Computer sensitive command detection method and device

Abstract

The present invention provides a computer sensitive command detection method and device, wherein the method includes: generating a registry file based on a plurality of acquired sensitive commands; the plurality of sensitive commands are obtained by removing commonly used computer commands from attack commands of APT and / or penetration testing; importing the registry file into a computer to create an image hijacking item; when it is detected that the computer is running any of the plurality of sensitive commands in the foreground or background, triggering the corresponding image hijacking item to issue an alarm. This solution eliminates commonly used computer commands from attack commands of APT and / or penetration testing, so that the sensitive commands to be detected are more accurate attack commands, thereby reducing the false alarm rate; in addition, by importing a plurality of sensitive commands into a computer in the form of a registry file, the execution status of the computer sensitive commands can be quickly perceived using the Windows debugging application mechanism.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer security technology, and in particular to a computer sensitive command detection method and device. Background Art

[0002] As security threats evolve, problems with traditional endpoint security products are becoming increasingly prominent. Currently, sensitive computer commands are detected through antivirus or EDR software. These software utilize hooking technology at the kernel or application layer to detect sensitive commands and generate alerts. However, existing solutions suffer from a high false positive rate. Summary of the Invention

[0003] The embodiments of the present invention provide a computer sensitive command detection method and device, which can reduce the false alarm rate of sensitive command alarms.

[0004] In a first aspect, an embodiment of the present invention provides a computer sensitive command detection method, comprising:

[0005] Generate a registry file based on the obtained multiple sensitive commands; the multiple sensitive commands are obtained by removing commonly used computer commands from the attack commands of APT and / or penetration testing;

[0006] Importing the registry file into a computer to create an image hijacking entry;

[0007] When it is detected that the computer is running any of the multiple sensitive commands in the foreground or background, the corresponding image hijacking item is triggered to issue an alarm.

[0008] In a possible implementation, the method for determining the frequently used computer commands includes: determining the frequently used computer commands based on the execution frequency of the commands within a time period.

[0009] In a possible implementation, the registry file further includes at least: alarm prompt information and a domain name;

[0010] The triggering of the corresponding image hijacking item to issue an alarm includes:

[0011] generating an alarm item according to the alarm prompt information;

[0012] Adding the alarm item as a prefix to the domain name to form an alarm domain name;

[0013] The alarm domain name is sent to a domain name resolution server in a DNS domain name resolution manner, so that the domain name resolution server resolves the alarm item from the alarm domain name.

[0014] In a possible implementation, the alarm prompt information includes: at least one of a user name, a computer name, and a running sensitive command;

[0015] The alarm item is obtained by arranging and splicing the at least one alarm prompt information.

[0016] In a possible implementation, the method further includes: the domain name resolution server is further configured to send the resolved alarm item to the alarm receiving terminal based on the correspondence between the alarm domain name and the alarm receiving terminal and according to the communication information of the alarm receiving terminal.

[0017] In a possible implementation, the communication information of the alarm receiving end is located in the alarm item.

[0018] In a second aspect, an embodiment of the present invention further provides a computer sensitive command detection device, comprising:

[0019] A generating unit, configured to generate a registry file based on the obtained multiple sensitive commands; the multiple sensitive commands are obtained by removing commonly used computer commands from attack commands of APT and / or penetration testing;

[0020] A creation unit, configured to import the registry file into a computer to create an image hijacking entry;

[0021] The detection alarm unit is used to trigger the corresponding image hijacking item and issue an alarm when it is detected that the computer is running any sensitive command among the multiple sensitive commands in the foreground or background.

[0022] In a third aspect, an embodiment of the present invention further provides a computer sensitive command detection device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the method described in any one of the above items.

[0023] In a fourth aspect, an embodiment of the present invention further provides a computer sensitive command detection system, comprising a domain name resolution server and the computer sensitive command detection device as described above.

[0024] In a fifth aspect, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method described in any embodiment of this specification.

