WinRM service-based protection method and device

Abstract

The embodiment of the present invention provides a protection method and device based on WinRM service. The method includes: installing a monitoring module in the WinRM service process, the monitoring module is used to monitor whether the process loads the target module; through the monitoring module, setting a Hook function on the target module, the Hook function is used to obtain data passing through the target module, the data includes the execution parameters and IP address of the target module; judging whether the format of the data is the target format, if so, parsing the data, matching the parsed execution parameters through preset rules, intercepting the operation of the process according to the matching results, and responding to the computer corresponding to the IP address according to the parsed IP address. This method solves the problem that network attack monitoring lacks effective and accurate identification of the behavior of remote WinRM execution commands on the intranet, and improves the effect of security threat detection.

Description

Technical Field

[0001] The present invention relates to the technical field of network security attack protection, and in particular to a protection method and device based on WinRM service. Background Art

[0002] In the complete attack chain of network penetration, the intranet remote lateral penetration stage refers to the attacker using a compromised machine as a springboard, and through this breakthrough, trying to attack other machines in the same network, obtaining more valuable credentials and higher-level permissions, thereby expanding the attack surface, and then controlling the entire intranet network, and finally completing the purpose of launching APT (Advanced Persistent Threat Attack, also known as Targeted Threat Attack, which refers to a continuous and effective attack activity launched by an organization against a specific object) advanced persistent threat attack. Among them, using WinRM for remote attack is a common attack method for attackers to penetrate the intranet horizontally. The WinRM service is a method that uses the operating system's own mechanism capabilities. Traditional network attack detection methods cannot effectively and accurately cover and detect such attack methods. Summary of the invention

[0003] In view of the problems in the prior art, an embodiment of the present invention provides a protection method and device based on WinRM service. The method solves the problem that network attack monitoring lacks effective and accurate identification of the behavior of remote WinRM execution commands in the intranet, thereby improving the effect of security threat detection.

[0004] Specifically, the embodiment of the present invention provides the following technical solutions:

[0005] In the first aspect, an embodiment of the present invention provides a protection method based on WinRM service, comprising: in response to detecting a process of WinRM service, installing a monitoring module in the process, the monitoring module being used to monitor whether the process has loaded a target module; if the target module has been loaded, setting a Hook function on the target module through the monitoring module, the Hook function being used to obtain data passing through the target module, the data including execution parameters and an IP address of the target module; determining whether the format of the data is the target format, and if so, parsing the data to obtain parsed execution parameters and a parsed IP address, matching the parsed execution parameters through preset rules, intercepting the operation of the process according to the matching result, and performing a security response to the remote computer corresponding to the IP address according to the parsed IP address.

[0006] Furthermore, the target module includes a WsmSvc.dll module.

[0007] Furthermore, the target module includes at least one target function; and if the target module has been loaded, a Hook function is set on the target module through the monitoring module, and the Hook function is used to obtain data passing through the target module, and the data includes execution parameters and IP address of the target module, including: if the target module has been loaded, a corresponding Hook function is set for at least one target function in the target module through the monitoring module, and the Hook function is used to obtain data passing through the corresponding target function, and the data obtained through at least one Hook function corresponding to at least one target function includes execution parameters and IP address of the corresponding process.

[0008] Furthermore, the at least one target function includes an httpapi.dll.HttpReceiveHttp-Request function, an httpapi.dll.HttpReceiveRequestEntityBody function, and an sspicli.dll.DecryptMessage function.

[0009] Furthermore, the determining whether the format of the data is the target format includes: obtaining data passing through the at least one target function according to at least one Hook function corresponding to the at least one target function, integrating the data passing through the at least one target function, and determining whether the format of the integrated data is the target format.

[0010] Furthermore, the target format includes XML format.

[0011] Furthermore, matching the parsed execution parameters through preset rules and intercepting the operation of the process according to the matching results includes: throwing the parsed execution parameters into the threat behavior engine for matching with preset rules, and intercepting the operation of the process according to the matching results.

