File detection method and device and computer readable storage medium

Abstract

The invention discloses a file detection method and device and a computer readable storage medium, and relates to the field of information security and the field of network security. The method comprises the steps that starting behavior information, aiming at a macro command, in an operating system is obtained, the starting behavior information at least comprises modification information of a first registry and / or modification information of a second registry, the first registry is used for configuring a starting mode of the macro command, and the second registry is used for recording a file which is allowed to execute the macro command; when it is detected that the target file is the file starting the macro command, file behavior information of the target file is obtained, and the file behavior information is used for representing process behavior information and / or operation behavior information related to the target file; and determining whether the target file is an abnormal file or not according to the enabling behavior information and the file behavior information of the target file. According to the method and the device, the technical problem of relatively low detection accuracy of the phishing file using a macro command to perform a hostile attack behavior in the prior art is solved.

Description

Technical Field

[0001] The present application relates to the fields of information security and network security, and in particular to a file detection method, device and computer-readable storage medium. Background Art

[0002] Phishing documents are a technique related to online fraud or social engineering. In the field of cybersecurity, "phishing" usually refers to the act of tricking victims into providing sensitive information (such as usernames, passwords, bank account details, etc.) by disguising as a trusted source. "Phishing documents" specifically refer to fake documents used in this process, such as email attachments and files in download links. These documents are designed to look like normal, harmless files (such as invoices, reports, contracts, or software update notifications), but may contain malware or guide users to visit fake websites to enter personal information.

[0003] A macro command (or simply macro) is a programming function that allows users to automatically complete a series of complex operations through simple steps. In office software, macro commands can be used to automate repetitive tasks, such as formatting text, performing calculations, and data sorting. Macro commands are essentially scripts composed of programming instructions that tell the software how to perform a specific sequence of tasks.

[0004] However, the functionality of macros also makes them a way for malware to spread. Hackers can create macros containing malicious code, and when users enable these macros without their knowledge, the malicious code will be executed, which may download and install viruses, Trojans, ransomware and other malicious programs to the user's computer.

[0005] At present, the existing technologies are basically based on static features to identify phishing documents based on macro commands. However, static features are at risk of being bypassed, thereby affecting the detection accuracy of phishing documents. In addition, the existing technologies use static features to identify phishing documents based on macro commands and there is a high probability of false alarms.

[0006] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0007] The present application provides a file detection method, device and computer-readable storage medium to at least solve the technical problem in the prior art of low accuracy in detecting phishing files that use macro commands to carry out malicious attacks.

[0008] According to one aspect of the present application, a file detection method is provided, comprising: obtaining enabling behavior information for macro commands in an operating system, wherein the enabling behavior information includes at least modification information of a first registry and / or modification information of a second registry, the first registry being used to configure an enabling method for the macro commands, and the second registry being used to record files that are allowed to execute the macro commands; in the case where it is detected that a target file is a file that enables the macro commands, obtaining file behavior information of the target file, wherein the file behavior information is used to characterize process behavior information and / or operation behavior information related to the target file; and determining whether the target file is an abnormal file based on the enabling behavior information and the file behavior information of the target file.

[0009] Optionally, determining whether the target file is an abnormal file based on the enabling behavior information and the file behavior information of the target file includes: when the enabling behavior information indicates that the first registry is modified to a first table state, detecting whether the process used to modify the first registry is a target process, wherein the first registry in the first table state is configured so that all files with a macro command execution function can unconditionally execute any macro command, and the target process is a process that is allowed to modify the first registry by default; when it is detected that the process used to modify the first registry is the target process, determining whether the target file is the abnormal file based on the file behavior information; when it is detected that the process used to modify the first registry is not the target process, generating warning information, wherein the warning information includes at least the path information of the first registry and the name of the process used to modify the first registry.

[0010] Optionally, when it is detected that the process used to modify the first registry is not the target process, after generating a warning message, the file detection method further includes: modifying the first registry to a second table state, wherein the first registry in the second table state is configured so that all files with the function of executing macro commands need to run the macro commands under the condition of satisfying restriction conditions.

[0011] Optionally, in the case where it is detected that the process used to modify the first registry is the target process, determining whether the target file is the abnormal file according to the file behavior information includes: detecting whether a first notification event is generated within a first time period according to the file behavior information, wherein the first notification event is used to characterize that a file of a target type is generated, the target type is the file type of the target file, and the first time period is a time period in which the first registry is modified to the first table state; in the case where it is detected that the first notification event is generated within the first time period, detecting whether the target process is started within a preset time period after the first notification event is generated; in the case where it is detected that the target process is started within the preset time period after the first notification event is generated, detecting whether the process command line information of the target process includes path information of the created file of the target type; in the case where it is detected that the process command line information of the target process includes path information of the created file of the target type, judging whether an abnormal behavior event is generated after the target process is started, wherein the abnormal behavior event characterizes a behavior event related to the execution of malicious code; and determining whether the target file is the abnormal file according to the judgment result of whether the abnormal behavior event is generated.

[0012] Optionally, the file detection method also includes: determining that the target file is the abnormal file in the presence of any one of the following detection results: a first detection result, used to characterize that it is detected that the first notification event is not generated within the first time period; a second detection result, used to characterize that it is detected that the target process is not started within a preset time period after the first notification event is generated; a third detection result, used to characterize that it is detected that the process command line information of the target process does not include path information of the created target type of file.

[0013] Optionally, determining whether the target file is an abnormal file based on the enabling behavior information and the file behavior information includes: in a case where the enabling behavior information indicates that the second registry is modified to a third table state, detecting whether a process used to modify the second registry is a target process, wherein the second registry in the third table state is configured so that the target file can unconditionally execute any macro command; in a case where it is detected that the process used to modify the second registry is the target process, determining whether the target file is the abnormal file based on the file behavior information; in a case where it is detected that the process used to modify the second registry is not the target process, determining that the target file is the abnormal file.

