Method for tracking Windows task plan program creation process

Abstract

The embodiment of the invention provides a method for tracking a Windows task plan program creation process, and relates to the technical field of information security. The method comprises the following steps: injecting a dynamic link library containing a context sealing and sending module into a task plan service process, and hooking an event tracking API (Application Program Interface) in Windows event tracking with a hook function in the context sealing and sending module through the dynamic link library; acquiring parameter information in an event tracking API (Application Program Interface) called by a unified background process manager of the system through the hook function, and constructing a task context of a thread based on the parameter information; and when receiving the callback created by the process, the security agent module implements the following operations: judging whether the task context of the thread exists or not, and operating the created process according to the task context under the condition that the task context exists in the thread. According to the implementation mode provided by the invention, accurate capture of the task creation process is realized.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method for tracking a Windows task scheduler creation process, an electronic device, and a corresponding storage medium. Background Art

[0002] The task scheduler can be executed automatically, so it is often used by malware to achieve its goals of residence, execution, and privilege escalation. In addition, according to the above description of the implementation mechanism of the task schedule service, it is impossible to associate the task schedule with the process creation specified by its operation simply by analyzing the process creation relationship. This feature can also be used by malware to achieve defense evasion actions.

[0003] For example: Malicious program A.exe, creates two task plans and then closes: Task-1: When the system is idle, starts PowerShell.exe, specifies a download script in its command line, and downloads malicious program B.exe from a certain site. Task-2: When the system starts, runs malicious program B.exe. When the system is idle, Task-1 is executed, and the task schedule service process starts the powershell.exe process (svchost.exe->powershell.exe), downloading B.exe. The next time the system logs in, Task-2 is executed, and the task schedule service process starts B.exe. (svchost.exe->B.exe) In the above process, judging from the relationship between file creation and process startup (the analysis of these two relationships is the most commonly used means of defense system), A.exe and B.exe have no direct connection. Attackers can use this mechanism to disperse a whole set of malicious behaviors into multiple task plans for execution, and the execution of each task is not enough to trigger the alarm of the defense system, thereby achieving the goal of evading defense.

[0004] Even if the creation operation of the task schedule can be captured by some means, only the connection between A.exe and Task-1 and Task-2 can be established, but the direct connection between Task-2 and B.exe is still missing. When svchost.exe starts B.exe, even if the notification of process creation is captured at the kernel layer and the call stack analysis shows that B.exe is started by the Task Scheduler service process (when Windows is running, there will be multiple svchost.exe processes, each carrying a different group of system services), there is no way to know which specific task triggered it, which poses a huge security risk.

[0005] There are some methods for collecting events with the help of ETW in the prior art, but they have problems such as post-analysis, inability to support real-time, incomplete trigger information, and inability to ensure accurate task-process association. Summary of the invention

[0006] The purpose of the embodiment of the present application is to provide a method for tracking the process created by the Windows Task Scheduler. By analyzing schedsvc.dll and ubmp.dll, it can be determined that event tracking-related processing will be performed before and after the task startup process, so as to at least solve some of the problems in the background technology.

[0007] In order to achieve the above-mentioned purpose, a method for tracking the creation process of a Windows task scheduler is provided in the present application, the method comprising: injecting a dynamic link library containing a context marshaling module into a task scheduling service process, and hooking an event tracking API in Windows event tracking with a hook function in the context marshaling module through the dynamic link library; obtaining parameter information in the event tracking API called by the unified background process manager of the system through the hook function, and building a task context of the thread based on the parameter information; when receiving a callback for process creation, the security proxy module implements the following operations: determining whether the task context of the thread exists, and if the task context exists for the thread, operating the created process according to the task context.

[0008] Optionally, there are multiple event tracking APIs and multiple hook functions, and the event tracking API is correspondingly hooked with the hook function in the context marshaling module.

[0009] Optionally, the event tracking API includes: an API for the unified background process manager to register a Windows event tracking provider, an API for the unified background process manager to determine whether a specified event needs to be published, and an API for the unified background process manager to publish events.

