Method and apparatus to identify creator of com process created using ole automation
An apparatus includes a memory that stores instructions; and a processing unit that executes the instructions to identify a created process, to receive a notification of a first event for an ancestor process and a notification for a second event for the created process, the notification of the first event indicating a first ActivityID and a first ID, the notification of the second event indicating a second ActivityID and a second ID, the first ID being different from the second ID, to perform a first determination that the created process was created by a component object model (COM) call, at least in part based on the second ID, and to perform a second determination that the ancestor process indirectly created the created process, at least in part based on the first and second ActivityIDs and the first determination.
1. An apparatus comprising:
interface circuitry;
machine-readable instructions; and
at least one processor circuit to be programmed by the machine-readable instructions to:
capture a first event message for a first event in an event log, the first event message including a first ID of the first event, and a first timestamp;
capture a second event message for a second event in the event log, the second event message including a second ID of the second event, the second ID different than the first ID, and a second timestamp occurring after the first timestamp;
identify a second process based on the second event message;
determine that the second process was created by a component object model (COM) call, at least in part based on the second ID;
determine that a first process initiated the COM call, at least in part based on the first event message and the second event message; and
execute a malware scan of a parent of the first process, at least in part based on the determination that the first process initiated the COM call.
2. The apparatus of claim 1 , wherein one or more of the at least one processing circuit is to cause display of the first process, at least in part based on the determination that the first process initiated the COM call.
3. The apparatus of claim 1 , wherein, to determine that the first process initiated the COM call, one or more of the at least one processor circuit is to parse a command line or a content of the first process and determine the first process created a COM server process, based on the parsed command line or parsed content.
4. The apparatus of claim 1 , wherein one or more of the at least one processor circuit is to determine that the first process initiated the COM call based on a determination that the second event message indicates an interface of IClassFactory or IClassFactory2.
5. The apparatus of claim 1 , wherein one or more of the at least one processor circuit is to:
identify a third event for the first process, the third event having a third ID different than the first ID and the second ID; and
determine the first process initiated the COM call based on a determination that the second event occurred before the third event.
6. The apparatus of claim 1 , wherein one or more of the at least one processor circuit is to:
identify a fourth event for the second process, the fourth event having a fourth ID different than the first ID and the second ID; and
determine that the first process initiated the COM call based on a determination that the fourth event occurred after the first event.
7. The apparatus of claim 1 , wherein one or more of the at least one processor circuit is to determine that the first process initiated the COM call based on the first ID, the second ID, the first timestamp, and the second timestamp.
8. At least one non-transitory computer-readable medium comprising computer-readable instructions to cause at least one processor circuit to at least:
analyze a first event message from an event log, the first event message including a first ID of a first event and a first timestamp;
analyze a second event message from an event log, the second event message including a second ID of a second event and a second timestamp, the second ID different than the first ID and the second timestamp after the first timestamp;
identify a second process based on the second event message;
determine that the second process was created by a component object model (COM) call, at least in part based on the second ID;
determine that a first process initiated the COM call, at least in part based on the first event message and the second event message; and
execute a malware scan of a parent of the first process, at least in part based on the determination that the first process initiated the COM call.
9. The at least one non-transitory computer-readable medium of claim 8 , wherein the computer-readable instructions are to cause one or more of the at least one processor circuit to:
cause a display of the first process, at least in part based on the determination that the first process initiated the COM call.
10. The at least one non-transitory computer-readable medium of claim 8 , wherein the computer-readable instructions are to cause one or more of the at least one processor circuit to parse a command line or a content of the first process and determine that the first process created a COM server process, based on the parsed command line or parsed content, to determine that the first process initiated the COM call.
11. The at least one non-transitory computer-readable medium of claim 8 , wherein the computer-readable instructions are to cause one or more of the at least one processor circuit to determine that the first process initiated the COM call based on a determination that the second event message indicates an interface of IClassFactory or IClassFactory2.
12. The at least one non-transitory computer-readable medium of claim 8 , wherein the computer-readable instructions are to cause one or more of the at least one processor circuit to:
identify a third event for the first process, the third event having a third ID different than the first ID and the second ID; and
determine that the first process initiated the COM call based on a determination that the second event occurred before the third event.
13. The at least one non-transitory computer-readable medium of claim 8 , wherein the computer-readable instructions are to cause one or more of the at least one processor circuit to:
identify a fourth event for the second process, the fourth event having a fourth ID different than the first ID and the second ID; and
determine the first process initiated the COM call based on a determination that the fourth event occurred after the first event.
14. The at least one non-transitory computer-readable medium of claim 8 , wherein the computer-readable instructions are to cause one or more of the at least one processor circuit to determine that the first process initiated the COM call based on the first ID, the second ID, the first timestamp, and the second timestamp.
15. A method implemented by a computing device, the method comprising:
capturing a first event message for a first event in an event log, the first event message including a first ID of the first event, and a first timestamp;
capturing a second event message for a second event in the event log, the second event message including a second ID of the second event, the second ID different than the first ID, and a second timestamp occurring after the first timestamp;
identifying a second process based on the second event message;
determining that the second process was created by a component object model (COM) call, at least in part based on the second ID;
determining that a first process initiated the COM call, at least in part based on the first event message and the second event message; and
executing a malware scan of a parent of the first process, at least in part based on the determination that the first process initiated the COM call.
16. The method of claim 15 , further including causing a display of the first process, at least in part based on the determination that the first process initiated the COM call.
17. The method of claim 15 , wherein determining the first process initiated the COM call includes parsing a command line or a content of the first process and determining the first process created a COM server process based on the parsed command line or parsed content.
18. The method of claim 15 , wherein determining the first process initiated the COM call is based on a determination that the second event message indicates an interface of IClassFactory or IClassFactory2.
19. The method of claim 15 , further including identifying a third event for the first process, the third event having a third ID different than the first ID and the second ID, wherein determining that the first process initiated the COM call includes determining that the second event occurred before the third event.
20. The method of claim 15 , further including identifying a fourth event for the second process, the fourth event having a fourth ID different than the first ID and the second ID, wherein determining that the first process initiated the COM call includes determining that the fourth event occurred after the first event.