Palo Alto Networks, Inc.

Jiangxia Liu

Qi Zhang

Bo Qu

Cong Zheng

Zihang Xiao

Tao Yan

Bin Zhao

Huagang Xie

Xinran Wang

ChienHua Lu

Xin Ouyang

Zhanglin He

Suiqiang Deng

Jin Chen

Royce Lu

Edouard Bochin

Detection of an exploit including shellcode is disclosed. Memory blocks are monitored during dynamic analysis of a sample to identify a memory block including suspicious shellcode. The memory block is dumped in memory to identify a candidate shellcode entry point associated with the suspicious shellcode. The suspicious shellcode is executed based on the candidate shellcode entry point to determine whether the suspicious shellcode is malicious. A verdict is generated regarding the sample based on results of executing the suspicious shellcode.

System and method for detecting exploit including shellcode

Techniques for a security platform with external inline processing of assembled selected traffic are disclosed. In some embodiments, a system/method/computer program product for providing a security platform with external inline processing of assembled selected traffic includes monitoring network traffic of a session at a security platform; selecting a subset of the monitored network traffic associated with the session to send to a cloud-based security service for analysis based on a security policy, wherein the selected subset of the monitored network traffic is proxied to the cloud-based security service; and receiving, from the cloud-based security service, results of the analysis based on the security policy, and performing a responsive action based on the results of the analysis based on the security policy.

Security platform with external inline processing of assembled selected traffic

A client device requests a web page via a clientless VPN. In response to the request, web page content comprising at least one script element is received at the clientless VPN. The clientless VPN inserts a wrapper function around at least a portion of the script element, forming modified web content. The client device is provided with the modified web content.

Encoding-free JavaScript stringify for clientless VPN

A native web storage function call is received at a client device. A modified browser storage function call is executed, to facilitate browser storage associated with a clientless VPN. The modified browser storage function call executes a call to the native browser storage function call to facilitate access to the browser storage.

Browser storage for clientless VPN

Techniques for providing a large scale high-interaction honeypot farm are disclosed. In some embodiments, a system/method/computer program product for providing a large scale high-interaction honeypot farm includes sending traffic detected at a sensor to a smart proxy for a honeypot farm that is executed in a honeypot cloud, wherein the traffic is forwarded attack traffic that is sent using a tunneling protocol, and wherein the honeypot farm includes a plurality of container images of distinct types of vulnerable services; selecting a matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on a profile of the attack traffic; forwarding the traffic to an instance of the matching type of vulnerable service; and executing a security agent associated with the instance of the matching type of vulnerable service to identify a threat by monitoring behaviors and detecting anomalies or post exploitation activities.

Large scale high-interactive honeypot farm

Techniques for providing a smart proxy for a large scale high-interaction honeypot farm are disclosed. In some embodiments, a system/method/computer program product for providing a smart proxy for a large scale high-interaction honeypot farm includes receiving tunneled traffic at a smart proxy from a sensor for a honeypot farm that is executed in a honeypot cloud, wherein the tunneled traffic is forwarded attack traffic, and wherein the honeypot farm includes a plurality of container images of distinct types of vulnerable services; selecting a matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on a profile of the attack traffic; and forwarding the tunneled traffic to an instance of the matching type of vulnerable service.

Smart proxy for a large scale high-interaction honeypot farm

Content obtained from a remote server by a clientless VPN is received in response to a request made by a client browser executing on a client device. The content includes a script and is received at the client device. A determination is made by the client device that the obtained content includes a script that invokes a native accessor function call. Functionality provided by the script is preserved, at least in part, by the client device executing a modified accessor function call.

Object property getter and setter for clientless VPN

Encoding-free javascript stringify for clientless VPN

A modified accessor function call is provided to the client device by a clientless VPN in conjunction with a browsing session performed by the client device via the clientless VPN. A native accessor function call is received at a client device. The modified accessor function call is executed at the client device, including by using the native accessor function call.

A client device requests a web page, via a clientless VPN. In response to the request, web page content comprising dynamic content is received at the clientless VPN. The clientless VPN inserts a wrapper function around the dynamic content, forming modified web content. The client device is provided with the modified web content.

A native web storage function call is received at a client device. A modified web storage function call is executed, to facilitate web storage associated with a clientless VPN. The modified web storage function call executes a call to the native web storage function call to facilitate access to the web storage.

Techniques for rendering an object using multiple versions of an application in a single process for dynamic malware analysis are disclosed. In some embodiments, a system, process, and/or computer program product for rendering an object using multiple versions of an application in a single process for dynamic malware analysis includes receiving a sample at a cloud security service, in which the sample includes an embedded object; detonating the sample using a browser executed in an instrumented virtual machine environment; and rendering the embedded object using a plurality of versions of an application in a single process during a dynamic malware analysis using the instrumented virtual machine environment.

Growing community of inventors

Cupertino, CA, United States of America

Jiangxia Liu