS) of the operating system is used to schedule a task to be performed by the operating system;
identifying a first send ALPC message within the plurality of send ALPC messages and a first receive ALPC message within the plurality of receive ALPC messages, wherein the first send ALPC message and the first receive ALPC message have a first common message ID;
pairing the first send ALPC message and the first receive ALPC message to create a first ALPC message pair, wherein the first ALPC message pair includes:
a first timestamp field having a value corresponding to a time of creation of at least one of the first send ALPC message and the first receive ALPC message,
a first ALPC source process ID corresponding to a send process ID of the first send ALPC message,
a first ALPC source thread ID corresponding to a send thread ID of the first send ALPC message,
a first ALPC destination process ID corresponding to a receive process ID of the first receive ALPC message, and
a first ALPC destination thread ID corresponding to a receive thread ID of the first receive ALPC message;
receiving a notification that the STS has performed a defined operation, the STS performing the defined operation while in use by the source process;
determining that (1) the value in the first timestamp field corresponds to a time period when the defined operation was performed, and (2) the first ALPC destination process ID corresponds to a process ID of the STS involved in performing the defined operation, and (3) the first ALPC destination thread ID corresponds to a thread ID of the STS involved in performing the defined operation;
evaluating the first ALPC source process ID to identify the source program responsible for performing the defined operation;
determining, based at least in part on the defined operation, that the source program is a malware program; and
performing a security action on the source program.
14. The method of claim 13 , wherein the defined operation corresponds to creation of a file in a defined path.
15. The method of claim 14 , further comprising parsing the file in order to determine one or more tasks created by the source program.
16. The method of claim 15 , further comprising parsing the file to determine one or more commands, which executes the one or more tasks created by the source program.
17. The method of claim 13 , wherein the defined operation corresponds to creation of new entry in a defined registry path.
18. The method of claim 13 , further comprising:
identifying a second send ALPC message within the plurality of send ALPC messages and a second receive ALPC message within the plurality of receive ALPC messages, wherein the second send ALPC message and the second receive ALPC message have a second common message ID;
pairing the second send ALPC message and the second receive ALPC message to create a second ALPC message pair, wherein the second ALPC message pair includes:
a second timestamp field having a value corresponding to a time of creation of at least one of the second send ALPC message and the second receive ALPC message,
a second ALPC source process ID corresponding to a send process ID of the second send ALPC message,
a second ALPC source thread ID corresponding to a send thread ID of the second send ALPC message,
a second ALPC destination process ID corresponding to a receive process ID of the second receive ALPC message, and
a second ALPC destination thread ID corresponding to a receive thread ID of the second receive ALPC message;
receiving a notification that the STS has performed a defined operation, the STS performing the defined operation while in use by the source process;
determining that (1) the value in the second timestamp field does not correspond to a time period when the defined operation was performed, or (2) the second ALPC destination process ID does not correspond to a process ID of the STS involved in performing the defined operation, or (3) the second ALPC destination thread ID does not correspond to a thread ID of the STS involved in performing the defined operation; and
discarding the second ALPC message pair.
19. The method of claim 13 , wherein the source program is determined to be a malware program by evaluating the defined operation and determining that the defined operation is a malware operation.
20. The method of claim 13 , wherein the security action is quarantining or deleting the source program.