Malwarebytes Corporation

Mark William Patton

Kevin Douglas Breton

Ares Lopez Ituiño

Sherab Giovannini

Nathan Earl Scott

Vijay Arumugam Velayutham

Braydon Michael Davis

Jorge Alejandro Duran Royo

Ragesh Damodaran

Ramon Royo Gutierrez

Manikandan Vellore Muneeswaran

Darren Kazuo Chinen

Zohiartze Herce San Martín

An endpoint security agent facilitates a security policy on an endpoint computing device. The endpoint agent comprises an engine and one or more plugins that each provide a particular security feature. The endpoint agent receives a policy from a cloud server specifying one or more plug-ins used by the policy and configuration of those plug-ins. The endpoint agent retrieves, installs, and configures the one or more plugins. The endpoint agent updates a communication table with command subscription information obtained from each installed plugin indicating command types subscribed to by each plug-in. When a command is received, a lookup of the command type is performed in the table, and the command is sent to the subscribing plugin.

Endpoint agent for enterprise security system

A security server tracks malicious objects detected by malware detection applications that scan for malicious objects on clients. The security server also receives client information from the clients indicating client states. The client state describes one or more protection applications executing on the client that seek to identify and prevent malicious objects from taking malicious actions based on real-time monitoring. Thus, the security server may identify when the protection application fails to detect a malicious object. In addition, the security server maps detection events of malicious objects with corresponding client states to generate aggregate detection information for a population of clients. Analytical data can be derived from the aggregate detection information to identify trends useful for evaluating different types of protection applications. Furthermore, the security server may initiate automated actions based on the identified trends to improve detection and remediation of the malicious objects on the clients.

Generating analytical data from detection events of malicious objects

An anti-malware application detects and remediates ransomware. The anti-malware application monitors processes executing on a computing device and detects that a process is opening a file for editing. A portion of the original file is saved prior to being edited by the process. Once the edited file is saved, the anti-malware application compares a portion of the edited file to the portion of the original file to determine if the edited file is encrypted. The anti-malware application may determine the process is associated with ransomware based on whether the edited file is encrypted.

Detecting ransomware based on file comparisons

An anti-malware application analyzes behavior of an executing process to identify ransomware. The anti-malware application detects an untrusted process requesting enumeration of a directory of user files and causes the untrusted process to initially operate on a decoy file that mimics the user files. If the behavior of the untrusted process with respect to the decoy file is indicative of ransomware, the process can be terminated without loss of the user files. The decoy file may be deployed in a way that is undetectable to the user.

Behavior-based ransomware detection using decoy files

An anti-malware application detects, stops, and quarantines ransomware. The anti-malware application monitors threads executing on a computing device and detects behaviors that conform to a predefined set of behaviors indicative of ransomware. Responsive to detecting these behaviors, indicators are stored to a log in a storage device. Each of the indicators in the log is associated with respective scores. A running score for each thread is generated by combining the respective scores of the indicators in the log. Responsive to determining that the running score exceeds a predefined threshold score, execution of the thread is terminated. The source ransomware file is then identified and quarantined.

Growing community of inventors

San Jose, CA, United States of America

Mark William Patton