In-memory scanning for fileless malware on a host device
The disclosure herein describes the processing of malware scan requests from VCIs by an anti-malware scanner (AMS) on a host device. A malware scan request is received by the AMS from a VCI, the malware scan request including script data of a script from a memory buffer of the VCI. The AMS scans the script data of the malware scan request, outside of the VCI, and determines that the script includes malware. The AMS notifies the VCI that the script includes malware, whereby the VCI is configured to prevent execution of the script or take other mitigating action. The AMS provides scanning for fileless malware to VCIs on a host device without consuming or otherwise affecting resources of the VCIs.
1. A system comprising:
at least one processor of a host device; and
at least one memory of the host device comprising computer program code of an anti-malware scanner (AMS), the at least one memory and the computer program code configured to, with the at least one processor, cause the at least one processor to:
receive, by the AMS, a malware scan request from a virtual computing instance (VCI) of the host device, wherein the malware scan request includes script data of a script from a memory buffer of the VCI;
scan, using the AMS outside of the VCI, the script data of the malware scan request;
determine that the script includes malware based on the scan of the script data; and
notify the VCI that the script includes malware, whereby the VCI is configured to prevent execution of the script.
2. The system of claim 1 , wherein the at least one memory and the computer program code are configured to, with the at least one processor, further cause the at least one processor to:
receive, by the AMS, an additional malware scan request from an additional VCI of the host device, wherein the malware scan request includes additional script data of an additional script from a memory buffer of the additional VCI;
scan, using the AMS outside of the additional VCI, the additional script data of the additional malware scan request;
determine that the additional script does not include malware using the scan of the additional script data; and
notify the additional VCI that the additional script does not include malware in response to the additional malware scan request, whereby the additional VCI is configured to execute the additional script.
3. The system of claim 1 , wherein scanning the script data of the malware scan request using the AMS includes identifying a script verdict entry associated with the script in a script verdict cache of the AMS using the script data of the malware scan request, the script verdict entry including a verdict indicating that the script includes malware.
4. The system of claim 1 , wherein scanning the script data of the malware scan request using the AMS includes:
determining that a script verdict cache of the AMS does not include script verdict entry associated with the script using the script data;
notifying the VCI that the script is unknown and may include malware;
requesting analysis of the script data from a sandboxing service;
receiving a verdict from the sandboxing service, the verdict indicating that the script data includes malware; and
storing the received verdict in the script verdict cache of the AMS.
5. The system of claim 4 , wherein scanning the script data of the malware scan request using the AMS further includes sharing the received verdict to a security analyzer of the system, whereby the security analyzer is enabled to distribute the received verdict to another AMS of another host device of the system.
6. The system of claim 1 , wherein scanning the script data of the malware scan request using the AMS includes:
determining that a script verdict cache of the AMS does not include script verdict entry associated with the script using the script data;
requesting a verdict of the script from a security analyzer of the system;
receiving the verdict of the script from the security analyzer, the verdict indicating that the script data includes malware based on analysis performed by another scanner application of another host device of the system; and
storing the received verdict in the script verdict cache of the AMS.
7. The system of claim 1 , wherein the at least one memory and the computer program code are configured to, with the at least one processor, further cause the at least one processor to register a scanner interface of the AMS with a malware scanning framework of the host device, whereby the registered scanner interface enables the AMS to receive the malware scan request via the malware scanning framework.
8. The system of claim 1 , wherein receiving the malware scan request includes receiving the script data from the memory buffer of the VCI in plain text.
9. A computerized method comprising:
receiving, by a processor of an anti-malware scanner (AMS), a malware scan request from a virtual computing instance (VCI) of a host device upon which the AMS is executed, wherein the malware scan request includes script data of a script from a memory buffer of the VCI;
scanning, by the processor of the host device outside of the VCI, the script data of the malware scan request using the AMS;
determining, by the processor, that the script includes malware using the scan of the script data; and
notifying, by the processor, the VCI that the script includes malware, whereby the VCI is configured to prevent execution of the script.