[0014] Optionally, in the case where it is detected that the process used to modify the second registry is the target process, determining whether the target file is the abnormal file according to the file behavior information includes: in the case where it is detected that the process used to modify the second registry is the target process, detecting whether a first notification event is generated within a second time period according to the file behavior information, wherein the first notification event is used to characterize the generation of a file of a target type, the target type is the file type of the target file, and the second time period is a time period before the second registry is modified to the third table state; in the case where it is detected that the first notification event is generated within the second time period, detecting whether the file path included in the first notification event is the same as the file path of the target file obtained according to the second registry; in the case where it is detected that the file path included in the first notification event is the same as the file path of the target file obtained according to the second registry, judging whether an abnormal behavior event is generated after the target process is started, wherein the abnormal behavior event characterizes a behavior event related to the execution of malicious code; and determining whether the target file is the abnormal file according to the judgment result of whether the abnormal behavior event is generated.

[0015] Optionally, the file detection method also includes: determining that the target file is the abnormal file in the presence of any one of the following detection results: a fourth detection result, used to characterize that it is detected that the first notification event is not generated within the second time period; a fifth detection result, used to characterize that it is detected that the file path included in the first notification event is different from the file path of the target file obtained based on the second registry.

[0016] According to another aspect of the present application, a file detection device is also provided, including: a first acquisition unit, used to acquire enabling behavior information for macro commands in an operating system, wherein the enabling behavior information at least includes modification information of a first registry and / or modification information of a second registry, the first registry is used to configure the enabling method of the macro command, and the second registry is used to record files that are allowed to execute the macro command; a second acquisition unit, used to acquire file behavior information of the target file when it is detected that the target file is a file that enables the macro command, wherein the file behavior information is used to characterize process behavior information and / or operation behavior information related to the target file; a determination unit, used to determine whether the target file is an abnormal file based on the enabling behavior information and the file behavior information of the target file.

[0017] According to another aspect of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, wherein when the computer program is executed, the device where the computer-readable storage medium is located executes any one of the file detection methods described above.

[0018] In the present application, the enabling behavior information for macro commands in the operating system is obtained, wherein the enabling behavior information includes at least modification information of a first registry and / or modification information of a second registry, wherein the first registry is used to configure the enabling method of the macro command, and the second registry is used to record files that are allowed to execute the macro command. Secondly, in the case where it is detected that the target file is a file that enables the macro command, the file behavior information of the target file is obtained, wherein the file behavior information is used to characterize the process behavior information and / or operation behavior information related to the target file. Finally, it is determined whether the target file is an abnormal file based on the enabling behavior information and the file behavior information of the target file.

[0019] As can be seen from the above content, the present application proposes a method for identifying phishing documents (corresponding to the above-mentioned abnormal files) by monitoring the activation behavior information of macro commands. The present application can obtain the configuration change information of the startup mode of the macro command and the change information of the trust record of the target file executing the macro command by monitoring the modification information of the first registry and the modification information of the second registry, so as to identify the behavior of enabling the macro in advance or temporarily enabling the macro. At the same time, according to the technical solution of the present application, the process behavior information and / or operation behavior information related to the target file will also be obtained, and finally the target file will be comprehensively determined to be a phishing document in combination with the activation behavior of the macro command and the file behavior of the target file.

[0020] It can be seen that, unlike the prior art, the solution of the present application is to determine whether the target file is an abnormal file based on dynamic feature information such as the activation behavior of the macro command and the file behavior of the target file. Therefore, using the technical solution of the present application, the difficulty for attackers to bypass file detection will be greatly increased. This is because, unlike static features, dynamic features are changing, so it is difficult for attackers to predict in advance which dynamic feature the defender is using. Moreover, since the present application associates the activation behavior of the macro command with the execution behavior of the file, the detection result can be more accurate and the evidence information can be more comprehensive (including two behavioral dimensions), which can not only greatly reduce the probability of false alarms, but also solve the technical problem of low accuracy in detecting phishing files that use macro commands for malicious attacks in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0022] Figure 1 is a flow chart of an optional file detection method according to an embodiment of the present application;

[0023] Figure 2 is a schematic diagram of an optional file detection system according to an embodiment of the present application;

[0024] Figure 3 It is a schematic diagram of an optional file detection device according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] It should also be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) collected by this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of the relevant regions, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation portals are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0028] According to an embodiment of the present application, an embodiment of a file detection method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0029] Figure 1 is a flowchart of an optional file detection method according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0030] Step S101, obtaining activation behavior information for macro commands in the operating system.

[0031] In step S101, the enabling behavior information includes at least modification information of a first registry and / or modification information of a second registry, the first registry is used to configure the enabling mode of the macro command, and the second registry is used to record files that are allowed to execute macro commands.

[0032] Optionally, the first registry is a registry for configuring the activation mode of the macro command, for example, the first registry may be a VBAWarnings registry, wherein the VBAWarnings registry is a registry related to VBA (Visual Basic for Applications, macro security settings) in Microsoft Office applications. VBAWarnings is located in the following path of the registry as a key value name:

[0033] HKU\Software\Microsoft\Office\Application Version\Word\Security\

[0034] For other Office applications, such as Excel, the above path will be changed accordingly to the name of Excel or other application. This registry key controls the warning behavior of VBA macros as follows:

[0035] A VBAWarnings value of 4 disables all macros without notifying the user.

[0036] A VBAWarnings value of 2 disables all macros and notifies the user if an attempt is made to run a macro.

[0037] A value of 3 for VBAWarnings disables all macros that are not digitally signed.

[0038] When the value of VBAWarnings is 1, it means that all macros are enabled, including unsigned macros, allowing any macro to run without any warning.

[0039] By modifying the VBAWarnings registry, administrators or users can adjust the security policy of Office applications for handling VBA macros to meet different security requirements.

[0040] Optionally, the second registry is used to record files that are allowed to execute macro commands, that is, the second registry can be used as a trust record of files that are allowed to execute macro commands, wherein the trust record is used to store document information marked as trusted by the user or the system. For example, when a user opens a document through an Office application and explicitly trusts the file (for example, by clicking "Enable Content" to allow macros to run), the system will record the information of the document under such a registry key so that certain security warnings can be bypassed when the document is opened again in the future.

