Malicious code detection method and device, electronic equipment and storage medium

Abstract

The invention discloses a malicious code detection method and device, electronic equipment and a storage medium, and relates to the technical field of information security. The method comprises the following steps: detecting whether a first process and a second process run in an operating system or not; when it is detected that the operation system runs the first process and the second process, whether the first process modifies a target pointer of the second process or not is judged; detecting whether a memory region pointed by the modified target pointer is a target memory region applied by the first process or not under the condition of judging that the target pointer of the second process is modified by the first process; when it is detected that the memory area pointed by the modified target pointer is the target memory area, whether malicious codes exist in the target memory area or not is detected. The technical problem that in the prior art, the detection opportunity of malicious codes injected in a thread local storage mode is improper, and the utilization rate of system performance resources is low due to blind scanning of the malicious codes in a memory is solved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method, device, electronic device and storage medium for detecting malicious code. Background Art

[0002] Thread Local Storage Injection (TLS injection), also known as TLS injection, can use the TLS callback function mechanism to point the AddressOfCallBacks (address of the callback function) pointer of the TLS structure of the target process to shellcode (a small code fragment), thereby achieving the purpose of malicious code execution.

[0003] Specifically, the TLS DirectoryEntry in the Data Directory in the Optional Header of each PE file (Portable Executable file) points to the TLS table structure, which is mainly used to store variables and callback functions. The AddressOfCallbacks in the structure points to the function pointer array of the callback function registered by TLS. By modifying the value of AddressOfCallbacks, the callback function can point to the shellcode pre-written to the memory by the attacker, and then use the characteristics of TLS callback, that is, when the thread of the target process is initialized or terminated, the operating system will call the function in the TLS callback function table, thereby achieving the purpose of malicious code execution.

[0004] TLS injection, on the one hand, writes malicious code into memory, preventing malicious files from being written to disk; on the other hand, it avoids the sensitive behavior of creating remote threads and instead uses the inherent TLS mechanism of PE files to execute malicious code, reducing the risk of threat detection engines detecting and killing it.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The present application provides a malicious code detection method, device, electronic device and storage medium to at least solve the technical problems in the prior art of inappropriate detection timing of malicious code injected in thread local storage and low system performance resource utilization caused by blind memory scanning of malicious code.

[0007] According to one aspect of the present application, a method for detecting malicious code is provided, including: detecting whether a first process and a second process are running in an operating system, wherein the first process has applied for data write permission and memory execution permission for a target memory area of ​​the second process; in the case where it is detected that the operating system runs the first process and the second process, determining whether the first process modifies a target pointer of the second process, wherein the target pointer is a pointer applied to a thread local storage function; in the case where it is determined that the first process modifies the target pointer of the second process, detecting whether the memory area pointed to by the modified target pointer is the target memory area applied for by the first process; when it is detected that the memory area pointed to by the modified target pointer is the target memory area, detecting whether there is malicious code in the target memory area.

[0008] Optionally, in the malicious code detection method provided in the present application, when it is detected that the operating system is running the first process and the second process, it is determined whether the first process modifies the target pointer of the second process, including: when it is detected that the operating system is running the first process and the second process, detecting whether the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute, wherein the first attribute represents that the second process only opens the memory data read permission, and the second attribute represents that the second process opens the memory data write permission; when it is detected that the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute, it is determined whether the first process modifies the target pointer of the second process.

[0009] Optionally, in the malicious code detection method provided in the present application, when it is detected that the first process changes the memory protection attribute of the second process from the first attribute to the second attribute, it is determined whether the first process modifies the target pointer of the second process, including: when it is detected that the first process changes the memory protection attribute of the second process from the first attribute to the second attribute, performing a memory dump operation on the second process, wherein the memory dump operation is used to save memory status information of the second process during runtime in a target file; parsing the target file to obtain a parsing result; and judging whether the first process modifies the target pointer of the second process based on the parsing result.

[0010] Optionally, in the malicious code detection method provided in the present application, whether the first process modifies the target pointer of the second process is determined according to the parsing result, including: locating the data directory in the optional header of the target file according to the parsing result, wherein the optional header is used to load and execute the target file; detecting whether the use address of the virtual memory recorded in the target entry in the data directory is a null value, wherein the target entry is used to store the thread data of the operating system; when the use address of the virtual memory recorded in the target entry is a non-null value, determining whether the modified memory address of the second process is a pointer corresponding to the address of the callback function in the target entry when the first process modifies the memory protection attribute of the second process; when it is determined that the modified memory address of the second process is a pointer corresponding to the address of the callback function in the target entry, determining that the first process modifies the target pointer of the second process.

[0011] Optionally, in the malicious code detection method provided in the present application, when it is detected that the operating system is running the first process and the second process, it is detected whether the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute, including: when it is detected that the operating system is running the first process and the second process, it is detected whether the memory address modified by the first process for the second process is located between the base address and the target address of the second process, wherein the target address is the sum of the base address and a preset byte; when it is detected that the memory address modified by the first process for the second process is located between the base address and the target address of the second process, the change information of the target bit mask of the second process recorded in the host log is obtained, wherein the target bit mask is used to configure the memory protection function of the second process; based on the change information of the target bit mask, it is determined whether the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute.

