进程注入如何通过调用栈，使用ML分类来检测——非常值得借鉴，待实践

4、Machine Learning to Ultimately Defeat Advanced Ransomware Threats

RSA 2022的这个分享主题核心讲解了进程注入如何通过调用栈，使用ML分类来检测。当然，勒索的其他本质特征例如文件加密等没有提到。但是其进程注入的检测值得重点关注。

Ryukas the most advanced form of ransomware payloads (1)

    The initial stages:Planting several executables in the system, for example using the Zloaderbotnet.

    Stopping services, deleting VSS copies, etc.

    The advanced stages:Injecting multiple system and trusted processes.

    But keeping the system operational: lsass.exe, csrss.exe and explorer.exe are not changed.

    Detaching the encrypting part from Ryukprocesses.

Challenge: abnormal injection detection.

Important: there are legitimate injection techniques.

   The ML-based solution:Snapshotting of data changes for the thread.

   Detecting stack anomalies with ML models.

   Recovering changed data if ransomware is detected.

   Otherwise discarding the snapshots of data changes.

Ransomware Shell code injection with CreateRemoteThread

The dropper delivers the payload

   The payload injects itself into legitimateprocesses with OpenProcess

   VirtualAllocEx

   WriteProcessMemorywrites bufferWithTheEncryptor

   CreateRemoteThreadlaunches bufferWithTheEncryptor

   CloseHandle

Ransomware shell code injection with APC

The dropper delivers the payload

   The payload injects itself into legitimateprocesses with OpenProcess

   VirtualAllocEx

   WriteProcessMemorywrites bufferWithTheEncryptor

   apcRoutine= bufferWithTheEncryptor

   OpenThread

   QueueUserApc

Ransomware DLL injection with SetWindowsHookEx

The dropper delivers the payload

   The payload injects itself into legitimateprocesses withLoadLibrary(“hook.dll”)

   Hooker=GetProcAddress(..);

   SetWindowsHookEx

              Architecture of the Anti-Ransomware Solution

              Windows File system filter driver, advanced call stack analyzer, Machine Learning system

Fighting Advanced Ransomware: Main Steps

Monitor injections using RtlCaptureStackBackTrace.

Analyze injections with Machine Learning Model.

Start data protection per the injection affected process.

Analyze process behavior.

When the detection decision is made, recover the encrypted files and terminate hostile injected objects.

System service orthe well-known legitimate application,

the Victim

Malicious thread, injected by Ransomware