[0041] Optionally, the second registry may be a TrustRecords registry. For Office applications such as word files, the specific path is as follows:

[0042] HKU\Software\Microsoft\Office\Application Version\Word\Security\TrustedDocuments\TrustRecords\

[0043] For other Office applications such as Excel, the path will be changed to the name of Excel or other application. Examples of paths are as follows:

[0044] Word:

[0045] HKU\S-1-5-21-3899319431-2787561385-3246391970-18338539\SOFTWARE\Micros oft\Office\16.0\Word\Security\Trusted Documents\TrustRecords

[0046] Excel:

[0047] HKU\S-1-5-21-3899319431-2787561385-3246391970-18344781\SOFTWARE\Micros oft\Office\15.0\Excel\Security\Trusted Documents\TrustRecords

[0048] Optionally, the key value name of the TrustRecords registry key is a file path, and the key value binary data features include the following features:

[0049] The first feature, with a first value (e.g., 01 00 00 00) as a suffix, indicates that the protected file is marked as a file that needs to be edited;

[0050] The second feature, with a second numerical value (eg, FF FF FF 7F) as a suffix, indicates that the macro is enabled.

[0051] Alternatively, here is an example of a phishing document with macros enabled:

[0052] When the user clicks on the phishing document and enables the macro, a new record related to the phishing document will be added to the trust record corresponding to the TrustRecords registry. The key value name of the TrustRecords registry item is the phishing document path, and the key value binary data ends with FF FF FF 7F. The specific TrustRecords registry path is as follows:

[0053] \HKEY_USERS\S-1-5-21-847292834-3402482809-3833557279-1001\Software\Mic rosoft\Office\16.0\Word\Security\Trusted Documents\TrustRecords

[0054] The specific path of the phishing document is as follows:

[0055] %USERPROFILE% / Desktop / Attack and Defense Drill Record.doc

[0056] Optionally, under the default security configuration, if a user opens a macro document, they will be prompted that the macro is disabled and need to manually enable the macro. After the user enables the macro, the TrustRecords registry will add a trust record.

[0057] In an optional embodiment, a file detection system can be used as the execution subject of the file detection method in the embodiment of the present application, wherein the file detection system can be a software system or an embedded system combining software and hardware. In addition, it is known to those skilled in the art that, in addition to using the file detection system as the execution subject, other devices or apparatuses can also be used as the execution subject, for example, a network firewall device. For the convenience of description, the technical solutions of the embodiments of the present application are described below with the file detection system as the execution subject.

[0058] In an optional embodiment, Figure 2 is a schematic diagram of an optional file detection system according to an embodiment of the present application, such as Figure 2 As shown, the file detection system includes: a macro startup monitoring module, a file behavior monitoring module, and a phishing document protection module.

[0059] Optionally, the macro startup monitoring module is mainly used to monitor the relevant registry entries used when macro commands are enabled: \Security\Trusted Documents\TrustRecords and \Security\VBAWarnings.

[0060] Among them, the macro startup monitoring module can use many registry monitoring methods, such as using the Windows APIRegNotifyChangeKeyValue function to monitor changes in registry items, or using ETW Windows event tracking to monitor changes in the registry, or using third-party log collection components such as Sysmon to monitor changes in the registry.

[0061] Optionally, when the VBAWarnings registry key value is modified, first determine whether the modified value data of VBAWarnings is 1. If so, it means that a program has modified the macro configuration to "allow any macro command to run". This will result in macro commands being allowed to execute without any warnings or operation restrictions when the user accesses any macro document. In this scenario, the macro startup monitoring module will construct an alarm event with the alarm name "Enable all macro configuration alarm". The alarm content includes at least: the name of the source process that executes the registry modification, the modified registry path, etc.

[0062] Optionally, when the TrustRecords registry key is modified, first determine whether the modified registry value data (binary) under TrustRecords ends with FF FF FF 7F. If so, it means that a program has added the file as a trusted document and allows the document to execute any macro command, which will result in the macro command being allowed to execute without any warnings or operation restrictions when the user accesses the macro document. In this scenario, the macro startup monitoring module will construct an alarm event, the alarm name is "Add macro trusted document alarm", and the alarm content includes at least: the name of the source process that executes the registry modification, the name of the modified registry key value (equivalent to the path of the macro trusted document), the modified registry key value data, etc.

[0063] Step S102: when it is detected that the target file is a macro-enabled file, file behavior information of the target file is obtained.

[0064] In step S102, the file behavior information is used to represent process behavior information and / or operation behavior information related to the target file.

[0065] Optionally, the target file may be a file in various forms such as a table, a slide, a text, etc. In the embodiment of the present application, any file that can run a macro command may be used as a target file.

[0066] Optionally, the file behavior monitoring module in the file detection system is mainly used to monitor file landing events and renaming events, and determine whether the file type is a macro type document, where file landing refers to the generation of a new file in the local storage, such as downloading a file or creating a file in the local storage.

[0067] Optionally, whether the file type is a macro-type document may be determined by judging by the file name suffix. For example, files ending with suffixes such as .doc, .ppt, .xls, .docm, .pptm, and .xlsm may carry macro commands.

[0068] For example, when an Office type document is found to have been landed or an existing file is modified to be an Office type document, the file behavior monitoring module will issue a notification event. The name of the notification event is "Newly Landed Office Type Document". The content of the notification event includes at least: the process information of the execution file landing, the path of the landing file, etc.

[0069] Optionally, there are many solutions for monitoring file landing events, such as HOOK system file operation related API, or you can use some file event monitoring programs (Sysmon, fsnotify, etc.).

[0070] Optionally, in addition to monitoring file landing events, the file behavior monitoring module can also monitor process startup events and determine whether the started process is an Office process. If so, a notification event is issued with the event name "Office process startup". The event content includes at least: Office process name, parent process information, process command line information, etc.

[0071] Optionally, the file behavior monitoring module can also monitor subsequent related behaviors of the Office process, including process startup behavior, process injection behavior, network communication behavior, file creation behavior, registry operation behavior, scheduled task operation behavior, service operation behavior, etc. The file behavior monitoring module can also use all monitored subsequent behaviors to construct notification events, and the content of the notification event includes complete behavior information.

[0072] Optionally, the file behavior monitoring module may also forward all monitored notification events to the phishing document determination module.

