A fileless attack detection method and device
Receive remote procedure call messages through the Hook function and compare interface functions, the problem of the existing technology inability to detect and intercept file-free attacks in DCOM mode is solved, and effective detection and interception of file-free attacks is achieved to protect system security.
CN114218564BActive Publication Date: 2025-03-28QI AN XIN TECHNOLOGY GROUP INC +1
2 Cites 0 Cited by
Patent Information
- Application Number
- CN202111362553.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-11-17
- Publication Date
- 2025-03-28
- Estimated Expiration
- 2041-11-17
AI Technical Summary
Technical Problem
The prior art cannot effectively detect and intercept file-free attacks that execute Excel 4.0 macro code through DCOM.
Method used
The Hook function receives messages based on the remote procedure call protocol, obtains interface identifiers and function identifiers, determines the interface function accessed by the message, and compares it with the interface function. If the target macro code accesses the interface, the receiving function is intercepted.
Benefits of technology
It realizes detection and interception of fileless attacks based on macro code to protect the system security.
✦ Generated by Eureka AI based on patent content.
Abstract
The method and device for detecting fileless attacks provided by the embodiment of the present invention include: receiving a message based on the remote procedure call protocol through a receiving function in the Excel process of the hook; obtaining the interface identifier and function identifier of the request in the message based on the remote procedure call protocol; determining the function of the interface accessed by the message based on the remote procedure call protocol according to the interface identifier and function identifier of the request; comparing the message based on the remote procedure call protocol with the function of the interface, and determining whether the target macro code in the message based on the remote procedure call protocol accesses the interface based on the comparison result; if the target macro code accesses the interface, intercepting the receiving function. By identifying the target macro code that accesses the interface and intercepting the receiving function where the target macro code is located, the detection and interception of fileless attacks based on macro codes can be realized, thereby protecting the security of the system.
Need to check novelty before this filing date? Find Prior Art