[0025] An embodiment of the present invention provides a computer sensitive command detection method and device. Commonly used computer commands may exist in the attack commands of APT and / or penetration testing. Commonly used computer commands are computer security commands. By removing the commonly used computer commands from the attack commands of APT and / or penetration testing, the sensitive commands to be detected are more accurate attack commands, thereby reducing the false alarm rate. In addition, by importing multiple sensitive commands into the computer in the form of registry files, the execution status of the computer sensitive commands can be quickly perceived by utilizing the Windows debugging application mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0027] Figure 1 This is a flow chart of a computer sensitive command detection method provided by one embodiment of the present invention;

[0028] Figure 2 This is a hardware architecture diagram of an electronic device provided by one embodiment of the present invention;

[0029] Figure 3 This is a structural diagram of a computer sensitive command detection device provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0031] As mentioned above, most current antivirus or EDR software utilizes hooking technology at the kernel or application layer to detect sensitive commands. However, since there are many commands at the kernel and application layers, normal software operations can often be mistaken for attack operations, resulting in false positives and interceptions.

[0032] Based on this, the inventive concept of the present invention is to customize the detection of sensitive commands to eliminate commonly used computer commands, so that the generated sensitive command list is a more realistic attack command to reduce the false alarm rate, and use the Windows debugging application mechanism to quickly perceive the execution status of computer sensitive commands.

[0033] The specific implementation of the above concept is described below.

[0034] Please refer to Figure 1 , an embodiment of the present invention provides a computer sensitive command detection method, the method comprising:

[0035] Step 100: Generate a registry file based on the acquired multiple sensitive commands; the multiple sensitive commands are obtained by removing commonly used computer commands from attack commands of APT and / or penetration testing;

[0036] Step 102, importing the registry file into the computer to create an image hijacking item;

[0037] Step 104: When it is detected that the computer is running any of the multiple sensitive commands in the foreground or background, the corresponding image hijacking item is triggered to issue an alarm.

[0038] In an embodiment of the present invention, commonly used computer commands may exist in the attack commands of APT and / or penetration testing. Common computer commands are computer security commands. By removing commonly used computer commands from the attack commands of APT and / or penetration testing, the sensitive commands to be detected are more accurate attack commands, thereby reducing the false alarm rate. In addition, by importing multiple sensitive commands into the computer in the form of registry files, the execution status of the computer sensitive commands can be quickly perceived by utilizing the Windows debugging application mechanism.

[0039] Described below Figure 1 How to perform the steps shown.

[0040] First, step 100 "generating a registry file based on the obtained multiple sensitive commands; the multiple sensitive commands are obtained after removing commonly used computer commands from the attack commands of APT and / or penetration testing" and step 102 "importing the registry file into the computer to create an image hijacking item" are explained at the same time.

[0041] In an embodiment of the present invention, the method for generating the multiple sensitive commands includes: obtaining attack commands of APT (Advanced Persistent Threat) and / or penetration testing; determining commonly used computer commands; and eliminating commonly used computer commands from the attack commands of APT and / or penetration testing.

[0042] The attack commands of APT and / or penetration testing may be a default sensitive command list provided by the system.

[0043] Since commonly used computer commands may be included in the default sensitive command list provided by the system, if commonly used computer commands are used as sensitive commands and alarms are issued, not only false alarms will be generated, but also the normal operation of the computer will be affected. In one embodiment of the present invention, the method for determining commonly used computer commands may include: determining commonly used computer commands based on the frequency of command execution by the computer within a time period.

[0044] Specifically, each command executed by the computer during the monitoring period is obtained based on a log or agent, the execution frequency of each command during the monitoring period is counted, and commands whose execution frequency exceeds a set frequency are determined as frequently used commands of the computer.

[0045] In one embodiment, the set frequency may be 0, that is, as long as the command has been executed in the computer, it indicates that the command is a commonly used command.

