System and method for process hollowing detection
US10691792B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Jul 3, 2018 |
| Grant date | Jun 23, 2020 |
| Priority date | — |
| Expiry date | Jul 23, 2038 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L63/1466
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
A method and system for remediating a process hollowing intrusion on a user device comprising detecting a process starting on the user device, preparing the process to monitor Application Programming Interface (API) calls between the process and an operating system of the user device, determining whether the process is associated with a process hollowing intrusion based on information associated with the process and/or the API calls, and executing security policies against the process associated with the process hollowing intrusion. In examples, it is determined whether the child process is associated with a process hollowing intrusion in response to determining whether one or more API calls associated with known process hollowing intrusions modify executable memory of and/or modify an entry point address of the child process.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.