[0073] Step S103: determining whether the target file is an abnormal file according to the activation behavior information and the file behavior information of the target file.

[0074] Alternatively, the abnormal file may also be referred to as a phishing document, where a phishing document is a technique related to cyber fraud or social engineering. In the field of cybersecurity, "phishing" generally refers to the act of tricking victims into providing sensitive information (such as usernames, passwords, bank account details, etc.) by disguising as a trusted source. A phishing document specifically refers to a fake document used in this process, such as an email attachment or a file in a download link. These documents are designed to look like normal, harmless files (such as invoices, reports, contracts, or software update notifications), but may contain malware or direct users to visit fake websites to enter personal information.

[0075] For example, an attacker may send an email claiming to be from a bank or well-known company with a seemingly safe PDF file or Word document attached, with the title "Your account has had unusual activity recently, please see the attached detailed report." Once the victim opens the document, they may be asked to enable macros, which actually executes malicious code in the background to take control of the victim's computer, steal information, or plant ransomware.

[0076] Based on the contents of the above steps S101 to S103, it can be known that in the present application, the enabling behavior information for macro commands in the operating system is obtained, wherein the enabling behavior information at least includes modification information of the first registry and / or modification information of the second registry, the first registry is used to configure the enabling method of the macro commands, and the second registry is used to record the files that are allowed to execute the macro commands. Secondly, in the case where it is detected that the target file is a file that enables macro commands, the file behavior information of the target file is obtained, wherein the file behavior information is used to characterize the process behavior information and / or operation behavior information related to the target file. Finally, it is determined whether the target file is an abnormal file based on the enabling behavior information and the file behavior information of the target file.

[0077] As can be seen from the above content, the present application proposes a method for identifying phishing documents (corresponding to the above-mentioned abnormal files) by monitoring the activation behavior information of macro commands. The present application can obtain the configuration change information of the startup mode of the macro command and the change information of the trust record of the target file executing the macro command by monitoring the modification information of the first registry and the modification information of the second registry, so as to identify the behavior of enabling the macro in advance or temporarily enabling the macro. At the same time, according to the technical solution of the present application, the process behavior information and / or operation behavior information related to the target file will also be obtained, and finally the target file will be comprehensively determined to be a phishing document in combination with the activation behavior of the macro command and the file behavior of the target file.

[0078] It can be seen that, unlike the prior art, the solution of the present application is to determine whether the target file is an abnormal file based on dynamic feature information such as the activation behavior of the macro command and the file behavior of the target file. Therefore, using the technical solution of the present application, the difficulty for attackers to bypass file detection will be greatly increased. This is because, unlike static features, dynamic features are changing, so it is difficult for attackers to predict in advance which dynamic feature the defender is using. Moreover, since the present application associates the activation behavior of the macro command with the execution behavior of the file, the detection result can be more accurate and the evidence information can be more comprehensive (including two behavioral dimensions), which can not only greatly reduce the probability of false alarms, but also solve the technical problem of low accuracy in detecting phishing files that use macro commands for malicious attacks in the prior art.

[0079] In an optional embodiment, the following method may be used to determine whether the target file is an abnormal file according to the startup behavior information and the file behavior information, specifically including:

[0080] In the case where the enabled behavior information represents that the first registry is modified to the first table state, it is detected whether the process used to modify the first registry is the target process, wherein the first registry in the first table state is configured so that all files with the function of executing macro commands can unconditionally execute any macro command, and the target process is a process that is defaulted to allowing modification of the first registry; in the case where it is detected that the process used to modify the first registry is the target process, it is determined whether the target file is an abnormal file based on the file behavior information; in the case where it is detected that the process used to modify the first registry is not the target process, a warning message is generated, wherein the warning message at least includes the path information of the first registry and the name of the process used to modify the first registry.

[0081] Optionally, taking the first registry as the VBAWarnings registry as an example, when the value of VBAWarnings is 1, it indicates that VBAWarnings is modified to the first table state.

[0082] Optionally, when the phishing document protection module is enabled, it will first record the current configuration information related to enabling macro commands. If the current configuration related to enabling macro commands is unsafe, that is, the VBAWarnings value is 1, then the phishing document protection module will prompt the user that the current configuration related to enabling macro commands is unsafe and all macro commands can be executed, so it is recommended that the user change it to a safe configuration. If the user does not adjust it to a safe configuration, the phishing document protection module will not take effect. It should be noted that, by default, the configuration information for enabling macro commands is a safe configuration.

[0083] Optionally, in the first file detection scenario, the phishing document protection module is used to identify whether an abnormal process has modified the configuration information for enabling macro commands and executed macro commands without user permission. Specifically, the following steps may be included:

[0084] Step 1, the phishing document protection module receives the alarm event of "Enable all macro configuration alarm" sent by the macro startup monitoring module. As mentioned above, when the VBAWarnings registry key value is modified, the macro startup monitoring module first determines whether the modified value data of VBAWarnings is 1. If it is, it means that a program has modified the enabled macro configuration to "Allow any macro command to run". This will result in macro commands being allowed to execute without any warnings or operational restrictions when the user accesses any macro document. In this scenario, the macro startup monitoring module will construct an alarm event with the alarm name "Enable all macro configuration alarm". The alarm content includes at least: the name of the source process that executes the registry modification, the modified registry path, etc.

[0085] Step 2: The phishing document protection module determines whether the process that executes the registry modification is an Office process (corresponding to the above-mentioned detection of whether the process used to modify the first registry is the target process).

[0086] Step 3: If it is not an Office process, the phishing document protection module directly issues a phishing event warning message (ie, the above-mentioned warning message).

[0087] It should be noted that the warning information at least includes the path information of the first registry and the name of the process used to modify the first registry, so that the process of enabling macro-related configurations and the specific execution path can be tracked, thereby tracing the attack method of the phishing document.

[0088] In an optional embodiment, when it is detected that the process used to modify the first registry is not the target process, after generating a warning message, the first registry is modified to a second table state, wherein the first registry in the second table state is configured so that all files with the function of executing macro commands need to run macro commands under the condition of meeting restriction conditions.

