Cyber security boot status markers
Boot status markers record historical boot processes performed by a computer system. Each time the computer system boots, an operating system performs a boot process and interfaces with an antimalware driver. The antimalware driver determines the boot status markers that were set during previous boot processes. The antimalware driver may then classify other drivers based on the boot status markers set during the previous boot processes. The antimalware driver may then report driver classifications to the operating system. The operating system may then block, or allow, the drivers based on the driver classifications.
1. A method that classifies a boot-start driver, comprising:
determining, by an antimalware driver during a current boot process associated with an operating system, a boot status marker set during a previous boot process;
determining, by the antimalware driver during the current boot process, a driver classification associated with the boot-start driver, the driver classification based on the boot status marker set during the previous boot process; and
reporting, by the antimalware driver during the current boot process, the driver classification to the operating system.
2. The method of claim 1 , wherein in response to the boot status marker, further comprising blocking an execution of the boot-start driver.
3. The method of claim 1 , wherein in response to the boot status marker, further comprising allowing an execution of the boot-start driver.
4. The method of claim 1 , wherein the determining of the boot status marker further comprises reading a memory storing the boot status marker set during the previous boot process.
5. The method of claim 1 , further comprising classifying the boot-start driver as boot critical in response to the boot status marker.
6. The method of claim 1 , further comprising determining the previous boot process successfully completed based on the boot status marker.
7. The method of claim 1 , further comprising reporting the boot status marker via a network interface to a service provider.
8. A computer system that evaluates a boot-start driver, comprising:
a central processing unit; and
a memory device storing instructions that, when executed by the central processing unit, perform operations, the operations comprising:
executing an antimalware driver during an Early Launch AntiMalware (ELAM) feature associated with a current boot process by an operating system;
determining, during the ELAM feature associated with the current boot process, a boot status marker set during a previous boot process; and
blocking or allowing an initialization of the boot-start driver during the current boot process based on the boot status marker set during the previous boot process.
9. The computer system of claim 8 , wherein the operations further comprise determining the boot status marker set by the antimalware driver during the previous boot process.
10. The computer system of claim 8 , wherein the operations further comprise assigning a driver classification associated with the boot-start driver based on the boot status marker set during the previous boot process.
11. The computer system of claim 8 , wherein the operations further comprise reading the boot status marker.
12. The computer system of claim 8 , wherein the operations further comprise classifying the boot-start driver as boot critical in response to the boot status marker.
13. The computer system of claim 8 , wherein the operations further comprise classifying the boot-start driver as non-boot critical in response to the boot status marker.
14. The computer system of claim 8 , wherein the operations further comprise classifying the boot-start driver as an unknown driver in response to the boot status marker.
15. The computer system of claim 8 , wherein the operations further comprise determining the boot-start driver is blockable in response to the boot status marker.
16. The computer system of claim 8 , wherein the operations further comprise writing the boot status marker to the memory device.
17. The computer system of claim 8 , wherein the operations further comprise determining the previous boot process successfully completed based on the boot status marker.
18. The computer system of claim 8 , wherein the operations further comprise reporting the boot status marker via a network interface to a cloud service provider.
19. A memory device storing instructions that, when executed by a central processing unit, perform operations that evaluate a boot-start driver, the operations comprising:
executing an antimalware driver during an Early Launch AntiMalware (ELAM) feature associated with a current boot process by an operating system;
reading, during the ELAM feature associated with the current boot process, a Unified Extensible Firmware Interface (UEFI) registry storing a boot status marker set by the antimalware driver during a previous boot process by the operating system; and
blocking or allowing an initialization of the boot-start driver during the current boot process based on the boot status marker read from the UEFI registry.
20. The memory device of claim 19 , wherein the operations further comprise determining a driver classification associated with the boot-start driver based on the boot status marker read from the UEFI registry.