[0046] It should be noted that when determining commonly used computer commands, the computer monitoring commands can be the computer for which sensitive command detection is desired, or it can be multiple computers. When multiple computers are monitoring commands, the range of commonly used computer commands identified is wider, further ensuring the accuracy of the sensitive commands ultimately obtained as attack commands.

[0047] Furthermore, for the multiple sensitive commands obtained after eliminating commonly used computer commands, users can also add or delete the multiple sensitive commands obtained in a customized manner according to their personal security literacy and capabilities to obtain sensitive commands for generating registry files.

[0048] In an embodiment of the present invention, after obtaining the sensitive commands for generating a registry file, the user can access the system through a web interface and manually input multiple sensitive commands into the system, so that the system obtains the multiple sensitive commands.

[0049] Since these sensitive commands do not appear or rarely appear in daily computer use, using these sensitive commands as commands to be detected can greatly reduce the false alarm rate.

[0050] In one embodiment of the present invention, in order to improve the perception speed of sensitive commands, the Windows debugging application mechanism can be used to implement the detection of sensitive commands. Therefore, it is necessary to generate a registry file for the multiple sensitive commands obtained.

[0051] Taking the sensitive commands "tasklist.exe" and "wmic.exe" as examples, the generated registry files can be:

[0052] Windows Registry Editor Version 5.00

[0053] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe]

[0054] "GlobalFlag" = dword:00000200

[0055] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\wmic.exe]

[0056] "ReportingMode"=dword:00000001

[0057] In the embodiment of the present invention, when importing the registry file into the computer, it is necessary to use administrator privileges to import it. After importing, an image hijacking item can be created. Taking the two sensitive commands in the above registry file as an example, the image hijacking item created is:

[0058] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe]

[0059] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\wmic.exe]

[0060] In addition, the registry file is not only used to detect sensitive commands, but also used to alarm sensitive commands. In one embodiment of the present invention, the registry file at least includes: alarm prompt information.

[0061] The alarm prompt information is used to inform the alarm receiving terminal of the alarm event. In this embodiment of the present invention, the alarm prompt information may include at least one of the following: the user name, the computer name, and the sensitive command being executed. The alarm receiving terminal can manage a single user per computer, or multiple computers and multiple users. By alerting the alarm receiving terminal of the user name, computer name, and sensitive command being executed, the alarm receiving terminal can process the alarm event.

[0062] Next, for step 104, when it is detected that the computer is running any of the multiple sensitive commands in the foreground or background, the corresponding image hijacking item is triggered to issue an alarm.

[0063] In an embodiment of the present invention, one alarm mode is to directly send an alarm prompt message to an alarm receiving terminal when a sensitive command is detected.

[0064] Furthermore, since the alarm prompt information is directly sent to the alarm receiving terminal, it may be discovered by an attacker and then blocked from being sent. In one embodiment of the present invention, the registry file may also include a domain name to implement the sending of the alarm prompt information through DNS domain name resolution.

[0065] Specifically, the triggering of the corresponding image hijacking item to alarm includes: generating an alarm item according to the alarm prompt information; adding the alarm item as a prefix to the domain name to form an alarm domain name; sending the alarm domain name to the domain name resolution server in the DNS domain name resolution mode, so that the domain name resolution server resolves the alarm item from the alarm domain name.

[0066] The alarm item is obtained by arranging and concatenating at least one alarm message. For example, if the alarm prompt information includes the user name, computer name, and the sensitive command being run, the alarm item can be: username.computername.CMD.

[0067] Among them, the domain name is the preset domain name, for example, microsoft.com, then the generated alarm domain name is: username.computername.CMD.microsoft.com.

[0068] In an embodiment of the present invention, the domain name resolution server can serve as an alarm receiving end or as a resolution and forwarding end for the alarm item. After the domain name resolution server resolves the alarm item, based on the correspondence between the alarm domain name and the alarm receiving end, the resolved alarm item is sent to the alarm receiving end according to the communication information of the alarm receiving end.