[0089] Optionally, in the above step 3, after generating the warning information, the phishing document protection module may also restore the configuration information for enabling macro commands, that is, restore it to a safe configuration state, for example, changing the value of VBAWarnings from "1" to "2".

[0090] By modifying the first registry table to the second table state, all files can be configured to run macro commands when restrictive conditions are met (for example, user permission is required), thereby improving the running security of the files.

[0091] In an optional embodiment, when it is detected that the process used to modify the first registry is the target process, determining whether the target file is an abnormal file based on the file behavior information includes: detecting whether a first notification event is generated within a first time period based on the file behavior information, wherein the first notification event is used to characterize that a file of a target type is generated, the target type is the file type of the target file, and the first time period is a time period in which the first registry is modified to a first table state; when it is detected that the first notification event is generated within the first time period, detecting whether the target process is started within a preset time period after the first notification event is generated; when it is detected that the target process is started within the preset time period after the first notification event is generated, detecting whether the process command line information of the target process includes path information of the created file of the target type; when it is detected that the process command line information of the target process includes path information of the created file of the target type, determining whether an abnormal behavior event is generated after the target process is started, wherein the abnormal behavior event characterizes a behavior event related to the execution of malicious code; and determining whether the target file is the abnormal file based on the judgment result of whether the abnormal behavior event is generated.

[0092] For example, when it is determined that no abnormal behavior event is generated after the target process is started, the target file is determined to be a normal file; when it is determined that an abnormal behavior event is generated after the target process is started, the target file is determined to be an abnormal file.

[0093] Optionally, after the above step 3, the following steps are further included:

[0094] Step 4, if the phishing document protection module determines that the process that executes the registry modification is an Office process, it is also necessary to determine whether there is a notification event (corresponding to the first notification event) of a new Office type document (corresponding to the above-mentioned target type of file) within a period of time (corresponding to the above-mentioned first time period) before and after the generation of the "Enable all macro configuration alarm" alarm event.

[0095] Step 5: If there is a first notification event of a newly landed Office-type document, the phishing document protection module further determines whether an Office process is started within a preset time period after the first notification event;

[0096] Step 6: If it is detected that an Office process is started within a preset time period after the first notification event, the phishing document protection module detects whether the process command line information of the started Office process includes the path information of the newly landed Office type document;

[0097] Step 7: If it is detected that the process command line information of the started Office process includes the path information of the newly landed Office type document, it is further determined whether there are abnormal behavior events in the subsequent related behaviors of the above Office process; if there are abnormal behavior events, it is determined that a phishing document has been delivered and the phishing document has been executed successfully.

[0098] It should be noted that through the above-mentioned phishing document detection process, the phishing document can be tracked and traced, and through the behavior monitoring of the entire phishing process, the entire process behavior chain of enabling macro configuration, landing phishing documents, and executing phishing documents can be restored. This can determine the cause of the phishing document and the attack intention of the phishing document, such as to execute the ransomware encrypted file, or to persist and hide, steal data for a long time, etc.

[0099] In an optional embodiment, the target file is determined to be an abnormal file when any of the following detection results exists:

[0100] A first detection result, used to indicate that no first notification event is generated within a first time period;

[0101] The second detection result is used to indicate that it is detected that the target process is not started within a preset time period after the first notification event is generated;

[0102] The third detection result is used to indicate that it is detected that the process command line information of the target process does not include the path information of the created file of the target type.

[0103] Optionally, in the above step 4, if the phishing document protection module determines that there is no notification event of a new Office-type document (corresponding to the above-mentioned first notification event) within a period of time before and after the generation of the "enable all macro configuration alarm" alarm event (corresponding to the above-mentioned first time period), a first detection result is generated, and the target file is determined to be a phishing document.

[0104] Optionally, in the above step 5, if the phishing document protection module determines that no Office process is started within a preset time period after the first notification event, a second detection result is generated, and the target file is determined to be a phishing document.

[0105] Optionally, in the above step 6, if the phishing document protection module detects that the process command line information of the started Office process does not include the path information of the newly landed Office type document, a third detection result is generated, and the target file is determined to be a phishing document.

[0106] From the above content, it can be seen that the detection of phishing documents involves multiple steps. If there is an abnormality in any step, the phishing document can be detected in time, thereby improving the efficiency of phishing document detection.

[0107] It should be noted that, generally speaking, the process that modifies the activation method of macro commands is the Office process. Normal users modify the activation method of macro commands through the Trust Center configuration module of the Office program. Therefore, if it is detected that the process that modifies the activation method of macro commands is not an Office process, a warning message of a phishing document can be issued.

[0108] In addition, when the configuration information for enabling macro commands is restored to normal, if the phishing document needs to execute macro commands again, it can only be done by adding a macro trust document. In addition, it should be noted that when using phishing documents to carry out network attacks, the construction process of the phishing document and the modification process of the macro command enabling method are usually carried out together.

[0109] It should also be noted that the above-mentioned abnormal behavior event determination method includes at least any one of the following determination methods:

[0110] Method 1: judging whether there is an abnormal behavior event during the use of the target file through network communication behavior. For example, if it is identified that the target file is connected to an external network through an Office process or its descendant process, it is determined that an abnormal behavior event has occurred during the use of the target file.

[0111] Method 2: Determine whether there are abnormal behavior events during the use of the target file through the process startup behavior. For example, if it is identified that the target file creates a suspicious descendant process through the Office process, such as the created process is the system's own process mshta.exe, rundll32.exe, powershell.exe, regasm.exe, regsvcs.exe, regsvr32.exe, wscript.exe, cscript.exe, etc., then it is determined that an abnormal behavior event has occurred during the use of the target file;

[0112] Method three: judging whether there is an abnormal behavior event in the use of the target file through the process startup behavior and process creation behavior. For example, if it is identified that the target file creates an executable file through the Office process or its descendant process, and the executable file is started by the descendant process, it is determined that an abnormal behavior event occurs in the use of the target file;

[0113] Method 4: Determine whether there are abnormal behavior events during the use of the target file through process injection behavior. For example, if it is identified that the target file injects abnormal code into common system processes such as rundll32.exe, explorer.exe, svchost.exe, etc. through the Office process or its descendant processes, it is determined that an abnormal behavior event has occurred during the use of the target file;

[0114] Method 5: judging whether there are abnormal behavior events in the use of the target file through the registry operation behavior. For example, if it is identified that the target file adds a backdoor in the registry or modifies key system configurations through the Office process or its descendant processes, it is determined that an abnormal behavior event has occurred in the use of the target file;

[0115] Method 6: judging whether there are abnormal behavior events in the use of the target file through the scheduled task operation behavior. For example, if it is identified that the target file adds a scheduled task or modifies an existing scheduled task through the Office process or its descendant process (this operation is often used to build a backdoor), it is determined that an abnormal behavior event has occurred in the use of the target file;

[0116] Method seven, judging whether there are abnormal behavior events in the use of the target file through service operation behavior, for example, if it is identified that the target file adds a new service or modifies an existing service through the Office process or its descendant process, it is determined that an abnormal behavior event has occurred in the use of the target file.

