Sophos Limited

Steven John Braggs

Andrew James Thomas

James Christopher Carpenter

Daniel Montaque Teal

A computer-implemented method includes identifying one or more software processes that execute on the endpoint device and that perform at least one file operation including opening a file, reading the file, writing the file, or transmitting the file over a network. The method further includes storing for each software process of the one or more software processes identification information about the file. The method further includes responsive to determining that a triggering event has occurred, performing one or more actions including: preventing deletion of the file, determining one or more attributes of a suspicious process that accessed the file, requesting that a separate component analyze event journal records in relation to a time interval that overlaps with when the suspicious process accessed the file, or transmitting a cryptographic hash of the file to a server.

Monitoring process data acquisition and exfiltration

A method for detecting malicious activity of a computing device comprises detecting, by a software driver executing within a kernel mode of an operating system being executed by the computing device, an operation performed at the computing device; intercepting the operation; receiving, by a security application executing within a user mode of the operating system, a request from the software driver for an instruction for the software driver for an action to block or allow the operation according to a first timeout value; generating a second timeout value based on an amount of time determined by the security application; transmitting a reply to the request that includes the second timeout value to the software driver; transmitting the instruction to the software driver in compliance with the second timeout value; and executing, by the software driver, the action in response to the instruction.

Variable timeouts between operating modes of a computer for detecting malicious software

In a system and method for processing computer system events asynchronously for software security operations, a computer memory is configured for a read operation by a computer process. The computer process loads, based on a first event occurring during the read operation, at least one file in the computer memory. At least one thread of the computer process is generated. An execution of the at least one thread of the computer process is delayed based on a second event occurring after the first event. A security operation is performed on the process contemporaneously with the loading of the file in the computer memory and the blocking of the execution of the at least one thread of the computer process. The process is either un-delayed on completion of the previous security operation or other security operations performed on that process.

Growing community of inventors

Oxford, United Kingdom

Steven John Braggs