[0010] Optionally, the event tracking API is an API related to event tracking in the NTDLL.DLL library; the API used to register a Windows event tracking provider is EtwEventRegister, the API used to determine whether a specified event needs to be published is EtwEventEnabled, and the API used to publish events is EtwEventWrite.

[0011] Optionally, parameter information in the event tracking API called by the unified background process manager of the system is obtained through the hook function, including: when the event tracking API is called by the unified background process manager, entering the hook function corresponding to the event tracking API; obtaining parameter information in the event tracking API through the hook function corresponding to the event tracking API.

[0012] Optionally, parameter information in the event tracking API called by the unified background process manager of the system is obtained through the hook function, and the task context of the thread is constructed based on the parameter information, including: obtaining a globally unique identifier from an API for registering a Windows event tracking provider, and when the globally unique identifier is the specific value, saving the first handle returned by the API for registering a Windows event tracking provider; obtaining a second handle and a first publishing event identifier from an API for determining whether a specified event needs to be published, and performing the next step of processing when the second handle is the same as the first handle and the first publishing event identifier is a trigger event; obtaining a third handle, a second publishing event identifier and event information from an API for publishing events, and when the third handle is the same as the first handle and the second publishing event identifier is a trigger event, extracting the full path of the task from the event information, and constructing the task context from the full path of the task.

[0013] Optionally, after constructing the task context of the thread based on the parameter information, the method further includes: setting the task context to the current thread; wherein, setting the task context to the current thread includes: setting the task context directly to a specific field of the current thread structure or setting it through an external thread-to-task context mapping structure to associate the task context with the current thread.

[0014] Optionally, the operation performed on the created process according to the task context includes: a blocking operation, a releasing operation or sending an audit message determined according to a preset policy.

[0015] Optionally, the method further comprises: when an API for determining whether a specified event needs to be published is called to publish an action result event of a task, clearing the constructed context.

[0016] The present application also provides a device for tracking the creation process of a Windows task scheduler, which includes: an injection hook module, which is used to inject a dynamic link library containing a context marshaling module into a task scheduling service process, and to hook an event tracking API in Windows event tracking with a hook function in the context marshaling module through the dynamic link library; an acquisition construction module, which is used to obtain parameter information in the event tracking API called by the unified background process manager of the system through the hook function, and to build a task context of the thread based on the parameter information; a judgment execution module, which is used for the security agent module to implement the following operations when receiving a callback for process creation: judging whether the task context of the thread exists, and if the task context exists for the thread, operating the created process according to the task context.

[0017] The present application also provides an electronic device, comprising: at least one processor; a memory connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the aforementioned method of tracking the creation process of the Windows Task Scheduler by executing the instructions stored in the memory.

[0018] The present application also provides a machine-readable storage medium on which instructions are stored. When the instructions are executed by a processor, the processor is configured to execute the aforementioned method for tracking the creation process of the Windows Task Scheduler.

[0019] The present application also provides a computer program product, including a computer program, which implements the aforementioned method of tracking the creation process of the Windows Task Scheduler when executed by a processor.

[0020] The above technical solution has the following beneficial effects:

[0021] By utilizing the task management mechanism within Windows and injecting the context marshaling module into the task scheduling service process, the action of "task creation process" can be accurately captured, thereby improving the accuracy of malicious code behavior analysis.

[0022] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present application, but do not constitute a limitation on the embodiments of the present application. In the accompanying drawings:

[0024] Figure 1 A schematic diagram of the steps of a method for tracking a Windows task scheduler creation process according to an embodiment of the present application is shown;

[0025] Figure 2 The following schematically shows a schematic diagram of the implementation process of the method for tracking the creation process of the Windows Task Scheduler according to the implementation mode of the present application;

[0026] Figure 3 A schematic diagram of the structure of a device for tracking the creation process of a Windows task scheduler according to an embodiment of the present application is shown;

[0027] Figure 4 The internal structure of an electronic device according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0028] The specific implementation of the embodiment of the present application is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present application, and is not used to limit the embodiment of the present application.