[0117] In an optional embodiment, the file detection system can also determine whether the target file is an abnormal file based on the startup behavior information and the file behavior information in the second file detection scenario, specifically including: when the enabling behavior information indicates that the second registry is modified to the third table state, detecting whether the process used to modify the second registry is the target process, wherein the second registry in the third table state is configured so that the target file can unconditionally execute any macro command; when it is detected that the process used to modify the second registry is the target process, determining whether the target file is an abnormal file based on the file behavior information; when it is detected that the process used to modify the second registry is not the target process, determining that the target file is an abnormal file.

[0118] Optionally, in the second file detection scenario, the phishing document protection module mainly identifies whether an abnormal process has added a macro-trusted document and executed a macro command without user permission. Specifically, the steps include:

[0119] Step 1: The phishing document protection module receives the alarm event of "Adding a macro trusted document alarm" and extracts the path of the macro trusted document from the alarm event. As mentioned above, when the TrustRecords registry key is modified, first determine whether the modified registry value data (binary) under TrustRecords ends with FF FF FF 7F (corresponding to the second registry being modified to the third table state). If so, it means that a program has added the file as a trusted document and allows the document to execute any macro command, which will cause the macro command to be allowed to execute without any warnings or operation restrictions when the user accesses the macro document. In this scenario, the macro startup monitoring module will construct an alarm event with the alarm name "Adding a macro trusted document alarm". The alarm content includes at least: the name of the source process that executes the registry modification, the name of the modified registry key value (equivalent to the path of the macro trusted document), the modified registry key value data, etc.

[0120] Step 2: The phishing document protection module determines whether the process that executes the modification of the TrustRecords registry is an Office process.

[0121] Step 3: If it is detected that the process that modifies the TrustRecords registry is not an Office process, it means that this is a phishing document that has been configured as a macro trust document in advance, and its purpose is to prevent users from discovering that the phishing document contains macro commands. In this case, the phishing document protection module will call the Office security mechanism to block the execution of macro commands, and directly issue a phishing event alarm, and delete the macro trust document configuration of the document. After the deletion, the user can see the alarm prompt of the existence of macro commands when opening the document again.

[0122] Optionally, when it is detected that the process used to modify the second registry is the target process, the phishing document protection module detects whether a first notification event is generated within a second time period based on the file behavior information, wherein the first notification event is used to characterize the generation of a file of the target type, the target type is the file type of the target file, and the second time period is a time period before the second registry is modified to the third table state; when it is detected that the first notification event is generated within the second time period, the phishing document protection module detects whether the file path included in the first notification event is the same as the file path of the target file obtained according to the second registry; when it is detected that the file path included in the first notification event is the same as the file path of the target file obtained according to the second registry, the phishing document protection module determines whether an abnormal behavior event is generated after the target process is started, wherein the abnormal behavior event characterizes a behavior event related to the execution of malicious code; and determines whether the target file is the abnormal file based on the judgment result of whether the abnormal behavior event is generated.

[0123] For example, when it is determined that no abnormal behavior event is generated after the target process is started, the phishing document protection module determines that the target file is a normal file; when it is determined that an abnormal behavior event is generated after the target process is started, the phishing document protection module determines that the target file is an abnormal file.

[0124] Optionally, after the above step 3, the following steps are further included:

[0125] Step 4: If it is detected that the process that executes the modification of the TrustRecords registry is an Office process, determine whether there is a notification event of a new Office type document in a period before the alarm event of "adding macro trusted document alarm" is generated (corresponding to the second time period mentioned above).

[0126] Step 5: If it is detected whether there is a notification event of a new Office type document in a period before the alarm event of "adding macro trusted document alarm" is generated (corresponding to the second time period mentioned above), then check whether the document path in this notification event is the same as the macro trusted document path configured in the TrustRecords registry.

[0127] Step six, if it is detected that the document path in the notification event is the same as the macro trust document path configured in the TrustRecords registry, determine whether there are abnormal behavior events in the subsequent related behaviors of the above Office process. If so, it is determined that a phishing document has been delivered and the phishing document has been successfully executed.

[0128] It should be noted that, generally speaking, the process that adds a macro trust document should be an Office process. Under the default security configuration, users enable the macro document by opening it and manually clicking the Enable Macro button, that is, modifying the registry key of the macro trust document through the Office process. Therefore, if the process that modifies the TrustRecords registry is not an Office process, it means that the macro document may be a phishing document. In addition, in the process of using phishing documents, the process of building the phishing document and the process of adding the macro trust document are usually carried out together.

[0129] In an optional embodiment, the target file is determined to be an abnormal file when any of the following detection results exists:

[0130] A fourth detection result, used to indicate that no first notification event is generated within the second time period;

[0131] The fifth detection result is used to indicate that it is detected that the file path included in the first notification event is different from the file path of the target file obtained according to the second registration table.

[0132] Optionally, in the above step five, if it is detected that there is no notification event of a new Office-type document within a period (corresponding to the above-mentioned second time period) before the alarm event of "add macro trusted document alarm" is generated, a fourth detection result is generated, and the target file is determined to be an abnormal file.

[0133] Optionally, in the above step six, if it is detected that the document path in the notification event is different from the macro trust document path configured in the TrustRecords registry, a fifth detection result is generated, and the target file is determined to be an abnormal file.