[0012] Optionally, in the malicious code detection method provided in the present application, when it is detected that the memory area pointed to by the modified target pointer is the target memory area, it is detected whether there is malicious code in the target memory area, including: extracting code features of the target code in the target memory area; detecting the feature similarity between the code features of the target code and each code feature in the code feature library, wherein the code feature library is used to store code features of known malicious codes; when the feature similarity between the code features of the target code and any code feature in the code feature library is greater than a preset threshold, determining that the target code is malicious code.

[0013] Optionally, the malicious code detection method provided in the present application also includes: after detecting that the first process modifies the target pointer of the second process, obtaining the first memory protection flag and the second memory protection flag of the second process, wherein the first memory protection flag is used to represent the state of the memory of the second process before the memory protection attribute is modified; the second memory protection flag is used to represent the state of the memory of the second process after the memory protection attribute is modified; and determining the change information of the memory protection attribute of the second process based on the first memory protection flag and the second memory protection flag.

[0014] According to another aspect of an embodiment of the present application, a malicious code detection device is also provided, which includes: a first detection unit, used to detect whether a first process and a second process are running in an operating system, wherein the first process has applied for data write permission and memory execution permission for a target memory area of ​​the second process; a first judgment unit, used to determine whether the first process modifies a target pointer of the second process when it is detected that the operating system runs the first process and the second process, wherein the target pointer is a pointer applied to a thread local storage function; a second detection unit, used to detect whether the memory area pointed to by the modified target pointer is the target memory area applied for by the first process when it is determined that the first process has modified the target pointer of the second process; and a third detection unit, used to detect whether there is malicious code in the target memory area when it is detected that the memory area pointed to by the modified target pointer is the target memory area.

[0015] According to another aspect of an embodiment of the present application, a computer-readable storage medium is further provided, wherein a computer program is stored in the computer-readable storage medium, wherein when the computer program is running, the device where the computer-readable storage medium is located executes any one of the above-mentioned malicious code detection methods.

[0016] According to another aspect of an embodiment of the present application, an electronic device is also provided, wherein the electronic device includes one or more processors and a memory, the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors execute any one of the above-mentioned malicious code detection methods.

[0017] In the present application, it is first detected whether the first process and the second process are running in the operating system, wherein the first process has applied for data write permission and memory execution permission for the target memory area of ​​the second process. Then, when it is detected that the operating system is running the first process and the second process, it is determined whether the first process modifies the target pointer of the second process, wherein the target pointer is a pointer applied to the thread local storage function; when it is determined that the first process has modified the target pointer of the second process, it is detected whether the memory area pointed to by the modified target pointer is the target memory area applied by the first process. Finally, when it is detected that the memory area pointed to by the modified target pointer is the target memory area, it is detected whether there is malicious code in the target memory area.

[0018] As can be seen from the above content, the present application determines whether the first process has modified the suspected TLS pointer (target pointer) of the second process by analyzing the process behavior information, and when it is detected that the memory area pointed to by the modified target pointer is the target memory area, the malicious code scanning operation of the target memory area is started, thereby avoiding the technical problems of low system performance resource utilization caused by inappropriate detection timing of malicious code injected through TLS in the prior art and blind memory scanning for malicious code. At the same time, the detection efficiency of malicious code injected into memory through TLS is also improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 is a flow chart of an optional malicious code detection method according to an embodiment of the present application;

[0021] Figure 2 is a schematic diagram of an optional malicious code detection process according to an embodiment of the present application;

[0022] Figure 3 is a flow chart of an optional malicious code detection process according to an embodiment of the present application;

[0023] Figure 4 It is a schematic diagram of an optional malicious code detection device according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] It should also be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) collected by this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of the relevant regions, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation portals are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0027] According to an embodiment of the present application, an embodiment of a method for detecting malicious code is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0028] In an optional embodiment, a malicious code detection system (hereinafter referred to as the detection system) can be used as the execution subject of the malicious code detection method in the embodiment of the present application, wherein the detection system can be a software system or an embedded system combining software and hardware. Of course, in addition to using the detection system as the execution subject, other forms of devices and equipment can also be used as the execution subject of the technical solution of the embodiment of the present application, and the present application does not specifically limit the specific type of the execution subject.

[0029] For the convenience of description, the detection system is used as the execution entity below to illustrate the technical solutions of the embodiments of the present application.

[0030] Figure 1 is a flow chart of an optional malicious code detection method according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0031] Step S101, detecting whether a first process and a second process are running in the operating system.

[0032] In step S101, the first process has applied for data write permission and memory execution permission for the target memory area of ​​the second process.

[0033] Optionally, the detection system can collect the process behavior logs of the host side, and thus detect whether the first process and the second process are running in the operating system at the current time or at a historical time according to the process behavior logs. The first process and the second process are processes that may be performing TLS injection behavior.