[0012] In the second aspect, an embodiment of the present invention also provides a protection device based on WinRM service, including: a first processing module, for installing a monitoring module in a process in response to detecting a WinRM service, the monitoring module being used to monitor whether the process has loaded a target module; a second processing module, for setting a Hook function on the target module through the monitoring module if the target module has been loaded, the Hook function being used to obtain data passing through the target module, the data including execution parameters and an IP address of the target module; a third processing module, for determining whether the format of the data is a target format, and if so, parsing the data to obtain parsed execution parameters and a parsed IP address, matching the parsed execution parameters through preset rules, intercepting the operation of the process according to the matching result, and performing a security response to the remote computer corresponding to the IP address according to the parsed IP address.

[0013] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the protection method based on WinRM service as described in the first aspect are implemented.

[0014] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the protection method based on the WinRM service as described in the first aspect.

[0015] In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the steps of protection based on the WinRM service described in the first aspect.

[0016] The WinRM service-based protection method and device provided by the embodiment of the present invention, in response to detecting the process of the WinRM service, installs a monitoring module in the process, and the monitoring module is used to monitor whether the process loads the target module; if the target module has been loaded, the monitoring module sets a Hook function on the target module, and the Hook function is used to obtain data passing through the target module, and the data includes the execution parameters and IP address of the target module; it is determined whether the format of the data is the target format, and if so, the data is parsed to obtain the parsed execution parameters and the parsed IP address, and the parsed execution parameters are matched by preset rules, and the operation execution of the process is intercepted according to the matching result, and the remote computer corresponding to the IP address is safely responded to according to the parsed IP address. It can be seen that the monitoring module is installed in the process of the WinRM service, the network communication data of the WinRM service process is monitored, the operation attack of the WinRM service initiated remotely from the intranet is accurately identified, and the IP of the remote machine that initiates the attack is obtained, and a security detection response is performed, so that the defense can grasp the information of the attacker in real time when the intranet remote horizontal penetration attack is carried out, and the IP of the remote machine can be further traced by capturing the source, which effectively improves the security defense capability. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 This is a flow chart of an embodiment of a protection method based on WinRM service of the present invention;

[0019] Figure 2 Flowcharts of other embodiments of the protection method based on WinRM service of the present invention;

[0020] Figure 3 Flowcharts of some further embodiments of the protection method based on WinRM service of the present invention;

[0021] Figure 4 It is a schematic diagram of an application scenario of the protection method based on WinRM service of the present invention;

[0022] Figure 5 This is a schematic diagram of the structure of an embodiment of a protection device based on WinRM service of the present invention;

[0023] Figure 6 It is a schematic diagram of the structure of an electronic device entity embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] Figure 1 FIG. 1 is a flow chart of an embodiment of the protection method based on WinRM service of the present invention. Figure 1 As shown, the protection method based on WinRM service in the embodiment of the present invention includes:

[0026] S101, in response to detecting a process of a WinRM service, installing a monitoring module in the process, the monitoring module being used to monitor whether the process loads a target module.

[0027] The process can be started by a remote computer on the intranet.

[0028] Windows Remote Management service, referred to as WinRM service, is Windows' implementation of WS-Management. WinRM allows remote users to use tools and scripts to manage Windows servers and obtain data.

[0029] A process is a program with independent functions that runs on a certain data set. It can apply for and own system resources. It is a dynamic concept and an active entity. It is not just the program code, but also the current activity, which is represented by the value of the program counter and the content of the processing register.

[0030] As an example, you can use the system-provided API function QueryServiceStatusEx and pass in the WinRM service name (ie, WinRM). The process ID of the WinRM service can be found in the data returned by the QueryServiceStatusEx function. If the process ID of the WinRM service exists, the WinRM service process is detected.

[0031] As an example, the monitoring module is installed by injecting it into the WinRM service process, that is, the API function in the WinRM service process is modified in memory to complete the preset Hook function operation, and then the communication data of WinRM is monitored in the Hook function.

[0032] The monitoring module may be a tool or script for monitoring a process, and is installed in the process of the WinRM service when the process of the WinRM service exists.

[0033] The target module runs in the WinRM service process. There is at least one module running in the WinRM service process. The appropriate target module can be selected according to specific needs.

[0034] Intranet is a local area network. Computers in the intranet access the Internet through a public gateway using the NAT (Network Address Translation) protocol. Computers in the intranet can send connection requests to other computers on the Internet, but other computers on the Internet cannot send connection requests to computers in the intranet.