[0134] It can be seen from the above content that the technical solution of this application can at least achieve the following technical effects:

[0135] It can accurately identify the construction and execution of phishing documents. Since it is associated with the activation action of macro commands, the construction action of macro documents, and the execution behavior of macro documents, it can make the detection more accurate, the evidence information more comprehensive, and greatly reduce the probability of false positives;

[0136] Ability to trace the relevant configuration of macro-enabled commands and the execution process and path to understand the security risks;

[0137] Ability to trace the subsequent execution actions of phishing documents and understand the attack intent of phishing documents;

[0138] When the macro command activation method is abnormally modified, it can issue a security warning in advance and perform security configuration recovery to prevent users from being unaware of phishing documents that hide macro commands and prohibit the execution of macro commands without user permission.

[0139] According to another aspect of the present application, a file detection device is also provided, wherein: Figure 3 is a schematic diagram of an optional file detection device according to an embodiment of the present application, such as Figure 3 As shown, the file detection device includes: a first acquisition unit 301, a second acquisition unit 302 and a determination unit 303.

[0140] Optionally, a first acquisition unit 301 is used to acquire enabling behavior information for macro commands in the operating system, wherein the enabling behavior information includes at least modification information of a first registry and / or modification information of a second registry, wherein the first registry is used to configure an enabling method for the macro command, and the second registry is used to record files that are allowed to execute the macro command; a second acquisition unit 302 is used to acquire file behavior information of the target file when it is detected that the target file is a file that enables the macro command, wherein the file behavior information is used to characterize process behavior information and / or operation behavior information related to the target file; a determination unit 303 is used to determine whether the target file is an abnormal file based on the enabling behavior information and the file behavior information of the target file.

[0141] Optionally, the determination unit 303 includes: a first detection subunit, a first determination subunit, and a second determination subunit. The first detection subunit is used to detect whether the process used to modify the first registry is the target process when the enabling behavior information indicates that the first registry is modified to the first table state, wherein the first registry in the first table state is configured so that all files with the function of executing macro commands can unconditionally execute any macro command, and the target process is a process that is allowed to modify the first registry by default; the first determination subunit is used to determine whether the target file is the abnormal file according to the file behavior information when it is detected that the process used to modify the first registry is the target process; the second determination subunit is used to generate warning information when it is detected that the process used to modify the first registry is not the target process, wherein the warning information at least includes the path information of the first registry and the name of the process used to modify the first registry.

[0142] Optionally, the file detection device includes: a first processing unit, used to modify the first registry to a second table state, wherein the first registry of the second table state is configured so that all files with the function of executing macro commands need to run the macro commands under the condition of satisfying restriction conditions.

[0143] Optionally, the first determination subunit includes: a first detection module, a second detection module, a third detection module, a first judgment module, a first determination module, and a second determination module. The first detection module is used to detect whether a first notification event is generated within a first time period according to the file behavior information, wherein the first notification event is used to indicate that a file of a target type is generated, the target type is the file type of the target file, and the first time period is the time period during which the first registry is modified to the first table state; the second detection module is used to detect whether a target process is started within a preset time period after the first notification event is generated, if the first notification event is detected to be generated within the first time period; the third detection module is used to detect whether the process command line information of the target process includes path information of the created file of the target type, if the target process is detected to be started within the preset time period after the first notification event is generated; the first judgment module is used to determine whether an abnormal behavior event is generated after the target process is started, if the process command line information of the target process includes path information of the created file of the target type, wherein the abnormal behavior event indicates a behavior event related to the execution of malicious code; the first determination module is used to determine whether the target file is the abnormal file according to the judgment result of whether the abnormal behavior event is generated.

[0144] Optionally, the file detection device further includes: a second processing unit, configured to determine that the target file is an abnormal file when any of the following detection results exists:

[0145] A first detection result, used to indicate that no first notification event is generated within a first time period;

[0146] The second detection result is used to indicate that it is detected that the target process is not started within a preset time period after the first notification event is generated;

[0147] The third detection result is used to indicate that it is detected that the process command line information of the target process does not include the path information of the created file of the target type.

[0148] Optionally, the determination unit 303 includes: a second detection subunit, a third determination subunit, and a fourth determination subunit. The second detection subunit is used to detect whether the process used to modify the second registry is a target process when the enabling behavior information indicates that the second registry is modified to a third table state, wherein the second registry in the third table state is configured so that the target file can unconditionally execute any macro command; the third determination subunit is used to determine whether the target file is an abnormal file according to the file behavior information when the process used to modify the second registry is detected to be the target process; and the fourth determination subunit is used to determine that the target file is an abnormal file when the process used to modify the second registry is detected to be the target process.

[0149] Optionally, the third determination subunit includes: a fourth detection module, a fifth detection module, a second judgment module, a third determination module and a fourth determination module. The fourth detection module is used to detect whether a first notification event is generated in a second time period according to the file behavior information when the process used to modify the second registry is detected as the target process, wherein the first notification event is used to indicate that a file of a target type is generated, the target type is the file type of the target file, and the second time period is a time period before the second registry is modified to the third table state; the fifth detection module is used to detect whether the file path included in the first notification event is the same as the file path of the target file obtained according to the second registry when the first notification event is detected to be generated in the second time period; the second judgment module is used to determine whether an abnormal behavior event is generated after the target process is started when the file path included in the first notification event is detected to be the same as the file path of the target file obtained according to the second registry, wherein the abnormal behavior event indicates a behavior event related to the execution of malicious code; the second determination module is used to determine whether the target file is the abnormal file according to the judgment result of whether the abnormal behavior event is generated.

[0150] Optionally, the file detection device further includes: a third processing unit, configured to determine that the target file is an abnormal file when any of the following detection results exists:

[0151] A fourth detection result, used to indicate that no first notification event is generated within the second time period;

[0152] The fifth detection result is used to indicate that it is detected that the file path included in the first notification event is different from the file path of the target file obtained according to the second registration table.

[0153] According to another aspect of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, wherein when the computer program runs, the device where the computer-readable storage medium is located executes any one of the above-mentioned file detection methods.