[0069] In the embodiment of the present invention, the communication information of the alarm receiving terminal can be stored in the domain name resolution server, or can be located in the alarm item. Specifically, when generating the alarm item, the communication information of the alarm receiving terminal is spliced ​​with the alarm prompt information to generate the alarm item.

[0070] The communication information of the alarm receiving end may be an email address, a mobile phone number, etc.

[0071] Based on this, if the alarm prompt information is the user name, computer name, and the sensitive command being run, and the communication information of the alarm receiver is located in the alarm item, in an example, the registry file is as follows:

[0072] Windows Registry Editor Version 5.00

[0073] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe]

[0074] "GlobalFlag" = dword:00000200

[0075] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\wmic.exe]

[0076] "ReportingMode"=dword:00000001

[0077] "MonitorProcess"="cmd.exe / c start / min powershell.exe-windowstylehidden-command\"$($u=$(\\\"u$env:username\\\"-replace('[^\\x00-\\x 7f]|\\s',"))[0..63]-join"; $c=$(\\\"c$env:computername\\\"-replace('[^\\x00-\\x7f]|\\s',"));\

[0078] Resolve-DnsName-Name\\\"$c.UN.$u.CMD.testoutlook.microsoft.com\\\")\""

[0079] In an embodiment of the present invention, by adding the alarm item as a prefix to the domain name and sending it to the domain name resolution server through DNS domain name resolution, not only can the alarm prompt information be sent out, but also the attacker's perception of the alarm event can be reduced.

[0080] In addition, the embodiments of the present invention can serve as a supplement to security protection software to provide execution detection and alarm of sensitive commands, and sensitive commands are attack commands that will not appear or rarely appear, so the false alarm rate can be greatly reduced; and, by utilizing the Windows debugging application mechanism, it can not only occupy fewer resources, but also quickly perceive and alarm when sensitive commands are executed.

[0081] like Figure 2 、 Figure 3 As shown, an embodiment of the present invention provides a computer sensitive command detection device. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, Figure 2 As shown in FIG. 1 , a hardware architecture diagram of an electronic device where a computer sensitive command detection device is provided in an embodiment of the present invention is provided. Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 3 As shown, as a device in a logical sense, the CPU of the electronic device in which it is located reads the corresponding computer program in the non-volatile memory into the internal memory and runs it. This embodiment provides a computer sensitive command detection device, including:

[0082] A generating unit 301 is configured to generate a registry file based on the acquired multiple sensitive commands; the multiple sensitive commands are obtained by removing commonly used computer commands from attack commands of APT and / or penetration testing;

[0083] A creating unit 302 is configured to import the registry file into a computer to create an image hijacking entry;

[0084] The detection alarm unit 303 is used to trigger the corresponding image hijacking item to alarm when it is detected that the computer is running any sensitive command among the multiple sensitive commands in the foreground or background.

[0085] In one embodiment of the present invention, the method for determining the frequently used computer commands includes: determining the frequently used computer commands based on the execution frequency of the commands within a time period.

[0086] In one embodiment of the present invention, the registry file further includes at least: alarm prompt information and domain name;

[0087] The detection alarm unit is specifically used to: generate an alarm item according to the alarm prompt information; add the alarm item as a prefix to the domain name to form an alarm domain name; send the alarm domain name to the domain name resolution server in the DNS domain name resolution mode, so that the domain name resolution server resolves the alarm item from the alarm domain name.

[0088] In one embodiment of the present invention, the alarm prompt information includes: at least one of a user name, a computer name, and a running sensitive command;

[0089] The alarm item is obtained by arranging and splicing the at least one alarm prompt information.

[0090] In one embodiment of the present invention, the domain name resolution server is further configured to send the resolved alarm item to the alarm receiving terminal based on the correspondence between the alarm domain name and the alarm receiving terminal and according to the communication information of the alarm receiving terminal.