[0035] In the existing network attack protection technology, attackers use the compromised machines in the intranet as a springboard to launch remote attacks using WinRM against the machines to be attacked. However, there is a lack of effective and accurate identification and monitoring protection mechanisms in the attacked machines, which makes the defender in a state of monitoring failure. Therefore, when the WinRM service in the attacked machine in the intranet is started, a monitoring module is installed in the process to monitor and identify the modules and traffic data loaded in the process.

[0036] S102: If the target module has been loaded, a Hook function is set on the target module through the monitoring module. The Hook function is used to obtain data passing through the target module, and the data includes execution parameters and IP address of the target module.

[0037] Hook function, that is, hook function, can capture the function call first before the system calls a function, obtain the control of the function, and perform additional processing on the function.

[0038] Internet Protocol Address (IP Address) is a unified address format provided by the IP protocol. It assigns a logical address to each network and each host on the Internet to shield the difference in physical addresses.

[0039] As an example, the execution parameter may be to call Win32 API, which is the application programming interface (Application Programming Interface) of Microsoft 32-bit platform. All applications running on Win32 platform can call these functions.

[0040] S103, determine whether the format of the data is the target format, if so, parse the data to obtain the parsed execution parameters and the parsed IP address, match the parsed execution parameters through preset rules, intercept the operation of the process according to the matching results, and make a security response to the remote computer corresponding to the IP address according to the parsed IP address.

[0041] In some embodiments, if the format of the data is not the target format, the non-target data can be parsed and analyzed, or it can be ignored directly. The preset rule can be about a preset function name or call action. The security response can be to inform other computers in the intranet, or to notify the control center to shut down the remote computer, etc.

[0042] Parsing means format conversion.

[0043] As an example, the matching result will return two states: 1. Block, 2. Release. If it is blocked, the execution behavior of the WinRM service process is intercepted. If it is released, the WinRM process itself continues to execute.

[0044] The protection method based on WinRM service provided by the embodiment of the present invention is to install a monitoring module in the process in response to detecting the process of WinRM service, and the monitoring module is used to monitor whether the process loads the target module; if the target module has been loaded, a Hook function is set on the target module through the monitoring module, and the Hook function is used to obtain data passing through the target module, and the data includes the execution parameters and IP address of the target module; it is determined whether the format of the data is the target format, and if so, the data is parsed to obtain the parsed execution parameters and the parsed IP address, and the parsed execution parameters are matched by preset rules, and the operation execution of the process is intercepted according to the matching result, and the remote computer corresponding to the IP address is safely responded to according to the parsed IP address. It can be seen that the monitoring module is installed in the process of WinRM service, the network communication data of WinRM service process is monitored, the operation attack of WinRM service initiated remotely from the intranet is accurately identified, and the IP of the remote machine that initiates the attack is obtained, and a security detection response is performed, so that the defense can grasp the information of the attacker in real time when the intranet remote horizontal penetration attack is carried out, and the IP of the remote machine can be further traced by capturing the source, which effectively improves the security defense capability.

[0045] Figure 2 Flowcharts of other embodiments of the protection method based on WinRM service of the present invention. Figure 2 As shown, the protection method based on WinRM service in the embodiment of the present invention includes:

[0046] S201, in response to detecting a process of a WinRM service, installing a monitoring module in the process, the monitoring module being used to monitor whether the process loads a target module.

[0047] In some embodiments, the specific implementation of step 201 and the technical effects thereof can be referred to in Figure 1 The corresponding step 101 in the embodiment will not be described in detail here.

[0048] S202: If the target module has been loaded, a corresponding Hook function is set for at least one target function in the target module through the monitoring module. The Hook function is used to obtain data through the corresponding target function. The data obtained through at least one Hook function corresponding to at least one target function includes the execution parameters and IP address of the corresponding process.

[0049] That is, the target module running in the WinRM service process includes at least one target function, and a Hook function is set for each of the at least one target function, and each Hook function is used to obtain data of the corresponding target function. Hook functions can also be set for the data of all functions in the target module.

