Sophos Limited

Erik Jan Loman

Lute Edwin Engels

Kenneth D Ray

Andrew James Thomas

Mark Willem Loman

Alexander Vermaning

Victor Marinus Johann Simon Van Hillo

Karl Ackerman

Simon Neil Reed

Ross McKerchar

A compute instance is instrumented to detect certain kernel memory allocation functions, in particular functions that allocate heap memory and/or make allocated memory executable. Dynamic shell code exploits can then be detected when code executing from heap memory allocates additional heap memory and makes that additional heap memory executable.

Malware mitigation based on runtime memory allocation

Malware uses various techniques to detect a sandbox environment so that malicious code can avoid execution in closely monitored contexts that might otherwise trigger detection and remediation. A security system is dynamically updated to exploit these anti-sandbox techniques, e.g., by causing endpoints to mimic sandbox environments in a manner that discourages malware execution on the endpoint, and by updating sandboxes to alter or hide sandbox detection triggers.

Dynamic sandbox scarecrow for malware management

Trampoline and return-oriented programming attacks employ a variety of techniques to maliciously execute instructions on a device in a manner different from a legitimate programmer's original intent. By instrumenting a device to detect deviations from predicted behavior, these exploits can be identified and mitigated.

Mitigation of return-oriented programming attacks

Growing community of inventors

Hengelo, Netherlands

Erik Jan Loman