[0029] Figure 1 The following schematically shows the steps of a method for tracking a Windows task scheduler creation process according to an embodiment of the present application. Figure 1 A method for tracking a process created by a Windows Task Scheduler is shown, the method comprising:

[0030] S01, injecting a dynamic link library (DLL) containing a context marshaling module into a task scheduling service process, and hooking an event tracing API (Application Programming Interface) in Windows event tracing (ETW) with a hook function (Hook Function) in the context marshaling module through the dynamic link library;

[0031] S02, obtaining parameter information in the event tracking API called by the unified background process manager of the system through the hook function, and constructing the task context of the thread based on the parameter information;

[0032] S03. When receiving the callback of process creation, the security proxy module implements the following operations: determining whether the task context of the thread exists, and if the task context exists, operating the created process according to the task context.

[0033] In this implementation, the task context marshaling module is injected into the service process. The injection mentioned here refers to loading a dynamic link library (DLL) into the process and executing it. There are many implementation methods, and this application does not limit the injection method.

[0034] The task context marshaling module is a dynamic link library injected into the task scheduling service process. It mainly hooks ETW-related APIs. Its purpose is to extract task information when the UBPM module publishes a specified event, construct a task context and attach it to the current thread for the security agent to query the task information when the process is created.

[0035] The security proxy module preferably runs in the kernel layer. After capturing the process creation notification, it queries the task information in the thread context and performs filtering and other processing on the action of starting the task plan process.

[0036] The task context refers to the detailed information of the task as the subject, which can be an encapsulated data structure pointer containing the detailed information of the task, or it can be the identification number of the task in an external database.

[0037] This application is implemented based on the Unified Background Process Manager (UBPM) provided by the Windows system, but due to different Windows versions, the unified background management function of the Unified Background Process Manager may be implemented by other functional modules. For example, in the case that early systems such as Windows 7 do not use the UBPM module to maintain tasks, the same ETW hook processing can be performed on taskeng.exe to achieve the same technical effect, and this application does not limit this.

[0038] Through the above implementation method, by utilizing the task management mechanism inside Windows and injecting the context marshaling module into the task scheduling service process, the action of "task creation process" is accurately captured, thereby improving the accuracy of malicious code behavior analysis.

[0039] The data capture in this implementation is accompanied by the task creation process, which has good real-time performance compared with the post-audit system. At the same time, the impact on the system is small, reducing the consumption of association analysis. And based on the process management mechanism within the system, it is distinguished to avoid false positives when the same-name processes are started concurrently.

[0040] In some embodiments of the present application, there are multiple event tracking APIs, and the event tracking APIs are correspondingly hooked with the hook functions in the context marshaling module. The event tracking API includes: an event tracking API called by the unified background process manager of the system for registering events, an event tracking API called by the unified background process manager of the system for judging whether it is necessary to publish a specified event, and an event tracking API called by the unified background process manager of the system for publishing events. As a standard component of Windows, the task scheduling service has built-in support for ETW (Event Tracing for Windows), and it implements both the controller and the provider in terms of role, and automatically enables the provider implemented by itself when the service is started. In order to facilitate the understanding and implementation of those skilled in the art, the event tracking API involved in the present application is described as follows.

[0041] As a provider, the execution program of the task scheduling service, including schedsvc.dll and ubpm.dll, calls EventRegister to register the event with the GUID {DE7B24EA-73C8-4A09-985D-5BDADCFA 9017}. Before and after the task operation is executed, ubpm.dll will try to publish the corresponding event: first call EventEnabled to determine whether there are consumers who have subscribed to such events, and if it returns TRUE, call EventWrite to write the event. Specifically: before the task is executed, it will try to publish the specified event, such as the trigger event. The event ID indicates the type of trigger (for example: 0x6b corresponds to the time trigger, 0x77 corresponds to the login event trigger...), and when calling EventEnabled, the description of the event is specified. When EventWrite is called, the full name of the task will be further specified in the first parameter (for example, Task-1 mentioned above). Execute the operation specified by the task, that is, start the process specified by the task (for example, B.exe mentioned above). After the task is executed, it will try to publish the result event, such as the action execution success (0xC9) and execution failure (0xCA).