[0050] In some optional implementations, the at least one target function includes an httpapi.dll.HttpReceiveHttpRequest function, an httpapi.dll.HttpReceiveRequestEntityBody function, and an sspicli.dll.DecryptMessage function.

[0051] As an example, the httpapi.dll.HttpReceiveHttpRequest function is used to synchronously or asynchronously retrieve the next available http request from the specified request queue, that is, to obtain the IP and ID of the remote computer.

[0052] As an example, the httpapi.dll.HttpReceiveRequestEntityBody function is used to receive the additional entity data of the specified http request, that is, to record the encrypted http data packet address and the ID of the remote computer.

[0053] As an example, the sspicli.dll.DecryptMessage function is used to obtain the decrypted http packet address and the remote computer ID.

[0054] S203, determine whether the format of the data is the target format. If so, parse the data to obtain the parsed execution parameters and the parsed IP address, throw the parsed execution parameters into the threat behavior engine for preset rule matching, intercept the operation of the process according to the matching result, and make a security response to the remote computer corresponding to the IP address according to the parsed IP address.

[0055] As an example, a threat behavior engine can be a cloud-based behavior recognition capability that uses the accumulated experience of security operations experts to form a set of rules for matching and detecting behavior data (i.e., execution parameters). Based on the detection and matching results, it determines whether the behavior is an attack behavior, and further protects against interception and prevention.

[0056] In some optional implementations, determining whether the format of data is the target format includes: obtaining data passing through at least one target function according to at least one Hook function corresponding to at least one target function, integrating the data passing through at least one target function, and determining whether the format of the integrated data is the target format.

[0057] As an example, taking at least one of the above target functions as an example, the IP and ID of the remote computer, the IP and ID of the remote computer, and the decrypted http data packet address and the ID of the remote computer are obtained respectively through the httpapi.dll.HttpReceiveHttpRequest function, the httpapi.dll.HttpReceiveRequestEntityBody function and the sspicli.dll.DecryptMessage function. The IP of the remote computer and the decrypted http data packet address are integrated together through the ID of the remote computer. The decrypted data is obtained according to the decrypted http data packet address, and then the format of the decrypted data is determined.

[0058] The protection method based on WinRM service provided by the embodiment of the present invention installs a monitoring module in the process of WinRM service to monitor the network communication data of at least one target function in the WinRM service process. The network communication data of at least one target function can more accurately identify the operation attack of WinRM service initiated remotely from the intranet, and obtain the IP of the remote machine that initiates the attack, and perform security detection response, so that the defense can grasp the information of the attacker in real time when facing remote lateral penetration attack on the intranet, and can further trace the source by capturing the IP of the remote machine, thereby effectively improving the security defense capability.

[0059] Figure 3 The following are some flow charts of some embodiments of the protection method based on WinRM service of the present invention. Figure 3As shown, the protection method based on WinRM service in the embodiment of the present invention includes:

[0060] S301, in response to detecting a process of a WinRM service, installing a monitoring module in the process, the monitoring module being used to monitor whether the process loads a WsmSvc.dll module.

[0061] WsmSvc.dll is a Windows dynamic link library and the only core module for WinRM service to work. Dynamic link library is the abbreviation of Dynamic Link Library. Programs and browsers need such dynamic link libraries because they contain program codes, data, etc.

[0062] In some embodiments, the specific implementation of step 301 and the technical effects thereof can be referred to in Figure 1 The corresponding step 101 in the embodiment will not be described in detail here.

[0063] S302: If the WsmSvc.dll module has been loaded, a Hook function is set on the WsmSvc.dll module through the monitoring module. The Hook function is used to obtain data passing through the WsmSvc.dll module, and the data includes execution parameters and IP address of the target module.

[0064] In some embodiments, the specific implementation of step 302 and the technical effects thereof can be referred to in Figure 1 The corresponding step 102 in the embodiment will not be described in detail here.

[0065] S303, determine whether the format of the data is the target format, if so, parse the data to obtain the parsed execution parameters and the parsed IP address, match the parsed execution parameters through preset rules, intercept the operation of the process according to the matching results, and make a security response to the remote computer corresponding to the IP address according to the parsed IP address.

[0066] In some optional implementations, the target format includes an XML format.

[0067] The target format may also be other formats, which is not limited by the present invention.