[0091] In one embodiment of the present invention, the communication information of the alarm receiving end is located in the alarm item.

[0092] It should be understood that the structure illustrated in the embodiments of the present invention does not constitute a specific limitation on a computer-sensitive command detection device. In other embodiments of the present invention, a computer-sensitive command detection device may include more or fewer components than illustrated, or may combine or separate certain components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0093] The information interaction, execution process, etc. between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For specific contents, please refer to the description in the embodiment of the method of the present invention and will not be repeated here.

[0094] An embodiment of the present invention further provides a computer sensitive command detection device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a computer sensitive command detection method in any embodiment of the present invention is implemented.

[0095] An embodiment of the present invention further provides a computer sensitive command detection system, comprising a domain name resolution server and the above-mentioned computer sensitive command detection device.

[0096] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the processor executes a computer-sensitive command detection method according to any embodiment of the present invention.

[0097] Specifically, a system or device equipped with a storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program codes stored in the storage medium.

[0098] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute part of the present invention.

[0099] Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0100] In addition, it should be clear that the functions of any of the above embodiments can be achieved not only by executing the program code read by the computer, but also by enabling the operating system operating on the computer to complete part or all of the actual operations based on the instructions of the program code.

[0101] In addition, it can be understood that the program code read from the storage medium is written into a memory provided in an expansion board inserted into the computer or into a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above embodiments.

[0102] It should be noted that, in this article, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprising a ..." do not exclude the presence of other identical factors in the process, method, article or device comprising the elements.

[0103] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk, etc. Various media that can store program codes.

[0104] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A computer sensitive command detection method, characterized in that: include: Generate registry files based on multiple sensitive commands obtained; The multiple sensitive commands are obtained by removing commonly used computer commands from the attack commands of APT and / or penetration testing; Importing the registry file into a computer to create an image hijacking entry; When it is detected that the computer is running any of the multiple sensitive commands in the foreground or background, the corresponding image hijacking item is triggered to issue an alarm.

2. The method according to claim 1, characterized in that The method for determining the frequently used computer commands includes: determining the frequently used computer commands based on the execution frequency of the commands within a time period.

3. The method according to claim 1, characterized in that The registry file at least includes: alarm prompt information and domain name; The triggering of the corresponding image hijacking item to issue an alarm includes: generating an alarm item according to the alarm prompt information; Adding the alarm item as a prefix to the domain name to form an alarm domain name; The alarm domain name is sent to a domain name resolution server in a DNS domain name resolution manner, so that the domain name resolution server resolves the alarm item from the alarm domain name.

4. The method according to claim 3, characterized in that The alarm prompt information includes: at least one of a user name, a computer name, and a running sensitive command; The alarm item is obtained by arranging and splicing the at least one alarm prompt information.

5. The method according to claim 3, characterized in that Also includes: The domain name resolution server is further configured to send the resolved alarm item to the alarm receiving terminal based on the corresponding relationship between the alarm domain name and the alarm receiving terminal and according to the communication information of the alarm receiving terminal.

6. The method according to claim 5, characterized in that The communication information of the alarm receiving end is located in the alarm item.

7. A computer sensitive command detection device, characterized in that: include: A generation unit, configured to generate a registry file based on the obtained multiple sensitive commands; The multiple sensitive commands are obtained by removing commonly used computer commands from the attack commands of APT and / or penetration testing; A creation unit, configured to import the registry file into a computer to create an image hijacking entry; The detection alarm unit is used to trigger the corresponding image hijacking item and issue an alarm when it is detected that the computer is running any sensitive command among the multiple sensitive commands in the foreground or background.

8. A computer sensitive command detection device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

9. A computer sensitive command detection system, characterized in that: It comprises a domain name resolution server and the computer sensitive command detection device as claimed in claim 8.

10. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 6.

Images