公开(公告)号：US10333992B2

公开(公告)日：2019-06-25

申请号：US15436215

申请日：2017-02-17

Applicant: SecureWorks Corp.

Inventor： Ross R. Kinder ,  Aaron Hackworth ,  Matthew K. Geiger ,  Kevin R. Moore ,  Timothy M. Vidas ,  Oliver J. Palmer ,  Jon Ramsey ,  Matt J. McCormack

IPC: H04L29/06

Abstract: A system for collection and analysis of forensic and event data comprising a server and an endpoint agent operating on a remote system. The server is configured to receive event data including process creation data, persistent process data, thread injection data, network connection data, memory pattern data, or any combination thereof, and analyze the event data to detect compromises of a remote system. The endpoint agent is configured to acquire event data, and communicate the event data to the server.

公开(公告)号：US20170244750A1

公开(公告)日：2017-08-24

申请号：US15436277

申请日：2017-02-17

Applicant: SecureWorks Corp.

Inventor： Ross R. Kinder ,  Aaron Hackworth ,  Matthew K. Geiger ,  Kevin R. Moore ,  Timothy M. Vidas ,  Oliver J. Palmer ,  Jon Ramsey ,  Matt J. McCormack

IPC: H04L29/06 ,  G06F9/445

CPC classification number: H04L63/308 ,  H04L63/0428 ,  H04L63/08 ,  H04L63/1416 ,  H04L63/1425 ,  H04L63/1433 ,  H04L63/1441 ,  H04L63/145 ,  H04L63/1466 ,  H04L63/20

Abstract: A system for collection and analysis of forensic and event data comprising a server and an endpoint agent operating on a remote system. The server is configured to receive event data including process creation data, persistent process data, thread injection data, network connection data, memory pattern data, or any combination thereof, and analyze the event data to detect compromises of a remote system. The endpoint agent is configured to acquire event data, and communicate the event data to the server.

公开(公告)号：US20170244762A1

公开(公告)日：2017-08-24

申请号：US15436215

申请日：2017-02-17

Applicant: SecureWorks Corp.

Inventor： Ross R. Kinder ,  Aaron Hackworth ,  Matthew K. Geiger ,  Kevin R. Moore ,  Timothy M. Vidas ,  Oliver J. Palmer ,  Jon Ramsey ,  Matt J. McCormack

IPC: H04L29/06 ,  G06F9/445

CPC classification number: H04L63/1441 ,  H04L63/0428 ,  H04L63/08 ,  H04L63/1416 ,  H04L63/1425 ,  H04L63/1433 ,  H04L63/145 ,  H04L63/1466 ,  H04L63/20 ,  H04L63/308

Abstract: A system for collection and analysis of forensic and event data comprising a server and an endpoint agent operating on a remote system. The server is configured to receive event data including process creation data, persistent process data, thread injection data, network connection data, memory pattern data, or any combination thereof, and analyze the event data to detect compromises of a remote system. The endpoint agent is configured to acquire event data, and communicate the event data to the server.