[0042] Furthermore, the event tracking API is an API related to event tracking in the NTDLL.DLL library; NTDLL.DLL is an important Windows NT kernel-level file that describes the interface of the Windows local NTAPI. When Windows starts, ntdll.dll resides in a specific write-protected area in the memory, so that other programs cannot occupy this memory area. In the Windows system, the API for registering the Windows event tracking provider is EtwEventRegister, the API for determining whether to publish a specified event is EtwEventEnabled, and the API for publishing an event is EtwEventWrite.

[0043] In some embodiments of the present application, the parameter information in the event tracking API called by the unified background process manager of the system is obtained through the hook function, including: when the event tracking API is called by the unified background process manager, entering the hook function corresponding to the event tracking API; obtaining the parameter information in the event tracking API through the hook function corresponding to the event tracking API. The hook function (Hook Function) hooked with the aforementioned event tracking API can be designed as follows. The hook function includes OnEventRegister function, OnEventEnabled function and OnEventWrite function. The names of the above hook functions are only examples, and the function names are not limited during implementation. Hook EtwEventRegister to OnEventRegister function, hook EtwEventEnabled to OnEventEnable d function, and hook EtwEventWrite to OnEventWrite function. For example, when EtwEventRegi ster is called, it will enter the hook function OnEventRegister, obtain the parameters in EtwEventRegist er, and execute its own functions.

[0044] In some embodiments of the present application, a globally unique identifier is obtained from an API for registering a Windows event tracing provider, and when the globally unique identifier is the specific value, the first handle returned by the API for registering a Windows event tracing provider is saved; a second handle and a first publishing event identifier are obtained from an API for determining whether a specified event needs to be published, and when the second handle is the same as the first handle and the first publishing event identifier is a trigger event, the next step of processing is performed; a third handle, a second publishing event identifier, and event information are obtained from an API for publishing events, and when the third handle is the same as the first handle and the second publishing event identifier is a trigger event, the full path of the task is extracted from the event information, and the task context is constructed from the full path of the task. Exemplarily, when EtwEventRegister is called, the hook function OnEventRegister is entered to obtain the parameter GUID (globally unique identifier) ​​in EtwEventRegister. In the case where the globally unique identifier is the specific value, the specific value here is the aforementioned {DE7B24EA-73C8-4A09-985D-5BDADCFA9017}, the handle returned by twEventRegister is retained and recorded as the first handle, which is used as a precondition for determining whether processing is required when entering the OnEventEnabled and OnEventWrite functions later. When EtwEventEnabled is called, enter the hook function OnE ventEnabled, obtain the event handle and release event identifier in EtwEventEnabled, that is, the second handle and release event ID. When the second handle is the same as the first handle and the first release event identifier is a trigger event (ID == 0x6B, 0x6D, 0x72, 0x76, 0x77...), force return to TRUE, otherwise no processing is performed. When EtwEventWrite is called, it will enter the hook function OnEventWr ite. First, it will determine whether the event handle, that is, the third handle, is the same as the first handle. If they are the same, it will continue to determine whether the published event ID, that is, the second published event identifier, is a trigger event (ID == 0x6B, 0x6D, 0x72, 0x76, 0x77...). If both conditions are met, the full path of the task can be extracted from the data parameters of the event, and a task context can be constructed from the full path of the task.

[0045] In some embodiments of the present application, after constructing the task context of the thread based on the parameter information, the method further includes: setting the task context to the thread. This embodiment mainly provides a method for associating tasks with threads at runtime. The task context can be set to the thread in the following ways, for example: setting the task context directly to a specific field of the thread structure, such as the ArbitraryUserPointer of the thread TIB structure; or through an external thread to task context mapping structure.

[0046] In some embodiments of the present application, the operations performed on the created process according to the task context include: blocking operations, releasing operations, or sending audit messages determined according to preset policies. When UBPM starts the process in the task action, the security agent module of the kernel layer will receive a callback for the process creation. The security agent module can try to extract the task context associated with the current thread. If the task context exists, it means that the newly created process is created by the task plan, and it can be operated according to the preset policy. The operation can be a filtering operation, such as blocking operations, releasing operations, or sending audit messages. The task context extraction method here relies on the aforementioned setting method, such as from the ArbitraryUserPointer pointer of the current thread TIB structure, or querying the thread to task context mapping.