[0154] According to another aspect of the present application, an electronic device is also provided, wherein the electronic device includes one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors are implemented to run the programs, wherein the program is configured to execute any one of the above-mentioned file detection methods when running.

[0155] The above-mentioned embodiments or examples disclosed in the present application are not exhaustive, but are only illustrative of some embodiments or examples, and are not intended to be specific limitations on the scope of protection disclosed in the present application. In the absence of contradiction, each step in a certain embodiment or example in the present application can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the various embodiments or examples can be combined arbitrarily, for example, some or all steps of different embodiments or examples can be combined arbitrarily, and a certain embodiment or example can be combined arbitrarily with the optional methods or optional examples of other embodiments or examples.

[0156] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0157] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0158] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0159] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0160] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0161] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0162] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A file detection method, characterized in that: include: Acquiring enabling behavior information for macro commands in the operating system, wherein the enabling behavior information at least includes modification information of a first registry and / or modification information of a second registry, the first registry being used to configure an enabling mode of the macro commands, and the second registry being used to record files that are allowed to execute the macro commands; In the case where it is detected that the target file is a file that enables the macro command, obtaining file behavior information of the target file, wherein the file behavior information is used to represent process behavior information and / or operation behavior information related to the target file; Determine whether the target file is an abnormal file according to the enabling behavior information and the file behavior information of the target file.

2. The file detection method according to claim 1, characterized in that: Determining whether the target file is an abnormal file according to the enabling behavior information and the file behavior information of the target file includes: In the case where the enabling behavior information indicates that the first registry is modified to a first table state, detecting whether the process used to modify the first registry is a target process, wherein the first registry in the first table state is configured so that all files having a macro command execution function can unconditionally execute any macro command, and the target process is a process that is defaulted to be allowed to modify the first registry; In the case where it is detected that the process used to modify the first registry is the target process, determining whether the target file is the abnormal file according to the file behavior information; When it is detected that the process used to modify the first registry is not the target process, warning information is generated, wherein the warning information at least includes path information of the first registry and the name of the process used to modify the first registry.

3. The file detection method according to claim 2, characterized in that: In the case where it is detected that the process used to modify the first registry is not the target process, after generating the warning information, the file detection method further includes: The first registry is modified to a second table state, wherein the first registry in the second table state is configured so that all files having a macro command execution function need to run the macro command under the condition of satisfying restriction conditions.

4. The file detection method according to claim 2, characterized in that: In the case where it is detected that the process used to modify the first registry is the target process, determining whether the target file is the abnormal file according to the file behavior information includes: Detecting whether a first notification event is generated within a first time period according to the file behavior information, wherein the first notification event is used to indicate that a file of a target type is generated, the target type is a file type of the target file, and the first time period is a time period during which the first registry is modified to the first table state; In the case where it is detected that the first notification event is generated within the first time period, detecting whether the target process is started within a preset time period after the first notification event is generated; In a case where it is detected that the target process is started within a preset time period after the first notification event is generated, detecting whether the process command line information of the target process includes path information of a created file of the target type; In the case where it is detected that the process command line information of the target process includes the path information of the created target type file, determining whether an abnormal behavior event is generated after the target process is started, wherein the abnormal behavior event represents a behavior event related to the execution of malicious code; Whether the target file is the abnormal file is determined according to a result of determining whether the abnormal behavior event is generated.

5. The file detection method according to claim 4, characterized in that: The file detection method also includes: In the case of any of the following detection results, the target file is determined to be the abnormal file: A first detection result, used to indicate that it is detected that the first notification event is not generated within the first time period; A second detection result, used to indicate that it is detected that the target process is not started within a preset time period after the first notification event is generated; The third detection result is used to indicate that it is detected that the process command line information of the target process does not include the path information of the created file of the target type.

6. The file detection method according to claim 1, characterized in that: Determining whether the target file is an abnormal file according to the enabling behavior information and the file behavior information includes: In the case where the enabling behavior information indicates that the second registry is modified to a third table state, detecting whether the process used to modify the second registry is a target process, wherein the second registry in the third table state is configured so that the target file can unconditionally execute any macro command; In the case where it is detected that the process used to modify the second registry is the target process, determining whether the target file is the abnormal file according to the file behavior information; When it is detected that the process used to modify the second registry is not the target process, the target file is determined to be the abnormal file.

7. The file detection method according to claim 6, characterized in that: In the case where it is detected that the process used to modify the second registry is the target process, determining whether the target file is the abnormal file according to the file behavior information includes: In the case where it is detected that the process used to modify the second registry is the target process, detecting whether a first notification event is generated within a second time period according to the file behavior information, wherein the first notification event is used to indicate that a file of a target type is generated, the target type is a file type of the target file, and the second time period is a time period before the second registry is modified to the third table state; In the case where it is detected that the first notification event is generated within the second time period, detecting whether a file path included in the first notification event is the same as a file path of the target file obtained according to the second registration table; When it is detected that the file path included in the first notification event is the same as the file path of the target file obtained according to the second registry, it is determined whether an abnormal behavior event is generated after the target process is started, wherein the abnormal behavior event represents a behavior event related to the execution of malicious code; and based on the determination result of whether the abnormal behavior event is generated, it is determined whether the target file is the abnormal file.

8. The file detection method according to claim 7, characterized in that: The file detection method also includes: In the case of any of the following detection results, the target file is determined to be the abnormal file: a fourth detection result, used to indicate that it is detected that the first notification event is not generated within the second time period; The fifth detection result is used to indicate that it is detected that the file path included in the first notification event is different from the file path of the target file obtained according to the second registration table.

9. A file detection device, characterized in that: include: A first acquisition unit is used to acquire activation behavior information for macro commands in the operating system, wherein the activation behavior information at least includes modification information of a first registry and / or modification information of a second registry, the first registry is used to configure an activation mode of the macro command, and the second registry is used to record files that are allowed to execute the macro command; A second acquisition unit is used to acquire file behavior information of the target file when it is detected that the target file is a file that enables the macro command, wherein the file behavior information is used to represent process behavior information and / or operation behavior information related to the target file; A determination unit is used to determine whether the target file is an abnormal file according to the activation behavior information and the file behavior information of the target file.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located executes the file detection method according to any one of claims 1 to 8.

Images