Vmware, Inc.

Microsoft Technology Licensing, LLC

Alexey A Polyakov

Ondrej Stastny

Shravan Shantharam

Brooks Peppin

Xueliang Hua

Nitin Rao

Nikhil Ravishankar

Ahmad Bilal

Tomas Vetrovsky

Jigar J Mody

Tony Lee

Yi-Min Wang

Scott Field

Neal Robert Christiansen

Yun Lin

Adrian Mihail Marinescu

Surendra Verma

Mihai Costea

Marc E Seinfeld

Jonathan M Cargille

Andrew M Herron

Ning Sun

Christian Gregory Allred

Dana D Groff

Chengyun Chu

Ravi Kumar Bikkula

Ying Lin

Neil A Cowie

David Field

Gretchen L Loihle

Vincent R Orgovan

Robert J Hensing, Jr

Lee Guang Yan

Disclosed are various examples for device provisioning using a manufacturer boot environment. A management agent can be executed from a manufacturer's boot environment and can install a management application that is executable in the main operating system to provision a client device for management. The management agent can then set a provisioning status BIOS variable to indicate that the client device is provisioned. The client device can then be booted to the main operating system and the management application can be executed.

Device provisioning with manufacturer boot environment

Examples described herein include systems and methods for bare metal management of computing devices. Firmware of the computing device can be configured to contact a network location as part of an HTTP boot and download a boot agent. The boot agent can be prioritized to execute before a primary OS boot loader. The boot agent can download an OS configuration including a package that is inserted into the primary OS. The primary OS, as configured, can then boot. The boot agent can also attest to OS health and device compliance on subsequent boots. For example, the boot agent can cause the firmware to track how many boots have occurred since compliance verification. If a threshold number of boots occur without verification, the boot agent can initiate restoration. Alternatively, if a decommission flag is set, the boot agent can cause the computing device to boot into its original configuration.

Bare metal device management

Examples described here include systems and methods for refreshing the operating system ('OS') of a device enrolled in a management platform. Execution of a first command file ensures that necessary components of the management platform residing on the device are stored in a partitioned portion of the device hard drive to preserve them during the OS refresh. After a new instance of the OS has been installed, execution of a second command file migrates the necessary components from the partitioned portion of the hard drive to the new OS instance. When the user logs back into the refreshed device, a third command file installs all necessary device management components at the new OS instance and re-enrolls the device with the management platform. In this manner, the OS of a managed device can be refreshed and re-enrolled in the management platform without significant input from a user or administrator.

Management platform recovery for a user device

Disclosed are various examples for persistent device provisioning. In some examples, a management agent is executed from the manufacturer boot environment. The management agent determines that a main operating system of the client device is currently unprovisioned for management by the management service. The management agent installs a management application that is executable in the main operating system. The client device boots to the main operating system and executes the management application. The management application enrolls the client device with the management service by installing an enrollment token received from the management service.

Disclosed are various examples for dynamic application deployment in trusted code environments. In some embodiments, an application is identified for installation on a client device. The client device includes a security process that limits the client device to execute trusted code based on a trusted code policy. Characteristics of a file are identified from an installation package for a client application. A management agent is instructed to update the trusted code policy to whitelist the file by providing the characteristics of the executable file to the security process. A command to install the application is transmitted to the management agent, where the management agent is a trusted installer for the client device.

Dynamic application deployment in trusted code environments

An anti-malware system that reduces the likelihood of detecting a false positive. The system is applied in an enterprise network in which a server receives reports of suspected malware from multiple hosts. Files on hosts suspected of containing malware are compared to control versions of those files. A match between a suspected file and a control version is used as an indication that the malware report is a false positive. Such an indication may be used in conjunction with other information, such as whether other hosts similarly report suspect files that match control versions or whether the malware report is generated by a recently changed component of the anti-malware system.

Mitigating false positives in malware detection

A malware analysis system is described that provides information about malware execution history on a client computer and allows automated back-end analysis for faster creation of identification signatures and removal instructions. The malware analysis system collects threat information on client computers and sends the threat information to a back-end analysis component for automated analysis. The back-end analysis component analyzes the threat information by comparing the threat information to information about known threats. The system builds a signature for identifying the threat family and a mitigation script for neutralizing the threat. The system sends the signature and mitigation data to client computers, which use the information to mitigate the threat. Thus, the malware analysis system detects and mitigates threats more quickly than previous systems by reducing the burden on technicians to manually create environments for reproducing the threats and manually analyze the threat behavior.

Collecting and analyzing malware data

A method and system in a computing device for performing security related functions as part of a process created to execute a software component that may be unrelated to security is provided. The security system provides security code that performs one or more security related functions. When a process is created to execute the code of a software component, the security system causes the security code to be executed before the execution of the code of the software component. One security related function of the security code may be to cause the operating system to maintain information about the process as long as the process exists. If the operating system later reports that the process no longer exists but the information is still being maintained, then the security system can assume that malware is attempting to hide the process.

Performing security functions when a process is created

The present invention is directed to a method and system for automatically classifying an application into an application group which is previously classified in a knowledge base. More specifically, a runtime behavior of an application is captured as a series of events which are monitored and recorded during the execution of the application. The series of events are analyzed to find a proper application group which shares common runtime behavior patterns with the application. The knowledge base of application groups is previously constructed based on a large number of sample applications. The construction of the knowledge base is done in such a manner that each sample application can be classified into application groups based on a set of classification rules in the knowledge base. The set of classification rules are applied to a new application in order to classify the new application into one of the application groups.

Classification of malware using clustering that orders events in accordance with the time of occurance

Growing community of inventors

Sammamish, WA, United States of America

Alexey A Polyakov