DETECTION OF MALICIOUS THREAD SUSPENSION

摘要

In an example, there is disclosed a computing apparatus having one or more logic elements providing a security agent operable for: detecting that a first process has launch a second process and placed the second process in a suspended state; detecting that the first process has modified or attempted to modify the second process; classifying the modification as potentially malicious; and taking a remedial action. There is also disclosed one or more computer-readable storage mediums having stored thereon executable instructions for providing the security agent, and a computer-executable method of providing the security agent.

主权项

1. A computing apparatus, comprising:
one or more logic elements comprising a security agent operable to:
detect that a first process has launch a second process and placed the second process in a suspended state;detect that the first process has modified or attempted to modify the second process;classify the modification as potentially malicious; andtake a remedial action.