DETECTING KERNEL EXPLOITS
Monitoring is performed for the activation of a set of one or more previously attached Kprobes. A determination is made that a strategy pattern match has occurred. The strategy pattern comprises a set of one or more behaviors including the activation of the at least one Kprobe included in the set of Kprobes. A remedial action is taken in response to the determination. Examples of such remedial actions include generating an alert and terminating a network connection.
1 - 20 . (canceled)
21 . A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, causes the one or more computing devices to perform the steps of:
monitoring a kernel of a computing node for an activation of at least one of a plurality of telemetry collection mechanisms including at least one Kprobe providing an on-demand collection hook for exported kernel symbols and at least one Kretprobe to collect data on function entry to the kernel or on function return from the kernel;
determining that a strategy pattern match has occurred with a detection strategy for a stack pivot by detecting, with the activation of at least one of the plurality of telemetry collection mechanisms, that a stack pointer has referenced an address outside normal stack bounds; and
in response to the strategy pattern match occurring, taking a remedial action to an exploit chain on the computing node associated with the stack pivot.
22 . The computer program product of claim 21 , further comprising code that causes the one or more computing devices to perform the step of attempting to use a highest performing one or more of the telemetry collection mechanisms available on the computing node.
23 . The computer program product of claim 21 , wherein the plurality of telemetry collection mechanisms is configured to operate below a resource threshold for the computing node.
24 . The computer program product of claim 23 , wherein the resource threshold includes a CPU resource threshold.
25 . The computer program product of claim 23 , wherein the resource threshold includes a RAM resource threshold.
26 . The computer program product of claim 23 , wherein the plurality of telemetry collection mechanisms is configured to throttle or drop data to prevent resource usage from exceeding the resource threshold.
27 . The computer program product of claim 21 , further comprising code that causes the one or more computing devices to perform the step of scanning kernel memory to determine whether a security mechanism associated with the strategy pattern match has been disabled.
28 . The computer program product of claim 21 , wherein the remedial action includes generating an alert for the computing node.
29 . The computer program product of claim 21 , wherein the remedial action includes terminating a network connection of the computing node.
30 . A method, comprising:
monitoring a kernel of a computing node with a sensor for an activation of one or more collection mechanisms associated with the sensor, the one or more collection mechanisms including at least one of a Kprobe and a Kretprobe that provide telemetry data from the kernel for the sensor;
determining that a strategy pattern match has occurred with a detection strategy for a stack pivot by detecting, with the activation of at least one of the one or more collection mechanisms, that a stack pointer has referenced an address outside normal stack bounds; and
in response to the strategy pattern match occurring, taking a remedial action to an exploit chain on the computing node associated with the stack pivot.
31 . The method of claim 30 , wherein the sensor attempts to use a highest performing one or more of the collection mechanisms available on the computing node.
32 . The method of claim 30 , wherein the sensor is configured to operate below a resource threshold for the computing node.
33 . The method of claim 32 , wherein the resource threshold includes a CPU resource threshold.
34 . The method of claim 32 , wherein the resource threshold includes a RAM resource threshold.
35 . The method of claim 32 , wherein the sensor is configured to throttle or drop data to prevent resource usage by the sensor from exceeding the resource threshold.
36 . The method of claim 30 , further comprising scanning kernel memory to determine whether a security mechanism associated with the strategy pattern match has been disabled.
37 . The method of claim 30 , wherein the remedial action includes at least one of generating an alert and terminating a network connection.
38 . A system, comprising:
a computing node executing a kernel on a processor;
a memory on the computing node, the memory storing instructions; and
a sensor on the computing node, the sensor configured to detect an activation of a plurality of collection mechanisms including at least one of a Kprobe and a Kretprobe that provide telemetry data from the kernel; wherein the processor is configured by the instructions stored in the memory to perform the steps of:
monitoring the kernel of the computing node with the sensor,
determining that a strategy pattern match has occurred with a detection strategy for a stack pivot by detecting, based on the telemetry data from the sensor, that a stack pointer has made a reference to an address outside normal stack bounds, and
in response to the strategy pattern match occurring, taking a remedial action to an exploit chain on the computing node associated with the stack pivot.
39 . The system of claim 38 , wherein the sensor is configured to attempt to use a highest performing one or more of the plurality of collection mechanisms available on the computing node.
40 . The system of claim 38 , wherein the remedial action includes at least one of generating an alert and terminating a network connection.