[0034] Optionally, common log collection tools include, but are not limited to: ETW (Event Tracing For Windows, a tool for collecting and analyzing performance and behavior information about the Windows operating system and applications running thereon), Sysmon (an efficient and lightweight system monitoring tool on Windows systems), etc. The collected process behavior log information includes, but is not limited to: log information related to event sources subscribed by ETW, Sysmon log information, etc.

[0035] Optionally, in order to detect TLS injection behavior, the log collection tool needs to subscribe to log data sources such as Microsoft-Windows-Threat-Intelligence, Microsoft-Windows-Kernel-Process, and Microsoft-Windows-Sysmon, and collect KERNEL_THREATINT_TASK_PROTECTVM log information, KERNEL_THREATINT_TASK_ALLOCVM log information, KERNEL_THREATINT_TASK_WRITEVM log information, and common Sysmon log information in these log data sources.

[0036] Optionally, in order to analyze the behavior information between processes and identify the process that may be performing TLS injection, the collected log information can be used to detect whether a process has applied for data write permission and memory execution permission for the target memory area of ​​another process.

[0037] For example, when it is detected that process A has applied for "readable permission", "writable permission" and "executable permission" of the target memory area of ​​process B, process A is determined to be the first process and process B is the second process.

[0038] It should be noted that when the first process applies for the "readable permission", "writable permission" and "executable permission" of the second process, it can first apply to modify the memory protection attribute of the second process to open the "readable permission" and "writable permission" to the first process. After these two permissions are successfully opened, the first process applies to modify the memory protection attribute of the second process to open the "executable permission" to the first process.

[0039] For example, the detection system can analyze the ALLOCVM (Allocate Virtual Memory) log to record information such as the source process, target process, memory start address, memory size, etc. The following is an example of an ETW ALLOCVM log:

[0040]

[0041]

[0042] Step S102: when it is detected that the operating system runs the first process and the second process, it is determined whether the first process modifies the target pointer of the second process.

[0043] In step S102, the target pointer is a pointer applied to the thread local storage function.

[0044] Optionally, if the detection system does not detect that the operating system is running the first process and the second process, it can determine whether there is malicious code in the operating system (including malicious code injected via TLS) by other means. This application does not introduce other methods in detail as they are not the focus of this application.

[0045] Optionally, the target pointer may also be referred to as a TLS pointer, and the target pointer may also be understood as a pointer corresponding to the address of the callback function of the second process.

[0046] Step S103, when it is determined that the first process has modified the target pointer of the second process, it is detected whether the memory area pointed to by the modified target pointer is the target memory area applied for by the first process.

[0047] Optionally, if the detection system determines that the first process has modified the target pointer of the second process, the next step is to detect whether the memory area pointed to by the modified target pointer is the target memory area requested by the first process. Then, based on the detection result, it is determined whether an attacker has attempted to write malicious code in the target memory area by means of TLS injection.

[0048] It should be noted that if the detection system determines that the first process does not modify the target pointer of the second process, it can determine whether there is malicious code in the operating system (including malicious code injected in TLS) by other means.

[0049] Step S104, when it is detected that the memory area pointed to by the modified target pointer is the target memory area, it is detected whether there is malicious code in the target memory area.

[0050] Optionally, if the detection system detects that the memory area specified by the modified target pointer is the target memory area, it means that there is a high probability that an attacker has tampered with the target pointer and the memory protection attribute of the second process, and attempted to write malicious code into the target memory area of ​​the second process through TLS injection. At this moment, the detection system starts code scanning of the target memory area, traversing each code in the target memory area to identify whether each code in the target memory area is malicious code.

[0051] Based on the contents of the above steps S101 to S104, it can be known that in the present application, firstly, it is detected whether the first process and the second process are running in the operating system, wherein the first process has applied for data write permission and memory execution permission for the target memory area of ​​the second process. Then, when it is detected that the operating system is running the first process and the second process, it is determined whether the first process modifies the target pointer of the second process, wherein the target pointer is a pointer applied to the thread local storage function; when it is determined that the first process has modified the target pointer of the second process, it is detected whether the memory area pointed to by the modified target pointer is the target memory area applied by the first process. Finally, when it is detected that the memory area pointed to by the modified target pointer is the target memory area, it is detected whether there is malicious code in the target memory area.

[0052] As can be seen from the above content, the present application determines whether the first process has modified the suspected TLS pointer (target pointer) of the second process by analyzing the process behavior information, and when it is detected that the memory area pointed to by the modified target pointer is the target memory area, the malicious code scanning operation of the target memory area is started, thereby avoiding the technical problems of low system performance resource utilization caused by inappropriate detection timing of malicious code injected through TLS in the prior art and blind memory scanning for malicious code. At the same time, the detection efficiency of malicious code injected into memory through TLS is also improved.

