Protecting a computer device from escalation of privilege attacks
A computing device can receive a notification that a process has interacted with the operating system to perform a predetermined operation on the at least one computing device. In response to the notification, the computing device can capture a current access token from the process. The computing device can perform a comparison of the current access token captured from the process against a stored access token. The computing device can determine that an escalation of privilege attack has occurred based on the comparison of the current access token captured from the process against the stored access token.
1 . A system, comprising:
a memory storing an operating system; and
at least one computing device in communication with the memory, the at least one computing device being configured to:
register one or more callbacks with the operating system to provide a notification;
receive, via the one or more callbacks, the notification that a process has interacted with the operating system to perform a predetermined operation on the at least one computing device;
in response to the notification via the one or more callbacks, capture an initial access token from the process and record the initial access token as a stored access token;
perform a comparison of a current access token captured from the process against the stored access token; and
determine that an escalation of privilege attack has occurred based on the comparison of the current access token captured from the process against the stored access token.
2 . The system of claim 1 , wherein the comparison comprises a determination that the current access token differs from the stored access token.
3 . The system of claim 1 , wherein performing the comparison comprises determining that at least one field of the current access token differs from at least one field of the stored access token.
4 . The system of claim 3 , wherein comparing the at least one field of the current access token to the at least one field of the stored access token comprises using a memory address to probe at least one of: the current access token or the stored access token.
5 . The system of claim 1 , wherein performing the comparison comprises determining that a privilege list of the current access token differs from a privilege list of the stored access token.
6 . The system of claim 1 , wherein performing the comparison comprises determining that a memory address of the current access token differs from a memory address of the stored access token.
7 . The system of claim 1 , wherein performing the comparison comprises determining that a security identifier of the current access token differs from a security identifier of the stored access token.
8 . A method, comprising:
registering, via one of one or more computing devices, one or more callbacks with an operating system to provide a notification;
receiving, via the one or more callbacks, the notification that a process requested that the operating system of one of the one or more computing devices perform a predetermined operation on the one of the one or more computing devices;
in response to the notification via the one or more callbacks, capturing, via one of the one or more computing devices, an initial access token from the process and record the initial access token as a stored access token;
performing, via one of the one or more computing devices, a comparison of a current access token captured from the process against the stored access token; and
determining, via one of the one or more computing devices, that an escalation of privilege attack has occurred based on the comparison of the current access token captured from the process against the stored access token.
9 . The method of claim 8 , further comprising:
recording, via one of the one or more computing devices, the current access token in cache.
10 . The method of claim 8 , wherein the stored access token is recorded in cache.
11 . The method of claim 8 , wherein the stored access token is captured prior to capturing the current access token.
12 . The method of claim 8 , further comprising receiving, via one of the one or more computing devices, a first notification associated with a first process prior to receiving the notification.
13 . The method of claim 12 , wherein the process is a child process of the first process.
14 . A non-transitory computer-readable medium embodying a program that, when executed by at least one computing device, cause the at least one computing device to:
register one or more callbacks with an operating system to provide a notification;
receive, via the one or more callbacks, the notification that a process has interacted with an operating system of the at least one computing device to perform a predetermined operation on the at least one computing device;
in response to the notification via the one or more callbacks, an initial access token from the process and record the initial access token as a stored access token;
perform a comparison of a current access token captured from the process against the stored access token; and
determine that an escalation of privilege attack has occurred based on the comparison of the current access token captured from the process against the stored access token.
15 . The non-transitory computer-readable medium of claim 14 , wherein the program further causes the at least one computing device to:
establish a set of trigger points with the operating system of the at least one computing device using one or more additional callbacks.
16 . The non-transitory computer-readable medium of claim 15 , wherein the trigger points comprise any one or more of:
creation of a child process of the process;
creation of a remote thread that runs in an address space of another process;
requesting access to a system registry managed by the operating system;
loading an image of executable code into a memory of the at least one computing device; and
requesting access to a file system of the at least one computing device.
17 . The non-transitory computer-readable medium of claim 15 , wherein the program further causes the at least one computing device to:
register the one or more additional callbacks with the operating system to provide a second notification; and
record the current access token in response to the second notification.
18 . The non-transitory computer-readable medium of claim 14 , wherein the program further causes the at least one computing device to:
suspend the process in response to determining that the escalation of privilege attack has occurred.
19 . The non-transitory computer-readable medium of claim 14 , wherein the program further causes the at least one computing device to:
perform an audit of the notification based on a policy file.
20 . The non-transitory computer-readable medium of claim 14 , wherein the program further causes the at least one computing device to:
present a custom message on a display associated with the at least one computing device in response to determining that the escalation of privilege attack has occurred.