Fileless attack detection method, system, device and storage medium

Abstract

The application discloses a fileless attack detection method, system, device and storage medium. The fileless attack detection method comprises the following steps: when a process creation event is detected, process command information of a target process is acquired, and the process command information is audited and detected to obtain a first audit result; if it is determined according to the first audit result that the target process is allowed to be created, process network information in a network connection process initiated by the target process is acquired, the process network information is audited and detected, and whether the target process is released is determined according to a second audit result. The application solves the technical problem that the accuracy of fileless attack detection is low.

Images