[0053] In an optional embodiment, when it is detected that the operating system runs the first process and the second process, the detection system first detects whether the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute, wherein the first attribute indicates that the second process only opens the memory data read permission, and the second attribute indicates that the second process opens the memory data write permission. Then, when it is detected that the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute, the detection system determines whether the first process modifies the target pointer of the second process.

[0054] Optionally, the memory protection attribute of the second process may also be referred to as the PE header memory protection attribute of the second process. The detection system may determine whether the first process has any operation related to modifying the memory protection attribute of the second process by analyzing the collected process behavior log information. If it is detected that the first process has any operation related to modifying the memory protection attribute of the second process, it is necessary to further detect whether the first process has modified the memory protection attribute of the second process from the first attribute to the second attribute, wherein the first attribute indicates that the second process only has the permission to read the memory data, and the second attribute indicates that the second process has the permission to write the memory data.

[0055] Generally speaking, in an operating system, it is a dangerous and disallowed operation for a first process to directly modify the memory protection attributes of a second process. If the memory protection attributes of a second process are indeed to be modified, the PE header will usually not be modified but the contents of the section table or section data will be attempted to be modified. When it is detected that the first process has modified the memory protection attributes of the second process, it is necessary to further determine whether the first process has modified the memory protection attributes of the second process from the original READ_ONLY (read-only, i.e., the first attribute) to READ_WRITEABLE (writable, i.e., the second attribute) or even READ_WRITE_EXECUTEABLE (executable, which can be recorded as the third attribute).

[0056] If it is detected that the first process changes the memory protection attribute of the second process from READ_ONLY (read-only, i.e. the first attribute) to READ_WRITEABLE (writable, i.e. the second attribute) or even READ_WRITE_EXECUTEABLE (executable, which can be recorded as the third attribute), it is necessary to further determine whether the first process has modified the target pointer of the second process.

[0057] If it is detected that the first process has not changed the memory protection attribute of the second process from the original READ_ONLY (read-only, i.e. the first attribute) to READ_WRITEABLE (writable, i.e. the second attribute), and has not changed it to READ_WRITE_EXECUTEABLE (executable, which can be recorded as the third attribute), then other methods can be used to determine whether there is malicious code in the operating system (including malicious code injected via TLS). This application does not introduce other methods in detail.

[0058] It should be noted that, as mentioned above, generally speaking, in an operating system, it is a dangerous and not allowed operation for a first process to directly modify the memory protection attributes of a second process. If the memory protection attributes of a second process are indeed to be modified, the PE header will usually not be modified but the content of the section table or section data will be attempted to be modified. Therefore, when it is detected that the operating system runs a first process and a second process, it is detected whether the first process modifies the memory protection attributes of the second process from the first attribute to the second attribute, so as to determine whether an attacker attempts to tamper with the memory protection attributes of the second process in order to subsequently implement malicious code injection.

[0059] In an optional embodiment, when it is detected that the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute, the detection system can perform a memory dump operation on the second process, wherein the memory dump operation is used to save the memory state information of the second process when it is running in a target file. Then, the detection system parses the target file to obtain a parsing result, and then determines whether the first process modifies the target pointer of the second process according to the parsing result.

[0060] Optionally, a memory dump operation can capture and save the memory state information of the second process at runtime into a target file, wherein the memory state information includes but is not limited to information such as code, data, and stack. In an operating system, a memory dump operation can be implemented through tools such as Task Manager, WinDbg (a Windows debugger used to analyze and debug Windows systems and applications), and Procdump (Process Dump, a practical command line tool used to generate a memory dump file of a Windows system), or by using API functions such as MiniDumpWriteDump (a function of the Windows system).

[0061] Optionally, the above target file is a file in PE (Portable Executable) format, wherein the file in PE format includes the following main parts:

[0062] DOS header: A structure designed for compatibility with older DOS.

[0063] PE header: contains the PE signature; metadata of the PE file, such as machine type, number of sections, etc.; information required by the Windows loader, such as the program's entry point, code base address, data base address, image size, etc.

[0064] Section table: Contains descriptions of each section in the file, such as the section name, virtual address, size, attributes, etc.

[0065] Section data: data of each section, such as .text (code section), .data (data section), .rdata (read-only data section), etc.

[0066] Optionally, the target file is parsed by parsing the PE format file, wherein the purpose of the parsing is to determine which memory area of ​​the second process is modified by the first process. Specifically, the following steps are included:

[0067] 1. Open the PE file and locate the e_lfanew variable in the DOS header.

[0068] 2. According to the e_lfanew variable of the DOS header, locate the PE header (IMAGE_NT_HEADERS).

[0069] 3. Verify that the PE signature (“PE\0\0”) is correct to confirm that this is a valid PE file.

[0070] 4. Parse the COFF file header (IMAGE_FILE_HEADER), where the COFF file header includes at least information about the file type, machine type, number of sections, etc.

[0071] 5. Parse the optional header (IMAGE_OPTIONAL_HEADER), where the optional header includes at least the information required to load and execute the PE file, such as entry point, base address, Image size, etc.