10. The computerized method of claim 9 , further comprising:
receiving, by the AMS, an additional malware scan request from an additional VCI of the host device, wherein the malware scan request includes additional script data of an additional script from a memory buffer of the additional VCI;
scanning, using the AMS outside of the VCI, the additional script data of the additional malware scan request;
determining that the additional script does not include malware using the scan of the additional script data; and
notifying the additional VCI that the additional script does not include malware, whereby the additional VCI is configured to execute the additional script.
11. The computerized method of claim 9 , wherein scanning the script data of the malware scan request using the AMS includes identifying a script verdict entry associated with the script in a script verdict cache of the AMS using the script data of the malware scan request, the script verdict entry including a verdict indicating that the script includes malware.
12. The computerized method of claim 9 , wherein scanning the script data of the malware scan request using the AMS includes:
determining that a script verdict cache of the AMS does not include script verdict entry associated with the script using the script data;
notifying the VCI that the script is unknown and may include malware;
requesting analysis of the script data from a sandboxing service;
receiving a verdict from the sandboxing service, the verdict indicating that the script data includes malware; and
storing the received verdict in the script verdict cache of the AMS.
13. The computerized method of claim 12 , wherein scanning the script data of the malware scan request using the AMS further includes sharing the received verdict to a security analyzer, whereby the security analyzer is enabled to distribute the received verdict to another AMS of another host device of a system of the host device.
14. The computerized method of claim 9 , wherein scanning the script data of the malware scan request using the AMS includes:
determining that a script verdict cache of the AMS does not include script verdict entry associated with the script using the script data;
requesting a verdict of the script from a security analyzer;
receiving the verdict of the script from the security analyzer, the verdict indicating that the script data includes malware based on analysis performed by another scanner application of another host device; and
storing the received verdict in the script verdict cache of the AMS.
15. The computerized method of claim 9 , further comprising registering a scanner interface of the AMS with a malware scanning framework of the host device, whereby the registered scanner interface enables the AMS to receive the malware scan request via the malware scanning framework.
16. The computerized method of claim 9 , wherein receiving the malware scan request includes receiving the script data from the memory buffer of the VCI in plain text.
17. One or more computer storage media of a host device having computer-executable instructions that, upon execution by a processor, cause the processor to at least:
receive, by an anti-malware scanner (AMS), a malware scan request from a virtual computing instance (VCI) of the host device, wherein the malware scan request includes script data of a script from a memory buffer of the VCI;
scan, using the AMS outside of the VCI, the script data of the malware scan request using the AMS;
determine that the script includes malware using the scan of the script data; and
notify the VCI that the script includes malware, whereby the VCI is configured to prevent execution of the script.
18. The one or more computer storage media of claim 17 , wherein the computer-executable instructions, upon execution by the processor, further cause the processor to at least:
receive, by the AMS, an additional malware scan request from an additional VCI of the host device, wherein the malware scan request includes additional script data of an additional script from a memory buffer of the additional VCI;
scan, using the AMS outside of the VCI, the additional script data of the additional malware scan request;
determine that the additional script does not include malware using the scan of the additional script data; and
notify the additional VCI that the additional script does not include malware in response to the additional malware scan request, whereby the additional VCI is configured to execute the additional script.
19. The one or more computer storage media of claim 17 , wherein scanning the script data of the malware scan request using the AMS includes identifying a script verdict entry associated with the script in a script verdict cache of the AMS using the script data of the malware scan request, the script verdict entry including a verdict indicating that the script includes malware.
20. The one or more computer storage media of claim 17 , wherein scanning the script data of the malware scan request using the AMS includes:
determining that a script verdict cache of the AMS does not include script verdict entry associated with the script using the script data;
notifying the VCI that the script is unknown and may include malware;
requesting analysis of the script data from a sandboxing service;
receiving a verdict from the sandboxing service, the verdict indicating that the script data includes malware; and
storing the received verdict in the script verdict cache of the AMS.