Security threat detection based on process information
Example methods and systems for a computer system to perform security threat detection are described. In one example, a computer system may intercept an egress packet from a virtualized computing instance to pause forwarding of the egress packet towards a destination and obtain process information associated a process from which the egress packet originates. The computer system may initiate security analysis based on the process information. In response to determination that the process is a potential security threat based on the security analysis, the egress packet may be dropped, and a remediation action performed. Otherwise, the egress packet may be forwarded towards the destination.
1. A method for a computer system to perform security threat detection, wherein the method comprises:
intercepting, by the computer system, an egress packet from a virtualized computing instance running on the computer system itself to pause forwarding of the egress packet towards a destination;
obtaining, by the computer system, process information from an introspection agent running on the virtualized computing instance, wherein the process information is associated with a process from which the egress packet originates, and the process runs on the virtualized computing instance;
based on the obtained process information, initiating, by the computer system, a security analysis of the process; and
in response to determination that the running process is a potential security threat based on the security analysis, dropping, by the computer system, the egress packet and performing, by the computer system, a remediation action; but otherwise, allowing, by the computer system, forwarding of the egress packet towards the destination.
2. The method of claim 1 , wherein obtaining the process information comprises:
based on the egress packet, extracting identification information associated with the virtualized computing instance or the process, or both; and
based on the identification information, obtaining the process information from the introspection agent.
3. The method of claim 1 , wherein initiating the security analysis comprises:
performing a preliminary analysis of the egress packet in the form of a domain name service (DNS) query, wherein the result of the DNS query indicates that the egress packet resolves to a domain name associated with a botnet or the egress packet is destined for a member of the botnet.
4. The method of claim 3 , wherein based on resolving the egress packet to a domain name associated with a botnet or the egress packet being destined for a member of the botnet, the security analysis further comprises performing one or more of the following:
(a) a scan to identify at least one malicious attribute associated with the process based on the process information; and
(b) a process execution in a test environment to identify at least one malicious runtime behavior associated with the process based on the process information.
5. The method of claim 4 , wherein initiating the security analysis comprises:
based on the process information that includes binary information associated with the process, executing the binary information in the test environment that is isolated from a production environment in which the virtualized computing instance operates.
6. The method of claim 4 , wherein initiating the security analysis comprises:
based on the process information that includes binary information associated with the process, performing a static scan to identify the at least one malicious attribute from the binary information.
7. The method of claim 4 , wherein initiating the security analysis comprises:
based on the process information that includes memory information associated with the process, performing a memory scan to identify the at least one malicious attribute from the memory information.
8. A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a physical processor of a computer system, cause the physical processor to perform security threat detection, wherein the method comprises:
intercepting, by the computer system itself, an egress packet from a virtualized computing instance running on the computer system to pause forwarding of the egress packet towards a destination;
obtaining, by the computer system, process information from an introspection agent running on the virtualized computing instance, wherein the process information is associated with a process from which the egress packet originates, and the process runs on the virtualized computing instance;
based on the obtained process information, initiating, by the computer system, a security analysis of the process; and
in response to determination that the running process is a potential security threat based on the security analysis, dropping, by the computer system, the egress packet and performing, by the computer system, a remediation action; but otherwise, allowing, by the computer system, forwarding of the egress packet towards the destination.
9. The non-transitory computer-readable storage medium of claim 8 , wherein obtaining the process information comprises:
based on the egress packet, extracting identification information associated with the virtualized computing instance or the process, or both; and
based on the identification information, obtaining the process information from the introspection agent.
10. The non-transitory computer-readable storage medium of claim 8 , wherein initiating the security analysis comprises:
performing a preliminary analysis of the egress packet in the form of a domain name service (DNS) query, wherein the result of the DNS query indicates that the egress packet resolves to a domain name associated with a botnet or the egress packet is destined for a member of the botnet.
11. The non-transitory computer-readable storage medium of claim 10 , wherein based on resolving the egress packet to a domain name associated with a botnet or the egress packet being destined for a member of the botnet, the security analysis further comprises performing one or more of the following:
(a) a scan to identify at least one malicious attribute associated with the process based on the process information; and
(b) a process execution in a test environment to identify at least one malicious runtime behavior associated with the process based on the process information.
12. The non-transitory computer-readable storage medium of claim 11 , wherein initiating the security analysis comprises:
based on the process information that includes binary information associated with the process, executing the binary information in the test environment that is isolated from a production environment in which the virtualized computing instance operates.
13. The non-transitory computer-readable storage medium of claim 11 , wherein initiating the security analysis comprises:
based on the process information that includes binary information associated with the process, performing a static scan to identify the at least one malicious attribute from the binary information.
14. The non-transitory computer-readable storage medium of claim 11 , wherein initiating the security analysis comprises:
based on the process information that includes memory information associated with the process, performing a memory scan to identify the at least one malicious attribute from the memory information.
15. A computer system, comprising:
a physical processor; and
a non-transitory computer-readable medium having stored thereon instructions that, when executed by the physical processor, cause the physical processor to:
intercept an egress packet from a virtualized computing instance running on the computer system itself to pause forwarding of the egress packet towards a destination;
obtain process information from an introspection agent running on the virtualized computing instance, wherein the process information is associated with a process from which the egress packet originates, and the process rungs on the virtualized computing instance;
based on the obtained process information, initiate a security analysis of the process; and
in response to determination that the running process is a potential security threat based on the security analysis, drop the egress packet and perform a remediation action; but otherwise, allow forwarding of the egress packet towards the destination.
16. The computer system of claim 15 , wherein the instructions for obtaining the process information cause the physical processor to:
based on the egress packet, extract identification information associated with the virtualized computing instance or the process, or both; and
based on the identification information, obtain the process information from the introspection agent.
17. The computer system of claim 15 , wherein the instructions for initiating the security analysis cause the physical processor to:
perform a preliminary analysis of the egress packet in the form of a domain name service (DNS) query, wherein the result of the DNS query indicates that the egress packet resolves to a domain name associated with a botnet or the egress packet is destined for a member of the botnet.
18. The computer system of claim 17 , wherein, based on resolving the egress packet to a domain name associated with a botnet or the egress packet being destined for a member of the botnet, the instructions for the security analysis cause the physical processor to perform one or more of the following:
(a) a scan to identify at least one malicious attribute associated with the process based on the process information; and
(b) a process execution in a test environment to identify at least one malicious runtime behavior associated with the process based on the process information.
19. The computer system of claim 18 , wherein the instructions for initiating the security analysis cause the physical processor to:
based on the process information that includes binary information associated with the process, execute the binary information in the test environment that is isolated from a production environment in which the virtualized computing instance operates.
20. The computer system of claim 18 , wherein the instructions for initiating the security analysis cause the physical processor to:
based on the process information that includes binary information associated with the process, perform a static scan to identify the at least one malicious attribute from the binary information.
21. The computer system of claim 18 , wherein the instructions for initiating the security analysis cause the physical processor to:
based on the process information that includes memory information associated with the process, perform a memory scan to identify the at least one malicious attribute from the memory information.