Sophos Limited

Dmitri Samosseiko

Andrew James Thomas

Kenneth D Ray

Mark David Harris

Robert Wendell Cook

Simon Neil Reed

Neil Robert Tyndale Watkiss

Fraser Howard

Karl Ackerman

Guy Roberts

Gabor Szappanos

Peter Adam Mackenzie

Malware detections are received from a plurality of endpoints in one or more enterprise networks. A first and second set of indicators of breach may be identified from the malware detections and, where appropriate, grouped by specific customers. The pattern of progressive deployment of malware directed toward a customer can then be used as a basis for identifying generalized targeting of the customer, or extended staging for a specific attack on the customer such as a ransomware attack.

Early malware detection

A technique for local proxy detection includes monitoring outbound traffic from the endpoint with remote network addresses outside the enterprise network, detecting use of a secure communication protocol with a request from the endpoint to one of the remote network addresses, identifying a plaintext network address within the request, and in response to identifying a plaintext network address in the request, initiating remediation of a potentially malicious local proxy on the endpoint.

Local proxy detection

Threat detection instrumentation is simplified by providing and updating labels for computing objects in a context-sensitive manner. This may include simple labeling schemes to distinguish between objects, e.g., trusted/untrusted processes or corporate/private data. This may also include more granular labeling schemes such as a three-tiered scheme that identifies a category (e.g., financial, e-mail, game), static threat detection attributes (e.g., signatures, hashes, API calls), and explicit identification (e.g., what a file or process calls itself). By tracking such data for various computing objects and correlating these labels to malware occurrences, rules can be written for distribution to endpoints to facilitate threat detection based on, e.g., interactions of labeled objects, changes to object labels, and so forth. In this manner, threat detection based on complex interactions of computing objects can be characterized in a platform independent manner and pre-processed on endpoints without requiring significant communications overhead with a remote threat management facility.

Normalized indications of compromise

Using indications of compromise for reputation based network security

Threat detection instrumentation is simplified by providing and updating labels for computing objects in a context-sensitive manner. This may include simple labeling schemes to distinguish between objects, e.g., trusted untrusted processes or corporate private data. This may also include more granular labeling schemes such as a three-tiered scheme that identifies a category (e.g., financial, e-mail, game), static threat detection attributes (e.g., signatures, hashes, API calls), and explicit identification (e.g., what a file or process calls itself). By tracking such data for various computing objects and correlating these labels to malware occurrences, rules can be written for distribution to endpoints to facilitate threat detection based on, e.g., interactions of labeled objects, changes to object labels, and so forth. In this manner, threat detection based on complex interactions of computing objects can be characterized in a platform independent manner and pre-processed on endpoints without requiring significant communications overhead with a remote threat management facility.

Growing community of inventors

Vancouver, Canada

Dmitri Samosseiko