Process tree and tags
Information associated with a process is received. At least a portion of the received information is used to modify a Process Tree. Modifying the Process Tree includes at least one of: (1) adding a Tag to the Process Tree and (2) modifying a Tag in the Process Tree. An Alert is generated based at least in part in response to determining that a Strategy has been matched.
1 . A computer program product comprising computer executable code embodied in in a non-transitory computer readable storage medium that, when executing on one or more processors, causes the one or more processors to perform steps comprising:
storing a process tree that includes a plurality of processes executing on a computing system;
storing one or more tags for the plurality of processes in the process tree, wherein:
each tag contains state information about an associated one of the plurality of processes, and
each tag propagates within the process tree according to an inheritance property that identifies the tag as at least one of inheritable, not inheritable, or inherited;
applying a detection strategy based on data in the process tree to detect events on the computing system indicative of a malicious behavior;
in response to a detection of the malicious behavior on the computing system with the detection strategy, generating an alert for one of the plurality of processes in the process tree; and
propagating the alert as an additional tag in the process tree based on a corresponding inheritance property for the alert.
2 . The computer program product of claim 1 , wherein the computing system is at least one of a workload instance, a server, a legacy system, a hardware computing system, a cloud-hosted workload instance, and a node.
3 . The computer program product of claim 1 , wherein the alert indicates that an insecure privilege escalation has occurred.
4 . The computer program product of claim 1 , wherein the alert indicates an original user that is different from a user currently associated with the one of the plurality of processes.
5 . The computer program product of claim 1 , wherein the alert indicates a propagation of an interactive shell in the process tree.
6 . The computer program product of claim 1 , wherein the detection strategy is based on one of the one or more tags indicating an interactive shell use.
7 . The computer program product of claim 1 , wherein the detection strategy is based on information received from a sensor executing in a user space of the computing system.
8 . The computer program product of claim 1 , further comprising code that performs the steps of:
receiving information associated with the one of the plurality of processes; and
modifying the process tree based on the information.
9 . The computer program product of claim 8 , wherein modifying the process tree includes adding a new tag to the process tree.
10 . The computer program product of claim 8 , wherein modifying the process tree includes modifying one of the one or more tags for processes in the process tree.
11 . The computer program product of claim 1 , further comprising code that performs the step of, in response to the detection of the malicious behavior on the computing system, initiating a remedial action on the computing system.
12 . A method comprising:
storing a process tree that includes a plurality of processes executing on a computing system;
storing one or more tags for the plurality of processes in the process tree, wherein:
each tag contains state information about an associated one of the plurality of processes, and
each tag propagates within the process tree according to an inheritance property that identifies the tag as at least one of inheritable, not inheritable, or inherited;
applying a detection strategy to detect events on the computing system indicative of a malicious behavior;
in response to a detection of the malicious behavior on the computing system with the detection strategy, generating an alert for one of the plurality of processes; and
propagating the alert as an additional tag in the process tree based on a corresponding inheritance property for the alert.
13 . The method of claim 12 , wherein the detection strategy is based on data from the process tree.
14 . The method of claim 12 , wherein the computing system is at least one of a workload instance, a server, a legacy system, a hardware computing system, a cloud-hosted workload instance, and a node.
15 . The method of claim 12 , wherein the alert indicates that an insecure privilege escalation has occurred.
16 . The method of claim 12 , wherein the alert indicates an original user that is different from a user currently associated with the one of the plurality of processes.
17 . The method of claim 12 , wherein the detection strategy is based on one of the one or more tags indicating an interactive shell use.
18 . The method of claim 12 , wherein the detection strategy is based on information received from a sensor executing in a user space of the computing system.
19 . The method of claim 12 , further comprising, in response to the detection of the malicious behavior on the computing system, initiating a remedial action on the computing system.
20 . A system, the system comprising a processor configured by computer executable code stored in a memory to perform steps comprising:
storing a process tree that includes a plurality of processes executing on a computing system;
storing one or more tags for the plurality of processes in the process tree, wherein:
each tag contains state information about an associated one of the plurality of processes, and
each tag propagates within the process tree according to an inheritance property that identifies the tag as at least one of inheritable, not inheritable, or inherited;
applying a detection strategy to detect events on the computing system indicative of a malicious behavior;
in response to a detection of the malicious behavior on the computing system with the detection strategy, generating an alert for one of the plurality of processes; and
propagating the alert as an additional tag in the process tree based on a corresponding inheritance property for the alert.