[0047] In some embodiments of the present application, the method further includes: when the event tracking API used to determine whether a specified event needs to be published is called to publish an action result event of a task, the constructed context is cleared. Regardless of whether the process is created successfully or not, UBPM will call EtwEventEnabled to try to publish the action result event of the task, thereby entering the hook function OnEventEnabled. In OnEventEnabled, first determine whether the event handle is the same as the aforementioned first handle. If the same, continue to determine whether the ID of the published event is an action result event (ID == 0xC9, 0xCA, 0xCB...), if both conditions are met, perform task context clearing processing, otherwise no processing is performed. The method for clearing the task context corresponds to the aforementioned setting method, for example, restoring the ArbitraryUserPointer pointer of the current thread TIB structure, or deleting the thread to task context mapping.

[0048] Figure 2 The following schematically shows the implementation process of the method for tracking the creation process of the Windows Task Scheduler according to the implementation mode of the present application. Figure 2 As shown, this implementation is based on the task context marshaling module 101 and the security proxy module 102, and its implementation process includes:

[0049] 1. Injection. When the task planning service process is started, the task context marshaling module 101 is injected into the service process. The injection mentioned here refers to loading a dynamic link library (DLL) into the process and executing it. There are many implementation methods, and this application does not limit the injection method. When the task context marshaling module 101 is initially executed, it hooks several event tracking related APIs in the NTDLL.DLL library, mainly: hooking EtwEventRegister to OnEventRegister function 201, hooking EtwEventEnabled to OnEventEnabled function 202 and hooking EtwEventWrite to OnEventWrite function 203.

[0050] 2. When registering event types, trigger event filtering, and trigger event writing in Ubpm.dll, the corresponding hook functions are performed.

[0051] 3. The OnEventWrite function 203 generates a task context.

[0052] 4. After receiving the process start notification, the security agent module filters the task-process based on the read task context.

[0053] 5. The OnEventEnabled function 202 clears the set task context after receiving the result event filtering.

[0054] Through the above implementation, in the continuous process of publishing the specified event, creating the process, and publishing the action result event of the task planning service, the corresponding operations such as capturing the task information, setting the context, and clearing the context are completed, thereby achieving: accurately capturing the action of "task creation process", thereby improving the accuracy of malicious code behavior analysis. At the same time, compared with the post-audit system, it has the advantages of real-time access control, reducing the consumption of association analysis, and avoiding false alarms when the same-name process is started concurrently.

[0055] Based on the same inventive concept, the present application also provides a device for tracking the creation process of the Windows task scheduler. Figure 3 The schematic diagram shows the structure of the device for tracking the creation process of the Windows task scheduler according to the implementation mode of the present application. Figure 3As shown, the device includes: an injection hook module, which is used to inject a dynamic link library containing a context marshaling module into a task scheduling service process, and to hook an event tracking API in Windows event tracking with a hook function in the context marshaling module through the dynamic link library; an acquisition construction module, which is used to obtain parameter information in the event tracking API called by the unified background process manager of the system through the hook function, and to construct a task context of the thread based on the parameter information; a judgment execution module, which is used for the security proxy module to implement the following operations when receiving a callback for process creation: judging whether the task context of the thread exists, and if the task context exists for the thread, operating the created process according to the task context.

[0056] In some optional implementations of the present application, there are multiple event tracking APIs and multiple hook functions, and the event tracking API is correspondingly hooked with the hook function in the context marshaling module.

[0057] In some optional implementations, the event tracking API includes: an API for the unified background process manager to register a Windows event tracking provider, an API for the unified background process manager to determine whether a specified event needs to be published, and an API for the unified background process manager to publish events.

[0058] In some optional implementations, the event tracking API is an API related to event tracking in the NTDLL.DLL library; the API used to register a Windows event tracking provider is EtwEventRegister, the API used to determine whether a specified event needs to be published is EtwEventEnabled, and the API used to publish events is EtwEventWrite.

[0059] In some optional implementations, parameter information in the event tracking API called by the unified background process manager of the system is obtained through the hook function, including: when the event tracking API is called by the unified background process manager, entering the hook function corresponding to the event tracking API; obtaining parameter information in the event tracking API through the hook function corresponding to the event tracking API.

