Microsoft Technology Licensing, LLC

Randal Patrick Treit

Adrian Mihail Marinescu

Marc E Seinfeld

Nitin Sood

Jeremy D Croy

Joseph J Johnson

Christopher Timothy Kirk

Detecting sideloaded attack chains. The method includes obtaining first telemetry data for a particular instance of a shared library. The first telemetry data is obtained from a first remote client system as a result of the first remote client system identifying the shared library as a known target of sideloaded attack chains. The first telemetry data for the particular instance of the shared library is compared to other telemetry data for other instances of the shared library obtained from other remote client systems to determine a similarity score for the first telemetry data as compared to the other telemetry data. Based on the similarity score, sideloaded attack chain conclusion information about the particular instance of the shared library is sent to the first remote client system.

Detection and prevention of sideloaded attack chains via cloud and fuzzy hashing

In some embodiments, a local agent on a target system may evaluate current and/or historical system state information from a store (either local or remote) and dynamically adjust the level of diagnosis performed during the scan based on the evaluated state information. Individual diagnostic scans may, for example, be enabled and disabled based on the context in the store, and each scan may update the context for further evaluation. By employing such an approach, systems with a low risk profile and lacking symptoms of a problem may be scanned quickly while systems that show signs of a problem or have a high risk profile may receive a more thorough evaluation.

System state based diagnostic scan

Growing community of inventors

Snohomish, WA, United States of America

Randal Patrick Treit