[0072] 6. Parse the section table (IMAGE_SECTION_HEADER), where the section table includes at least the description information of each section in the file, such as the section name, virtual address, size, attributes, etc.

[0073] 7. Parse the import table, which lists the external functions and libraries that the program depends on.

[0074] 8. Parse the Export Table, which lists the provided functions and symbols.

[0075] 9. Parse the relocation table, where the relocation table is used to correct the memory address during loading.

[0076] 10. Parse the TLS directory (Thread Local Storage Directory), where the TLS directory at least includes TLS related information.

[0077] 11. Parse other data directories, such as resource directories, debugging information directories, and related directories of exception handling information.

[0078] It should be noted that, after parsing the target file, the memory information of the second process can be clearly and accurately analyzed, which is helpful for subsequently determining which memory area of ​​the second process is modified by the first process.

[0079] In an optional embodiment, in the process of determining whether the first process modifies the target pointer of the second process according to the parsing result, the detection system can locate the data directory in the optional header of the target file according to the parsing result, wherein the optional header is used to load and execute the target file. Then, the detection system detects whether the use address of the virtual memory recorded by the target entry in the data directory is a null value, wherein the target entry is used to store the thread data of the operating system. In the case where the use address of the virtual memory recorded by the target entry is a non-null value, it is determined whether the memory address of the second process modified by the first process is a pointer corresponding to the address of the callback function in the target entry when modifying the memory protection attribute of the second process; in the case where it is determined that the memory address of the second process modified is a pointer corresponding to the address of the callback function in the target entry, it is determined that the first process modifies the target pointer of the second process.

[0080] Optionally, the logical analysis of whether the first process implements TLS injection behavior is as follows:

[0081] First, the detection system can use the parsing results of the target file to determine whether the second process includes a TLS section. Specifically, the detection system can first locate the data directory (Data Directories) in the optional header (Optional Header) of the target file based on the parsing results of the target file. If the VirtualAddress (corresponding to the above-mentioned virtual memory usage address) in the fifth entry Thread Local Storage Directory (corresponding to the above-mentioned target entry) of the data directory is 0 (0 is a null value), it means that the second process does not include a TLS section, that is, the second process is not used by the first process to implement TLS injection behavior.

[0082] However, if VirtualAddress is not 0, it means that the second process includes a TLS section. At this time, it is necessary to further determine whether the memory address of the second process modified by the first process is the AddressOfCallBacks pointer in the Thread Local Storage Directory when the memory protection attribute of the second process is modified by the first process (that is, determine whether the memory address of the second process modified by the first process is the pointer corresponding to the address of the callback function in the target entry when the memory protection attribute of the second process is modified by the first process).

[0083] If it is determined that the modified memory address of the second process is the pointer corresponding to the address of the callback function in the target entry, it means that the first process has modified the target pointer of the second process, and the modified target pointer is the "pointer corresponding to the address of the callback function in the target entry".

[0084] Through the above process, the technical effect of determining whether the first process has modified the target memory area of ​​the second process and determining which memory area of ​​the second process has been specifically modified by the first process can be achieved.

[0085] In an optional embodiment, when it is detected that the operating system runs the first process and the second process, in order to detect whether the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute, the detection system may perform the following steps:

[0086] When it is detected that the operating system runs the first process and the second process, the detection system first detects whether the memory address modified by the first process for the second process is between the base address and the target address of the second process, where the target address is the sum of the base address and the preset byte. When it is detected that the memory address modified by the first process for the second process is between the base address and the target address of the second process, the detection system obtains the change information of the target bit mask of the second process recorded in the host log, where the target bit mask is used to configure the memory protection function of the second process. Subsequently, the detection system determines whether the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute based on the change information of the target bit mask.

[0087] Optionally, in order to determine whether the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute, or even modifies the memory protection attribute of the second process from the first attribute to the third attribute. The detection system can first determine whether the memory address modified by the first process for the second process is located between the ImageBase of the second process (i.e., the base address mentioned above) and ImageBase+0x1000 (0x1000 is the preset byte), because the size of the PE header generally does not exceed this interval. Then, the detection system can determine whether it is the above-mentioned type of modification by combining the LastProtectionMask and ProtectionMask (i.e., the target bit mask mentioned above) of the PROTECTVM log of ETW.

[0088] Among them, "LastProtectionMask" and "ProtectionMask" are often used in the fields of computer science, programming, or network security, and they represent bit masks related to data protection. Here is an explanation of these two terms:

[0089] ProtectionMask: This is a bit mask used to control access rights to data or resources. In many operating systems and programming environments, ProtectionMask is used to define access rules for data structures or memory areas. For example, in a file system, ProtectionMask can determine which users or processes can read, write, or execute a specific file. This helps to improve the security of the system and prevent unauthorized access.

[0090] LastProtectionMask: This term may refer to the last protection mask applied in a series of operations or access rules. This is often used to track how system resources are protected at a particular moment in time. For example, in a multi-level security system or a system with multiple access levels, LastProtectionMask can indicate the highest access level used in a particular operation or event.