[0060] In some optional implementations, parameter information in the event tracking API called by the unified background process manager of the system is obtained through the hook function, and the task context of the thread is constructed based on the parameter information, including: obtaining a globally unique identifier from an API for registering a Windows event tracking provider, and when the globally unique identifier is the specific value, saving the first handle returned by the API for registering a Windows event tracking provider; obtaining a second handle and a first publishing event identifier from an API for determining whether a specified event needs to be published, and performing the next step of processing when the second handle is the same as the first handle and the first publishing event identifier is a trigger event; obtaining a third handle, a second publishing event identifier and event information from an API for publishing events, and when the third handle is the same as the first handle and the second publishing event identifier is a trigger event, extracting the full path of the task from the event information, and constructing the task context from the full path of the task.

[0061] In some optional embodiments, after constructing the task context of the thread based on the parameter information, the method further includes: setting the task context to the current thread; wherein, setting the task context to the current thread includes: setting the task context directly to a specific field of the current thread structure or setting it through an external thread-to-task context mapping structure to associate the task context with the current thread.

[0062] In some optional implementations, the operations performed on the created process according to the task context include: a blocking operation, a releasing operation, or sending an audit message determined according to a preset policy.

[0063] In some optional implementations of the present application, the device further includes a clearing module, which is used to clear the constructed context when an event tracking API used to determine whether a specified event needs to be published is called to publish an action result event of a task.

[0064] The specific definition of each functional module in the above-mentioned device for tracking the creation process of the Windows Task Scheduler can be found in the above-mentioned definition of the method for tracking the creation process of the Windows Task Scheduler, which will not be repeated here. Each module in the above-mentioned system can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the electronic device in the form of hardware, or can be stored in the memory in the electronic device in the form of software, so that the processor can call and execute the operations corresponding to the above modules. It also realizes the accurate capture of the action of "task creation process", and also has the advantages of real-time access control, reducing the consumption of association analysis and avoiding false alarms of processes with the same name.

[0065] The implementation methods in this application can solve problems such as broken traceability analysis in existing systems. For example, in some existing systems, there are already complete task plan databases, kernel-layer process injection dynamic libraries, process callback notification processing, kernel-layer filtering engines and other basic components. Before applying the method proposed in this application, the existing system can capture the creation, deletion, and modification of task plans, and can also track the creation of processes and real-time risk behavior assessments during process execution. However, the inability to capture the task plan creation process will lead to broken traceability analysis in some scenarios. After applying the method proposed in this application, the problem has been solved. In this product, the implementation method is basically consistent with the detailed description, and only the selection of related technologies is described here:

[0066] The injection method of the task context marshaling module is completed by the kernel layer component of the existing system. When svchost.exe is captured loading schedsvc.dll, the task context marshaling module (schestub.dll) is loaded into the process space, and the ETW function hooking processing in the above steps is completed.

[0067] Task context construction method: Use the full path of the task to query the integer ID of the task in the database from the task planning database of the existing system.

[0068] Based on the method of associating task context with thread, the ArbitraryUserPointer pointer of thread TIB structure is used to complete the setting of task context (database ID).

[0069] In the security agent module of the kernel layer, when a process creation callback is captured, the task identifier is obtained from the ArbitraryUserPointer pointer of the current thread TIB. If it exists, an event with the task as the subject and the process as the object is constructed and sent to the filtering engine for processing. The filtering engine processes it according to the filtering policy.

[0070] It can be seen that the system that applies the method or device in the present application can avoid the break in the traceability analysis chain caused by the inability to capture the task plan creation process, thereby improving the security of the system.

[0071] In some embodiments of the present application, an electronic device is provided, comprising: at least one processor; a memory connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the aforementioned method for tracking the creation of a process by the Windows Task Scheduler. The internal structure diagram can be as follows Figure 4 shown. Figure 4The internal structure diagram of an electronic device according to an embodiment of the present application is schematically shown. The electronic device includes a processor A01, a network interface A02, a memory (not shown in the figure) and a database (not shown in the figure) connected via a system bus. Among them, the processor A01 of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes an internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02 and a database (not shown in the figure). The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 in the non-volatile storage medium A04. The network interface A02 of the electronic device is used to communicate with an external terminal via a network connection. When the computer program B02 is executed by the processor A01, a method for tracking the creation process of the Windows Task Scheduler is implemented.