[0068] The data that needs to be judged is the plain text data in the XML format of the WinRM service. Then, to extract the execution command from this data, it is necessary to further parse the data inside. If the parsed data is still encrypted data, continue to decrypt until the unencrypted execution parameters and IP address are obtained.

[0069] The plain text data in XML format can be found below:

[0070] / *Remote computer IP* /

[0071] <a:to> http: / / 192.168.44.144:5985 / wsman?PSVersion=2.0 < / a:To >

[0072] …

[0073] / *Data that needs secondary decryption* /

[0074] <rsp:arguments>AAAAAAAAAAwAAAAAAAAAAMAAAbFAgAAAAYQAgBdHAv7qqLoQL4JXGVrX / z23zYE / f9vik2yrpJ8iMq7de+7v zxPYmogUmVmSWQ9IjAiPjxNUz48T2JqIE49IlBvd2VyU2hlbGwiIFJlZklkPSIxIj48TVM+PE9iaiBOPSJDb…< / rsp:arguments>

[0075] After decrypting the above data, the execution parameters are obtained.

[0076] The protection method based on WinRM service provided by the embodiment of the present invention installs a monitoring module in the process of WinRM service, monitors the network communication data of the WsmSvc.dll module in the WinRM service process, and more comprehensively identifies the operation attack of WinRM service initiated remotely from the intranet through the network communication data of the WsmSvc.dll module, and obtains the IP of the remote machine that initiates the attack, and performs security detection response, so that the defense can grasp the information of the attacker in real time when the intranet is attacked by remote lateral penetration, and can further trace the source by capturing the IP of the remote machine, thereby effectively improving the security defense capability.

[0077] Figure 4 Schematic diagram of the application scenario of the protection method based on WinRM service of the present invention. Figure 4 As shown in the figure, the steps of WinRM service-based protection include:

[0078] 1. Find and identify the WinRM service process and install the monitoring module to the WinRM service process;

[0079] 2. The monitoring module in the WinRM service process will detect whether the current process has loaded the WsmSvc.dll module;

[0080] Because WinRM is a communication protocol based on the Web Services Management standard (WS-Management standard, the WS-Management specification is a standard proposed by the internationally renowned standardization organization DMTF for system management using Web Services technology.

[0081] The specification was formulated with reference to many mature Web Services standards, and the WS-Management specification was also improved accordingly. The protocol is a firewall-friendly standard protocol based on the Simple Object Access Protocol (SOAP). To monitor the communication data of the protocol, the monitoring module will preset the Hook function for the IAT (PE Input Table) function of the WsmSvc.dll module, which are httpapi.dll.HttpReceiveHttpRequest;

[0082] httpapi.dll.HttpReceiveRequestEntityBody, sspicli.dll.DecryptMessage function

[0083] IAT (PE input table) function, generally when a program calls its own function, its own function address RAV is fixed; but when the program calls a function in a dll, the address of the dll will be relocated, causing the function address in the dll to change every time.

[0084] In order to accurately call the address of the dll function every time, a table (PE input table) is specially constructed to store the address of the dll function after the dll is relocated each time the program runs. After that, when the program calls the dll function, it can use a "similar pointer" to point to this table and take its value as the new address of the function. The dll function can be called accurately;

[0085] 3. When the WinRM service process receives a packet of WinRM protocol network communication, the httpapi.dll.HttpReceiveHttpRequest preset Hook function is triggered, which records the HTTP request data (remote computer IP). When the httpapi.dll.HttpReceiveRequestEntityBody preset Hook function is triggered, the HTTP request ID and data address are recorded. When the sspicli.dll.DecryptMessage preset Hook function is triggered, the decrypted HTTP data content is recorded (generally, these three functions will be triggered at the same time);

[0086] 4. WinRM relies on SOAP protocol communication (SOAP protocol, namely Simple Object Access Protocol, is a protocol specification for exchanging data. It is a lightweight, simple, XML-based (a subset of Standard Generalized Markup Language) protocol designed to exchange structured and solidified information on the WEB). SOAP is based on XML format. When it is determined that the HTTP data content after decryption is in XML format, the data is parsed to obtain the WinRM remote execution script or command parameter data and the remote computer IP, and pass it to the threat behavior engine for security identification. Finally, the interception process is determined based on the identification results.