[0091] Here is an example of a PROTECTVM log from ETW:

[0092]

[0093]

[0094] Through the above content, the technical effect of accurately judging whether the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute or even the third attribute can be achieved.

[0095] In an optional embodiment, when it is detected that the memory area pointed to by the modified target pointer is the target memory area, it is detected whether there is malicious code in the target memory area, including: extracting code features of the target code in the target memory area; detecting feature similarity between the code features of the target code and each code feature in a code feature library, wherein the code feature library is used to store code features of known malicious codes; when the feature similarity between the code features of the target code and any code feature in the code feature library is greater than a preset threshold, determining that the target code is malicious code.

[0096] Optionally, memory scanning is to use known remote control, shellcode, fileless attack framework and other features to match the memory data of the running process to find malicious code. When the memory area pointed to by the modified target pointer has been determined to be the target memory area, the detection system can directly use the modified target pointer to determine the target memory area and perform memory scanning. The detection system can also use memory scanning tools, such as YARA, to perform memory scanning in combination with corresponding security rules, or analyze the shellcode at this memory to discover threat events that are not identified by security rules.

[0097] It should be noted that if the detection system detects that the code feature of the target code and the feature similarity of each code feature in the code feature library are less than or equal to a preset threshold, other methods can be used to determine whether there is malicious code in the operating system.

[0098] In an optional embodiment, after detecting that the first process has modified the target pointer of the second process, the detection system can obtain the first memory protection flag and the second memory protection flag of the second process, wherein the first memory protection flag is used to represent the state of the memory of the second process before the memory protection attribute is modified; the second memory protection flag is used to represent the state of the memory of the second process after the memory protection attribute is modified. Then, the detection system determines the change information of the memory protection attribute of the second process according to the first memory protection flag and the second memory protection flag.

[0099] Optionally, after completing the modification of the pointer, the attacker will often change the modified memory protection attributes back to the original attributes to evade detection. In this case, the detection system can determine this by comparing ProtectVM's OldProtection (corresponding to the first memory protection flag mentioned above) and Protection (corresponding to the second memory protection flag mentioned above), that is, determining the change information of the memory protection attributes of the second process.

[0100] In an optional embodiment, Figure 2 is a schematic diagram of an optional malicious code detection process according to an embodiment of the present application, such as Figure 2 As shown, through the ProtectVM log information of the first process and the second process, the detection system detects that the first process has applied for data write permission for the target memory area of ​​the second process, and then the detection system performs a memory dump operation on the memory status information of the second process when it is running, and generates a target file in PE format. Subsequently, the detection system parses the target file and determines whether the first process has modified the "AddressOfCallBacks pointer" of the second process based on the parsing result. When it is determined that the first process has modified the "AddressOfCallBacks pointer" of the second process, and the memory area pointed to by the modified pointer is the target memory area of ​​the second process, a memory scanning tool is used to perform a memory scan on the target memory area. If malicious code is detected in the target memory area, an alarm log is generated. For example, the alarm log may be "It is detected that the first process has injected malicious code into the target memory area using TLS injection."

[0101] In an optional embodiment, Figure 3 is a flow chart of an optional malicious code detection process according to an embodiment of the present application, such as Figure 3As shown, first, the detection system detects that the operating system runs a first process and a second process, wherein the first process applies for data write permission and memory execution permission for a target memory area of ​​the second process.

[0102] like Figure 3 As shown, when it is detected that the operating system is running the first process and the second process, it is detected whether the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute, or even to the third attribute, wherein the relevant explanations of the first attribute, the second attribute and the third attribute can be found above.

[0103] like Figure 3 As shown, when it is detected that the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute or even the third attribute, a memory dump operation is performed on the second process to obtain a target file, and then the obtained target file is parsed to obtain a parsing result.

[0104] like Figure 3 As shown, the detection system can determine whether the second process includes a TLS section based on the parsing result, and if the second process includes a TLS section, detect whether the first process modifies the "AddressOfCallBacks pointer" of the second process.

[0105] like Figure 3 As shown, after detecting that the first process has modified the "AddressOfCallBacks pointer" of the second process, it is detected whether the memory area pointed to by the modified "AddressOfCallBacks pointer" is the target memory area applied for by the first process. If so, a memory scan is performed on the target memory area, and an alarm message is generated for the detected malicious code.

[0106] From the above content, it can be seen that this application determines the timing of memory scanning by analyzing process behavior, avoiding the performance overhead caused by blind memory scanning. By determining the changes of suspicious TLS sections, more specific threat event warnings and more detailed detection results are given, reducing the burden of security analysts on threat event analysis.

[0107] According to another aspect of the embodiment of the present application, a malicious code detection device is also provided, wherein: Figure 4 is a schematic diagram of an optional malicious code detection device according to an embodiment of the present application, such as Figure 4 As shown, the detection device includes: a first detection unit 401, a first judgment unit 402, a second detection unit 403 and a third detection unit 404.