[0072] Those skilled in the art will understand that Figure 4 The structure shown in the figure is merely a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0073] In one embodiment provided in the present application, a machine-readable storage medium is provided, on which instructions are stored, and when the instructions are executed by a processor, the processor is configured to execute the aforementioned method of tracking the creation process of the Windows Task Scheduler.

[0074] In one embodiment provided in the present application, a computer program product is provided, including a computer program, which implements the aforementioned method of tracking the creation process of the Windows Task Scheduler when executed by a processor.

[0075] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0076] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0077] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0078] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0079] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0080] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0081] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0082] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0083] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for tracking a Windows Task Scheduler creation process, characterized in that: The method includes: Injecting a dynamic link library containing a context marshaling module into a task scheduling service process, and hooking an event tracing API in Windows event tracing with a hook function in the context marshaling module through the dynamic link library; Obtaining parameter information in the event tracking API called by the unified background process manager of the system through the hook function, and building a task context of the thread based on the parameter information; When receiving the callback of process creation, the security proxy module implements the following operations: determining whether the task context of the thread exists, and if the task context exists, operating the created process according to the task context.

2. The method according to claim 1, characterized in that There are multiple event tracking APIs and hook functions, and the event tracking API is correspondingly hooked with the hook function in the context marshaling module.

3. The method according to claim 1, characterized in that The event tracking API includes: The unified background process manager uses an API to register Windows event tracing providers, the unified background process manager uses an API to determine whether a specified event needs to be published, and the unified background process manager uses an API to publish events.

4. The method according to claim 3, characterized in that The event tracking API is an API related to event tracking in the NTDLL.DLL library; The API for registering a Windows event tracing provider is EtwEventRegister, the API for determining whether a specified event needs to be published is EtwEventEnabled, and the API for publishing an event is EtwEventWrite.

5. The method according to claim 1, characterized in that: The parameter information in the event tracking API called by the unified background process manager of the system is obtained through the hook function, including: When the event tracking API is called by the unified background process manager, the hook function corresponding to the event tracking API is entered; The parameter information in the event tracking API is obtained through the hook function corresponding to the event tracking API.

6. The method according to claim 3, characterized in that Obtaining parameter information in the event tracking API called by the unified background process manager of the system through the hook function, and building the task context of the thread based on the parameter information, including: Obtaining a globally unique identifier from an API for registering a Windows event tracing provider, and when the globally unique identifier is the specific value, saving a first handle returned by the API for registering a Windows event tracing provider; Obtaining the second handle and the first publishing event identifier from an API for determining whether a specified event needs to be published, and performing the next step of processing when the second handle is the same as the first handle and the first publishing event identifier is a trigger event; A third handle, a second publishing event identifier and event information are obtained from an API for publishing events. When the third handle is the same as the first handle and the second publishing event identifier is a trigger event, the full path of the task is extracted from the event information, and the task context is constructed from the full path of the task.

7. The method according to claim 1, characterized in that After constructing the task context of the thread based on the parameter information, the method further includes: setting the task context to the current thread; The step of setting the task context to the current thread includes: directly setting the task context to a specific field of the current thread structure or setting the task context through an external thread-to-task context mapping structure to associate the task context with the current thread.

8. The method according to claim 1, characterized in that The operations of operating the created process according to the task context include: Block operations, release operations, or send audit messages determined by preset policies.

9. The method according to claim 4, characterized in that The method further comprises: when an API for determining whether a designated event needs to be published is called to publish an action result event of a task, clearing the constructed context.

10. An electronic device, characterized in that: include: at least one processor; a memory connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the steps of the method for tracking the creation process of the Windows Task Scheduler as described in any one of claims 1 to 9 by executing the instructions stored in the memory.

11. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instruction is executed by a processor, the steps of the method for tracking the creation process of the Windows Task Scheduler as described in any one of claims 1 to 9 are implemented.

12. A computer program product, comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the method for tracking the creation process of the Windows Task Scheduler as described in any one of claims 1 to 9 are implemented.

Images