[0087] Figure 5 FIG. 1 is a schematic diagram of the structure of an embodiment of a protection device based on WinRM service of the present invention. Figure 3 As shown, the protection device based on the WinRM service includes:

[0088] The first processing module 501 is used to install a monitoring module in the process in response to detecting the process of the WinRM service, and the monitoring module is used to monitor whether the process loads the target module;

[0089] The second processing module 502 is used to set a Hook function on the target module through the monitoring module if the target module has been loaded, and the Hook function is used to obtain data passing through the target module, and the data includes execution parameters and IP address of the target module;

[0090] The third processing module 503 is used to determine whether the format of the data is the target format. If so, the data is parsed to obtain the parsed execution parameters and the parsed IP address, the parsed execution parameters are matched through preset rules, the operation of the process is intercepted according to the matching results, and a security response is made to the remote computer corresponding to the IP address according to the parsed IP address.

[0091] Optionally, the target module includes a WsmSvc.dll module.

[0092] Optionally, the target module includes at least one target function; and

[0093] The second processing module 502 is further used for:

[0094] If the target module has been loaded, a corresponding Hook function is set for at least one target function in the target module through the monitoring module. The Hook function is used to obtain data through the corresponding target function. The data obtained through at least one Hook function corresponding to at least one target function includes the execution parameters and IP address of the corresponding process.

[0095] Optionally, the at least one target function includes an httpapi.dll.HttpReceiveHttpRequest function, an httpapi.dll.HttpReceiveRequestEntityBody function, and an sspicli.dll.DecryptMessage function.

[0096] Optionally, the third processing module 503 is further used for:

[0097] According to at least one Hook function corresponding to at least one target function, data passing through at least one target function is obtained, and after integrating the data passing through at least one target function, it is determined whether the format of the integrated data is a target format.

[0098] Optionally, the target format comprises an XML format.

[0099] Optionally, the third processing module 503 is further used for:

[0100] The parsed execution parameters are thrown into the threat behavior engine for preset rule matching, and the process operations are intercepted based on the matching results.

[0101] Here is an example:

[0102] Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6 As shown, the electronic device may include: a processor (processor) 601, a communication interface (Communications Interface) 602, a memory (memory) 603 and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 complete mutual communication through the communication bus 604. The processor 601 can call the logic instructions in the memory 603 to execute the following method: in response to detecting the process of the WinRM service, a monitoring module is installed in the process, and the monitoring module is used to monitor whether the process loads the target module; if the target module has been loaded, a Hook function is set on the target module through the monitoring module, and the Hook function is used to obtain data passing through the target module, and the data includes the execution parameters and IP address of the target module; it is determined whether the format of the data is the target format, and if so, the data is parsed to obtain the parsed execution parameters and the parsed IP address, and the parsed execution parameters are matched through preset rules, and the operation of the process is intercepted according to the matching result, and a security response is made to the remote computer corresponding to the IP address according to the parsed IP address.

[0103] In addition, the logic instructions in the above-mentioned memory 603 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0104] On the other hand, an embodiment of the present invention further provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the protection method based on the WinRM service provided by the above-mentioned embodiments, for example, including: in response to detecting a process of the WinRM service, installing a monitoring module in the process, the monitoring module is used to monitor whether the process has loaded a target module; if the target module has been loaded, setting a Hook function on the target module through the monitoring module, the Hook function is used to obtain data passing through the target module, the data including execution parameters and IP address of the target module; judging whether the format of the data is the target format, if so, parsing the data to obtain parsed execution parameters and parsed IP address, matching the parsed execution parameters through preset rules, intercepting the operation of the process according to the matching results, and performing a security response to the remote computer corresponding to the IP address according to the parsed IP address.

[0105] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the protection method based on the WinRM service provided by the above-mentioned embodiments, for example, including: in response to detecting a process of the WinRM service, installing a monitoring module in the process, the monitoring module being used to monitor whether the process has loaded a target module; if the target module has been loaded, setting a Hook function on the target module through the monitoring module, the Hook function being used to obtain data passing through the target module, the data including execution parameters and an IP address of the target module; determining whether the format of the data is the target format, and if so, parsing the data to obtain parsed execution parameters and a parsed IP address, matching the parsed execution parameters through preset rules, intercepting the operation of the process according to the matching result, and performing a security response to the remote computer corresponding to the IP address according to the parsed IP address.

