Macro-script execution control

Patent metadata

Field	Value
Publication number	US-10649877-B2
Application number	US-201816204688-A
Country	US
Kind code	B2
Filing date	Nov 29, 2018
Priority date	Jun 8, 2016
Publication date	May 12, 2020
Grant date	May 12, 2020

Abstract

An agent inserts one or more hooks into a sub-execution runtime environment that is configured to include a script and/or targeted to include the script. The agent including the one or more hooks monitors a behavior of the sub-execution runtime environment and/or the script. The agent subsequently obtains context information regarding the sub-execution runtime environment and/or the script so that it can control the runtime of at least the sub-execution runtime environment. Related systems, methods, and articles of manufacture are also disclosed.

First claim

What is claimed is:

1. A method, implemented by one or more computers, comprising:
inserting, by an agent, two or more hooks of different types into a sub-execution runtime environment, wherein the sub-execution runtime environment is configured to include a script and/or targeted to include the script, and wherein the sub-execution runtime environment is an execution environment implemented within a context of another execution environment;
monitoring, by the agent including the two or more hooks, a behavior of the sub- execution runtime environment and/or the script;
obtaining, by the agent including the two or more hooks, context information regarding the sub-execution runtime environment and/or the script; and
controlling, by the agent, a runtime of at least the sub-execution runtime environment including the script, wherein the controlling is based on the monitored behavior of the sub-execution runtime environment and/or the script and the obtained context information regarding the sub-execution runtime environment and/or the script, and wherein the agent installs at least one of the two or more hooks as events occur including an additional operating system module and/or a script execution environment-related module being loaded into the script execution environment including a memory.

2. The method of claim 1 , wherein the two or more hooks are inserted into a runtime environment for a document, and wherein the script is embedded in the document.

3. The method of claim 2 , wherein the agent inserts a plurality of hooks comprising code hooks into the sub-execution runtime environment including the script and the runtime environment for the document.

4. The method of claim 1 , wherein at least one hook of the two or more hooks is placed in a dynamic link library to monitor calls made by the sub-execution runtime environment including the script.

5. The method of claim 1 , wherein the context information comprises a file name, a file path, and/or a uniform resource locator.

6. The method of claim 1 , wherein at least one hook of the two or more hooks stores the context information using a global variable to enable sharing the context information with the agent or another hook.

7. The method of claim 1 , wherein the controlling comprises:
obtaining, by the agent, policy information; and
determining, based on the monitored behavior of the sub-execution runtime environment and/or the script, the obtained context information regarding the sub-execution runtime environment and/or the script, the obtained policy information, and a remedial action to control the runtime of the at least the sub-execution runtime environment including the script.

8. The method of claim 7 , wherein the remedial action comprises inhibiting execution of the script.

9. The method of claim 7 , wherein the remedial action comprises allowing the script to execute with limited resources.

10. The method of claim 1 , further comprising:
inducing an error in execution of the script by at least modifying at least one argument of an intercepted function call.

11. The method of claim 1 , further comprising:
identifying and/or locating an interpreter of the sub-execution runtime environment including the script; and
hooking the interpreter of the sub-execution runtime environment including the script.

12. The method of claim 1 , further comprising:
monitoring a behavior of a process;
determining, based on at least one hook and the context information, whether the monitored behavior of the process is being performed by the process on behalf of a script;
obtaining information about the script; and
reporting the monitored behavior of the process and/or applying a remedial action to the process.

13. The method of claim 1 , wherein the agent inserts at least one hook of the two or more hooks into the sub-execution runtime environment including the script before the script is loaded, run, and/or selected for loading.

14. The method of claim 1 , wherein the agent inserts at least one hook of the two or more hooks into the sub-execution runtime environment including the script before the script is allowed to run and/or the script is called.

15. The method of claim 1 , wherein the controlling, by the agent, includes preventing the script from being loaded, called, and/or executed.

16. A method, implemented by one or more computers, comprising:
inserting, by an agent, two or more hooks of different types into a sub-execution runtime environment, wherein the sub-execution runtime environment is configured to include a script and/or targeted to include the script, and wherein the sub-execution runtime environment is an execution environment implemented within a context of another execution environment;
monitoring, by a first hook of the two or more hooks, a behavior of the sub-execution runtime environment;
obtaining, by a second hook of the two or more hooks, context information regarding the sub-execution runtime environment; and
controlling, by the agent, a runtime of at least the sub-execution runtime environment including the script, wherein the controlling is based on the monitored behavior of the sub-execution runtime environment and the obtained context information regarding the sub-execution runtime environment, and wherein the agent installs at least one of the two or more hooks as events occur including an additional operating system module and/or a script execution environment-related module being loaded into the script execution environment including a memory.

17. The method of claim 16 , wherein the controlling comprises:
obtaining, by the agent, policy information; and
determining, based on the monitored behavior of the sub-execution runtime environment, the obtained context information regarding the sub-execution runtime environment, the obtained policy information, and a remedial action to control the runtime of the at least the sub-execution runtime environment including the script.

18. The method of claim 17 , wherein the remedial action comprises inhibiting execution of the script.

19. The method of claim 17 , wherein the remedial action comprises allowing the script to execute with limited resources.

20. A method, implemented by one or more computers, comprising:
inserting, by an agent, two or more hooks of different types into a sub-execution runtime environment, wherein the sub-execution runtime environment is configured to include a script and/or targeted to include the script, and wherein the sub-execution runtime environment is an execution environment implemented within a context of another execution environment;
monitoring, by a first hook of the two or more hooks, a behavior of the script;
obtaining, by a second hook of the two or more hooks, context information regarding the script; and
controlling, by the agent, a runtime of at least the sub-execution runtime environment including the script, wherein the controlling is based on the monitored behavior of the script and the obtained context information regarding the script, and wherein the agent installs at least one of the two or more hooks as events occur including an additional operating system module and/or a script execution environment-related module being loaded into the script execution environment including a memory.

Assignees

• Cylance Inc

Inventors

• Soeder Derek A

Classifications

• G06F21/54 Primary

  by adding security routines or objects to programs · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F9/4484

  Executing subprograms · CPC title

• G06F11/3466 Primary

  Performance evaluation by tracing or monitoring · CPC title

• G06F9/468

  Specific access rights for resources, e.g. using capability register · CPC title