[0108] Optionally, the first detection unit 401 is used to detect whether the first process and the second process are running in the operating system, wherein the first process has applied for data write permission and memory execution permission for the target memory area of ​​the second process; the first judgment unit 402 is used to determine whether the first process modifies the target pointer of the second process when it is detected that the operating system is running the first process and the second process, wherein the target pointer is a pointer applied to the thread local storage function; the second detection unit 403 is used to detect whether the memory area pointed to by the modified target pointer is the target memory area applied for by the first process when it is determined that the first process has modified the target pointer of the second process; the third detection unit 404 is used to detect whether there is malicious code in the target memory area when it is detected that the memory area pointed to by the modified target pointer is the target memory area.

[0109] Optionally, the first judgment unit 402 includes: a first detection subunit and a first judgment subunit. The first detection subunit is used to detect whether the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute when it is detected that the operating system runs the first process and the second process, wherein the first attribute indicates that the second process only opens the memory data read permission, and the second attribute indicates that the second process opens the memory data write permission; the first judgment subunit is used to determine whether the first process modifies the target pointer of the second process when it is detected that the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute.

[0110] Optionally, the first judgment subunit includes: a first processing module, a second processing module and a first judgment module. The first processing module is used to perform a memory dump operation on the second process when it is detected that the first process changes the memory protection attribute of the second process from the first attribute to the second attribute, wherein the memory dump operation is used to save the memory state information of the second process when it is running in a target file; the second processing module is used to parse the target file to obtain a parsing result; and the first judgment module is used to judge whether the first process modifies the target pointer of the second process according to the parsing result.

[0111] Optionally, the first judgment module includes: a positioning submodule, a first detection submodule, a first judgment submodule, and a first determination submodule. The positioning submodule is used to locate the data directory in the optional header of the target file according to the parsing result, wherein the optional header is used to load and execute the target file; the first detection submodule is used to detect whether the use address of the virtual memory recorded by the target entry in the data directory is a null value, wherein the target entry is used to store the thread data of the operating system; the first judgment submodule is used to determine whether the memory address of the second process modified by the first process is a pointer corresponding to the address of the callback function in the target entry when the use address of the virtual memory recorded by the target entry is a non-null value; the first determination submodule is used to determine that the first process has modified the target pointer of the second process when it is determined that the memory address of the second process modified is a pointer corresponding to the address of the callback function in the target entry.

[0112] Optionally, the first detection subunit includes: a first detection module, an acquisition module, and a second judgment module. The first detection module is used to detect whether the memory address modified by the first process for the second process is located between the base address and the target address of the second process when it is detected that the operating system runs the first process and the second process, wherein the target address is the sum of the base address and a preset byte; the acquisition module is used to obtain the change information of the target bit mask of the second process recorded in the host log when it is detected that the memory address modified by the first process for the second process is located between the base address and the target address of the second process, wherein the target bit mask is used to configure the memory protection function of the second process; the second judgment module is used to judge whether the first process changes the memory protection attribute of the second process from the first attribute to the second attribute according to the change information of the target bit mask.

[0113] Optionally, the third detection unit 404 includes: a feature extraction subunit, a feature comparison subunit, and a determination subunit. The feature extraction subunit is used to extract the code features of the target code in the target memory area; the feature comparison subunit is used to detect the feature similarity between the code features of the target code and each code feature in the code feature library, wherein the code feature library is used to store the code features of known malicious codes; the determination subunit is used to determine that the target code is malicious code when the feature similarity between the code features of the target code and any code feature in the code feature library is greater than a preset threshold.

[0114] Optionally, the malicious code detection device further includes: an acquisition unit and a first determination unit. The acquisition unit is used to acquire a first memory protection flag and a second memory protection flag of the second process after detecting that the first process has modified the target pointer of the second process, wherein the first memory protection flag is used to represent the state of the memory of the second process before the memory protection attribute is modified; the second memory protection flag is used to represent the state of the memory of the second process after the memory protection attribute is modified; and the first determination unit is used to determine the change information of the memory protection attribute of the second process according to the first memory protection flag and the second memory protection flag.

[0115] According to another aspect of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, wherein when the computer program is executed, the device where the computer-readable storage medium is located executes any one of the above-mentioned malicious code detection methods.

[0116] According to another aspect of the present application, an electronic device is also provided, wherein the electronic device includes one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement a method for detecting malicious code for running the programs, wherein the programs are configured to execute any of the above-mentioned malicious codes at runtime.

[0117] The above-mentioned embodiments or examples disclosed in the present application are not exhaustive, but are only illustrative of some embodiments or examples, and are not intended to be specific limitations on the scope of protection disclosed in the present application. In the absence of contradiction, each step in a certain embodiment or example in the present application can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the various embodiments or examples can be combined arbitrarily, for example, some or all steps of different embodiments or examples can be combined arbitrarily, and a certain embodiment or example can be combined arbitrarily with the optional methods or optional examples of other embodiments or examples.

