Process tree and tags

1. A system, comprising:

a processor configured to:

receive information associated with a process;

use at least a portion of the received information to modify a Process Tree, wherein modifying the Process Tree includes at least one of: (1) adding a Tag to the Process Tree, including by adding a new authorized heir Tag to the Process Tree in response to determining that an original authorized shell process is still alive, and (2) modifying a Tag in the Process Tree;

return a NIL in response to determining that the original authorized shell process is dead; and

generate an Alert, based at least in part in response to determining that a Strategy has been matched; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 , wherein the received information indicates that the process has been forked.

3. The system of claim 1 , wherein the received information indicates that the process has been initialized.

4. The system of claim 1 , wherein the received information indicates that the process has been exited.

5. The system of claim 1 , wherein, in response to receiving the information, the processor is configured to determine whether any Tags are associated with the process.

6. The system of claim 5 , wherein the processor is further configured to determine whether any Tags determined to be associated with the process expect to have a callback associated with an Event.

7. The system of claim 1 , wherein the information includes a change to at least one of a UID and a GID.

8. The system of claim 1 , wherein the Alert indicates that an insecure privilege escalation has occurred.

9. The system of claim 1 , wherein the Alert indicates an original user that is different from a user currently associated with the process.

10. The system of claim 1 , wherein the Process Tree uses a timeout-driven hash map.

11. The system of claim 1 , wherein the information is received from a sensor executing in a user space without kernel modification.

12. The system of claim 1 , wherein the information is read out of a ring buffer.

13. The system of claim 1 , wherein the processor is further configured to propagate an Alert group to children of the process.

14. The system of claim 1 , wherein the Strategy comprises a cross-node Strategy.

15. The system of claim 1 , wherein the Alert includes a lineage associated with the process.

16. The system of claim 1 , wherein, in response to the Alert being generated, a remedial action is taken.

17. The system of claim 16 , wherein the remedial action includes contacting a user associated with the process.

18. A method, comprising:

receiving information associated with a process;

using at least a portion of the received information to modify a Process Tree, wherein modifying the Process Tree includes at least one of: (1) adding a Tag to the Process Tree, including by adding a new authorized heir Tag to the Process Tree in response to determining that an original authorized shell process is still alive, and (2) modifying a Tag in the Process Tree;

returning a NIL in response to determining that the original authorized shell process is dead; and

generating an Alert, based at least in part in response to determining that a Strategy has been matched.

19. The method of claim 18 , wherein the received information indicates that the process has been forked.

20. The method of claim 18 , wherein the received information indicates that the process has been initialized.

21. The method of claim 18 , wherein the received information indicates that the process has been exited.

22. The method of claim 18 , further comprising, in response to receiving the information, determining whether any Tags are associated with the process.

23. The method of claim 22 , further comprising determining whether any Tags determined to be associated with the process expect to have a callback associated with an Event.

24. The method of claim 18 , wherein the information includes a change to at least one of a UID and a GID.

25. The method of claim 18 , wherein the Alert indicates that an insecure privilege escalation has occurred.

26. The method of claim 18 , wherein the Alert indicates an original user that is different from a user currently associated with the process.

27. The method of claim 18 , wherein the Process Tree uses a timeout-driven hash map.

28. The method of claim 18 , wherein the information is received from a sensor executing in a user space without kernel modification.

29. The method of claim 18 , wherein the information is read out of a ring buffer.

30. The method of claim 18 , further comprising propagating an Alert group to children of the process.

31. The method of claim 18 , wherein the Strategy comprises a cross-node Strategy.

32. The method of claim 18 , wherein the Alert includes a lineage associated with the process.

33. The method of claim 18 , wherein, in response to the Alert being generated, a remedial action is taken.

34. The method of claim 33 , wherein the remedial action includes contacting a user associated with the process.

35. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

receiving information associated with a process;

using at least a portion of the received information to modify a Process Tree, wherein modifying the Process Tree includes at least one of: (1) adding a Tag to the Process Tree, including by adding a new authorized heir Tag to the Process Tree in response to determining that an original authorized shell process is still alive, and (2) modifying a Tag in the Process Tree;

returning a NIL in response to determining that the original authorized shell process is dead; and

generating an Alert, based at least in part in response to determining that a Strategy has been matched.