Scripting Engine Malware Detection via In-Memory Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies struggle to reliably detect and block malicious command content executed by scripting engines like PowerShell, due to their ability to run scripts directly in memory, making detection methods based on file content unreliable.
Innovation Solution
The implementation of an unmanaged interface module and a managed interface module that intercept commands before execution, communicate with a threat detection component, and block potentially harmful commands, providing enhanced visibility and protection from malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If scripting engines run scripts directly in memory, then execution speed is improved, but detection reliability deteriorates
Solution Approach 1:
The system performs preliminary analysis of script content before it is executed by the scripting engine. By intercepting and analyzing the script at the managed code level prior to native code execution, the system can detect malicious content while maintaining the performance benefits of in-memory script execution.
Solution Approach 2:
The patent introduces an intermediary analysis layer between the managed scripting engine and the native execution environment. This intermediary component analyzes script content through controlled interfaces without disrupting the direct execution path, enabling reliable malware detection while preserving execution speed.
2Ease of operation
If file-based detection methods are used, then detection simplicity is improved, but effectiveness deteriorates
Solution Approach 1:
The system replaces traditional file-based mechanical detection methods with an in-memory analysis approach. Instead of examining static files on disk, the system intercepts and analyzes script content in memory at the managed code level, substituting the old file-based mechanism with a more effective in-memory inspection system.
3Reliability
If comprehensive script monitoring is implemented, then security protection is improved, but system performance deteriorates
Solution Approach 1:
The system implements partial monitoring by focusing analysis efforts on specific script content that passes through managed code interfaces. Rather than monitoring every aspect of script execution equally, the system applies analysis selectively to relevant portions, achieving adequate security protection while minimizing performance overhead.
Data Source
Figure 1A
Figure 1B
Figure 2~4
AI summary
Described herein are systems, techniques, and computer program products for preventing execution, by a scripting engine, of harmful commands that may be introduced by computer malware or other mechanisms. The system identifies certain host processes that may attempt to utilize a hosted scripting engine. An unmanaged interface module is injected into an identified host process. The unmanaged interface module is configured to detect certain conditions indicating the likelihood that a scripting engine will be instantiated, and in response to inject a managed interface module into the host process. The managed interface module hooks into certain methods of the scripting engine to intercept commands before they are executed by the scripting engine. The managed and unmanaged interface components then communicate with a kernel-mode threat detection component to determine whether any commands should be blocked.