Elevated security execution mode for network-accessible devices
Various aspects related to methods, systems, and computer readable media for detection and blocking of security threats for network-accessible devices. Methods may include monitoring a plurality of processes executing on the user device to identify a pre-execution flag associated with at least one process of the plurality of processes, and, responsive to identifying the pre-execution flag: receiving an indication of a security threat to the user device, the indication of security threat associated with the at least one process and a device threat type, responsive to the receiving the indication of the security threat, elevating security measures associated with the user device for a first time period, and after the elevating, automatically remediating the security threat on the user device within the first time period.
1 . A computer-implemented method to automatically elevate security measures on a user device, the method comprising:
scanning a plurality of file storage locations on the user device to identify one or more files that include a code segment that is one or more of:
readable and writeable during execution,
marked for simultaneous read, write, and execute access,
has an association with a shared library of an operating system of the user device,
or combinations thereof:
responsive to identifying the one or more files, implementing one or more pre-execution flags in the identified one or more files;
monitoring a plurality of processes executing on the user device to identify a pre-execution flag associated with at least one process of the plurality of processes, wherein the at least one process is associated with a code segment included in the one or more files, and wherein the monitoring the plurality of processes comprises monitoring memory of the user device; and
responsive to identifying the pre-execution flag:
receiving an indication of a security threat to the user device, the indication of the security threat associated with the at least one process and a device threat type;
responsive to the receiving the indication of the security threat, elevating security measures associated with the user device for a first time period; and
after the elevating, automatically remediating the security threat on the user device within the first time period.
2 . The computer-implemented method of claim 1 , wherein the pre-execution flag indicates that the at least one process is associated with a code segment which is vulnerable to a code-injection threat.
3 . The computer-implemented method of claim 1 , further comprising determining that the device threat type associated with the security threat is a code-injection threat to the user device.
4 . The computer-implemented method of claim 3 , wherein the remediating the security threat on the user device comprises identifying injected code, and performing one or more of isolating, deleting, or remediating the injected code.
5 . The computer-implemented method of claim 1 , wherein the shared library is associated with library linking between programs executing on the user device.
6 . The computer-implemented method of claim 1 , wherein the shared library is a dynamic-linked library (DLL) file.
7 . The computer-implemented method of claim 1 , wherein the shared library is associated with memory sharing between programs executing on the operating system.
8 . The computer-implemented method of claim 1 , wherein the receiving the indication of the security threat comprises at least one of:
receiving the indication of the security threat on the user device from security software that executes on the user device; or
receiving the indication of the security threat on the user device from a remote device in operative communication with the user device over a network, the indication of the security threat based upon network activity from the user device detected by the remote device.
9 . The computer-implemented method of claim 1 , wherein the device threat type is automatically monitored by at least one of: security software that executes on the user device, or a remote device in operative communication with the user device over a network.
10 . The computer-implemented method of claim 1 , wherein the device threat type is a computer security threat associated with a plurality of known and unknown security threats to computer networks.
11 . The computer-implemented method of claim 1 , wherein the elevating security measures associated with the user device comprises configuring the user device to prevent at least one of:
network access from the user device during the first time period;
execution of untrusted software on the user device during the first time period;
creation of new user accounts on the user device during the first time period;
creation of a service in a safe mode on the user device; or
reboot of the user device into the safe mode during the first time period.
12 . The computer-implemented method of claim 1 , wherein the automatically remediating the security threat comprises:
configuring security software that executes on the user device to implement a remediation technique on the user device that remediates the security threat.
13 . The computer-implemented method of claim 1 , further comprising:
determining, after the elevating, that the device threat type for the user device is remediated; and
responsive to the determining that the device threat type is remediated, updating the device security measures associated with the user device to a normal security level, wherein the normal security level is associated with disabling one or more of the security measures implemented in the first time period.
14 . The computer-implemented method of claim 1 , further comprising:
determining, after expiration of the first time period, that the device threat type for the user device has not been remediated; and
responsive to the determining that the device threat type has not been remediated, maintaining the elevated security measures for a second time period.
15 . The computer-implemented method of claim 1 , wherein the receiving the indication of the security threat is based on security software that executes on the user device determining that at least one behavioral rule of a plurality of behavioral rules is satisfied, wherein the plurality of behavioral rules include rules to detect one or more hacking toolsets.
16 . A non-transitory computer-readable medium with instructions stored thereon that, responsive to execution by a processing device, causes the processing device to perform operations comprising:
scanning a plurality of file storage locations on a user device to identify one or more files that include a code segment that is one or more of:
readable and writeable during execution,
marked for simultaneous read, write, and execute access,
has an association with a shared library of an operating system of the user device,
or combinations thereof;
responsive to identifying the one or more files, implementing one or more pre-execution flags in the identified one or more files;
monitoring a plurality of processes executing on the user device to identify a pre-execution flag associated with at least one process, wherein the at least one process is associated with a code segment included in the one or more files, and wherein the monitoring the plurality of processes comprises monitoring memory of the user device; and
responsive to identifying the pre-execution flag:
receiving an indication of a security threat to the user device, the indication of the security threat associated with the at least one process and a device threat type;
responsive to the receiving the indication of the security threat, elevating security measures associated with the user device for a first time period; and
after the elevating, automatically remediating the security threat on the user device within the first time period.
17 . The non-transitory computer-readable medium of claim 16 , wherein the pre-execution flag indicates that:
the at least one process is associated with a code segment which is vulnerable to a code-injection threat.
18 . The non-transitory computer-readable medium of claim 16 , wherein the operations further comprise determining that the device threat type associated with the security threat is a code-injection threat to the user device.
19 . The non-transitory computer-readable medium of claim 18 , wherein the remediating the security threat on the user device comprises identifying injected code, and performing one or more of isolating, deleting, or remediating the injected code.
20 . A threat management computer system to manage active security threats on an enterprise network, comprising:
a memory with instructions stored thereon;
a processing device, coupled to the memory, the processing device configured to access the memory and execute the instructions; and
a network device coupled to the processing device and configured to receive indications of security threats from a plurality of user devices, wherein the instructions cause the processing device or the network device to perform operations including:
scanning a plurality of file storage locations on a user device to identify one or more files that include a code segment that is one or more of:
readable and writeable during execution,
marked for simultaneous read, write, and execute access,
has an association with a shared library of an operating system of the user device,
or combinations thereof;
responsive to identifying the one or more files, implementing one or more pre-execution flags in the identified one or more files;
monitoring a plurality of processes executing on the user device of the plurality of user devices to identify a pre-execution flag associated with at least one process, wherein the at least one process is associated with a code segment included in the one or more files, and wherein the monitoring the plurality of processes comprises monitoring memory of the user device; and
responsive to identifying the pre-execution flag:
receiving an indication of a security threat to the user device, the indication of the security threat associated with the at least one process and a device threat type;
responsive to the receiving the indication of the security threat, elevating security measures associated with the user device for a first time period; and
after the elevating, automatically remediating the security threat on the user device within the first time period.