[0106] The device embodiments described above are merely illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, i.e., they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without paying creative labor.

[0107] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0108] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.< / a:to>

Claims

1. A protection method based on WinRM service, characterized in that: The method comprises: In response to detecting a process of WinRM service started by a remote computer in the intranet, a monitoring module is installed in the process, the monitoring module is used to monitor whether the process loads a target module; the target module includes a WsmSvc.dll module; the WsmSvc.dll module is a Windows dynamic link library and is the only core module for WinRM service work; If the target module has been loaded, a Hook function is set on the target module through the monitoring module, and the Hook function is used to obtain data passing through the target module, and the data includes execution parameters and IP address of the target module; wherein the Hook function is used to obtain data passing through the WsmSvc.dll module; Determine whether the format of the data is the target format. If so, parse the data to obtain parsed execution parameters and a parsed IP address, match the parsed execution parameters through preset rules, intercept the operation of the process according to the matching result, and perform a security response to the remote computer corresponding to the IP address according to the parsed IP address; matching the parsed execution parameters through preset rules and intercepting the operation of the process according to the matching result includes: throwing the parsed execution parameters into a threat behavior engine for matching with preset rules, intercepting the operation of the process according to the matching result, and the execution parameters are application programming interfaces that call Microsoft 32-bit platforms.

2. The WinRM service-based protection method according to claim 1, characterized in that: The target module includes at least one target function; and If the target module has been loaded, a Hook function is set on the target module through the monitoring module, and the Hook function is used to obtain data passing through the target module, and the data includes execution parameters and IP address of the target module, including: If the target module has been loaded, a corresponding Hook function is set for the at least one target function in the target module through the monitoring module. The Hook function is used to obtain data through the corresponding target function. The data obtained through at least one Hook function corresponding to at least one target function includes execution parameters and IP address of the corresponding process.

3. The WinRM service-based protection method according to claim 2, characterized in that: The at least one target function includes an httpapi.dll.HttpReceiveHttpRequest function, an httpapi.dll.HttpReceiveRequestEntityBody function, and an sspicli.dll.DecryptMessage function.

4. The WinRM service-based protection method according to claim 2, characterized in that: The determining whether the format of the data is a target format includes: According to at least one Hook function corresponding to the at least one target function, data passing through the at least one target function is obtained, and after integrating the data passing through the at least one target function, it is determined whether the format of the integrated data is the target format.

5. The WinRM service-based protection method according to claim 1, characterized in that: The target format includes XML format.

6. A protection device based on WinRM service, characterized in that: The device comprises: A first processing module is used for, in response to detecting a process of WinRM service started by a remote computer in the intranet, installing a monitoring module in the process, wherein the monitoring module is used for monitoring whether the process loads a target module; the target module includes a WsmSvc.dll module; the WsmSvc.dll module is a Windows dynamic link library and is the only core module for WinRM service operation; A second processing module is used for setting a Hook function on the target module through the monitoring module if the target module has been loaded, wherein the Hook function is used to obtain data passing through the target module, wherein the data includes execution parameters and an IP address of the target module; wherein the Hook function is used to obtain data passing through the WsmSvc.dll module; The third processing module is used to determine whether the format of the data is the target format. If so, the data is parsed to obtain the parsed execution parameters and the parsed IP address, the parsed execution parameters are matched through preset rules, the operation of the process is intercepted according to the matching result, and a security response is made to the remote computer corresponding to the IP address according to the parsed IP address; the third processing module is also used to: throw the parsed execution parameters into the threat behavior engine for preset rule matching, intercept the operation of the process according to the matching result, and the execution parameters are to call the application programming interface of the Microsoft 32-bit platform.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the protection method based on WinRM service as described in any one of claims 1 to 5 are implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the protection method based on WinRM service as described in any one of claims 1 to 5 are implemented.

9. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by the processor, the processor implements the steps of the protection method based on WinRM service as described in any one of claims 1 to 5.

Images