[0118] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0119] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0120] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0121] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0122] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0123] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc., which can store program code.

[0124] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for detecting malicious code, characterized in that: include: Detecting whether a first process and a second process are running in the operating system, wherein the first process has applied for data write permission and memory execution permission for a target memory area of ​​the second process; In a case where it is detected that the operating system runs the first process and the second process, determining whether the first process modifies a target pointer of the second process, wherein the target pointer is a pointer applied to a thread local storage function; In the case where it is determined that the first process has modified the target pointer of the second process, detecting whether the memory area pointed to by the modified target pointer is the target memory area applied for by the first process; When it is detected that the memory area pointed to by the modified target pointer is the target memory area, it is detected whether there is malicious code in the target memory area.

2. The method for detecting malicious code according to claim 1, characterized in that: In a case where it is detected that the operating system runs the first process and the second process, determining whether the first process modifies the target pointer of the second process includes: In the case where it is detected that the operating system runs the first process and the second process, detecting whether the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute, wherein the first attribute indicates that the second process only opens the memory data read permission, and the second attribute indicates that the second process opens the memory data write permission; When it is detected that the first process changes the memory protection attribute of the second process from the first attribute to the second attribute, it is determined whether the first process modifies the target pointer of the second process.

3. The method for detecting malicious code according to claim 2, characterized in that: When it is detected that the first process changes the memory protection attribute of the second process from the first attribute to the second attribute, determining whether the first process modifies the target pointer of the second process includes: When it is detected that the first process changes the memory protection attribute of the second process from the first attribute to the second attribute, performing a memory dump operation on the second process, wherein the memory dump operation is used to save memory state information of the second process when it is running in a target file; Parsing the target file to obtain a parsing result; It is determined whether the first process modifies the target pointer of the second process according to the analysis result.

4. The method for detecting malicious code according to claim 3, characterized in that: Determining whether the first process modifies the target pointer of the second process according to the parsing result includes: Locating a data directory in an optional header of the target file according to the parsing result, wherein the optional header is used to load and execute the target file; Detecting whether a used address of a virtual memory recorded in a target entry in the data directory is a null value, wherein the target entry is used to store thread data of the operating system; When the used address of the virtual memory recorded in the target entry is a non-null value, determining whether the modified memory address of the second process is a pointer corresponding to the address of the callback function in the target entry when the first process modifies the memory protection attribute of the second process; When it is determined that the memory address modified by the second process is the pointer corresponding to the address of the callback function in the target entry, it is determined that the first process has modified the target pointer of the second process.

5. The method for detecting malicious code according to claim 2, characterized in that: In a case where it is detected that the operating system runs the first process and the second process, detecting whether the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute includes: In the case where it is detected that the operating system runs the first process and the second process, detecting whether the memory address modified by the first process for the second process is between a base address and a target address of the second process, wherein the target address is a sum of the base address and a preset byte; When it is detected that the memory address modified by the first process for the second process is between the base address and the target address of the second process, obtaining change information of the target bit mask of the second process recorded in the host log, wherein the target bit mask is used to configure the memory protection function of the second process; According to the change information of the target bit mask, it is determined whether the first process modifies the memory protection attribute of the second process from the first attribute to the second attribute.

6. The method for detecting malicious code according to claim 1, characterized in that: When it is detected that the memory area pointed to by the modified target pointer is the target memory area, detecting whether there is malicious code in the target memory area includes: Extracting code features of the target code in the target memory area; Detecting feature similarity between a code feature of the target code and each code feature in a code feature library, wherein the code feature library is used to store code features of known malicious codes; When the feature similarity between the code feature of the target code and any code feature in the code feature library is greater than a preset threshold, the target code is determined to be the malicious code.

7. The method for detecting malicious code according to claim 1, characterized in that: The malicious code detection method further includes: After detecting that the first process has modified the target pointer of the second process, obtaining a first memory protection flag and a second memory protection flag of the second process, wherein the first memory protection flag is used to represent the state of the memory of the second process before the memory protection attribute is modified; and the second memory protection flag is used to represent the state of the memory of the second process after the memory protection attribute is modified; Determine change information of the memory protection attribute of the second process according to the first memory protection identifier and the second memory protection flag.

8. A malicious code detection device, characterized in that: include: A first detection unit is used to detect whether a first process and a second process are running in the operating system, wherein the first process has applied for data write permission and memory execution permission for a target memory area of ​​the second process; A first judging unit is configured to judge whether the first process modifies a target pointer of the second process when it is detected that the operating system runs the first process and the second process, wherein the target pointer is a pointer applied to a thread local storage function; a second detection unit, configured to, when it is determined that the first process has modified the target pointer of the second process, detect whether the memory area pointed to by the modified target pointer is the target memory area applied for by the first process; The third detection unit is used to detect whether there is malicious code in the target memory area when it is detected that the memory area pointed to by the modified target pointer is the target memory area.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located executes the malicious code detection method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the malicious code detection method described in any one of claims 1 to 7.

Images