Microsoft Technology Licensing, LLC

Jonathan Mark Keller

Adrian Mihail Marinescu

David J Morrison

Anil Francis Thomas

Ajith Kumar

Darren L McKenzie

Marc E Seinfeld

Sterling M Reasor

Michael Jarrett

Jason J Joyce

Vishal Kapoor

Joseph Leo Faulhaber

Santanu Chakraborty

Joseph J Johnson

Ahmed S Hussain

Kanwaljit Marok

Michael Davenport

Omer Ben Bassat

Nizan Manor

The subject disclosure is directed towards detecting malware or possible malware in an input file by allowing the input file to be opened, and by monitoring for one or more behaviors corresponding to the open file that likely indicate malware. Only certain executable files and/or file types opened thereby may be monitored, with various collected event data used for antimalware purposes when improper behavior is observed. Example behaviors include writing of a file to storage, generation of network traffic, injection of a process, running of script, and/or writing system registry data. Telemetry data and/or a sample of the file may be sent to an antimalware service, and malware remediation may be performed. Data (e.g., the collected events) may be distributed to other nodes for use in antimalware detection, e.g., to block execution of a similar file.

Discovering malicious input files and performing automatic and distributed remediation

Techniques are described herein that are capable of selectively scanning objects for infection by malware (i.e., to determine whether one or more of the objects are infected by malware). For instance, metadata that is associated with the objects may be reviewed to determine whether update(s) have been made with regard to the objects since a determination was made that the objects were not infected by malware. An update may involve increasing a number of the objects, modifying one of the objects, etc. Objects that have been updated (e.g., added and/or modified) since the determination may be scanned. Objects that have not been updated since the determination need not necessarily be scanned. For instance, an allowance may be made to perform operations with respect to the objects that have not been updated since the determination without first scanning the objects for infection by malware.

Selectively scanning objects for infection by malware

An arrangement for dynamically identifying and intercepting potential software threats before they execute on a computer system is provided in which a file system filter driver (called a 'mini-filter') interfaces with an anti-malware service to selectively generate an alert event and allow the threat to run, in addition to generating an alert event and suspending the threat. The decision to suspend the threat or allow it to run is made through application of a cascading logic hierarchy that includes respective policy-defined actions, user-defined actions, and signature-defined actions. The mini-filter generates the alert event to the anti-malware service whenever a file is opened, or modified and closed. The service uses an engine to scan the file to identify potential threats which are handled though application of the logic hierarchy which provides for configurations defined in a lower tier of the hierarchy to be overridden by those contained in a higher tier.

Detection and dynamic alteration of execution of potential software threats

A system for identifying specific information regarding the hardware configuration of a computer system improves resolution of problems via online crash and is usable for other purposes as well. Embodiments of the employ applications directed by remote computers functioning as servers, which use the specific computer system hardware-configuration information provided by the identifying system.

System and method for computer hardware identification

Paint bucket

Growing community of inventors

Redmond, WA, United States of America

Jonathan Mark Keller