At Upwind Security, we continuously enhance our security capabilities to address emerging threats and provide unparalleled runtime protection for containerized environments. In this update, we are excited to introduce new detection and prevention policies designed to secure workloads against sophisticated attacks.
Next-Generation Threat Detections
Over the past several weeks we have added additional detection policies to identify advanced threats at runtime. These new policies focus on syscall detection, process monitoring, and network anomaly identification. With these new detections, we focus on containerized application behaviour and provide even more advanced security for applications at runtime. Below, we will dive into the specific detections and how Upwind leverages them to provide security teams with next-generation protection.
Process Monitoring
Monitoring processes helps track what applications are running, their relationships with other processes, and the arguments they use. This provides valuable insight into system activity, helps detect unexpected or unauthorized processes, and aids in understanding the flow of execution within the system.
We’ve enhanced our process monitoring to detect:
- Management Tool Downloads: Identifies downloads of tools like kubectl or other management utilities inside containers, which may signal preparation for lateral movement or privilege escalation.
- SSH Sessions in Containers: Detects the initiation of SSH sessions within containerized environments, a common tactic for gaining unauthorized remote access.
- Attack Techniques on Developer Tools: Monitors for attack patterns targeting developer tools like IDEs.
- Source Code Package Downloads: Flags unusual or unauthorized package downloads within containers, which could indicate supply chain attacks or unauthorized software installation.
- Process from Modified Binary Creating Network Connections: Detecting when a process running from a modified binary attempts to establish a network connection, indicating potential compromise or malicious activity.
By performing process monitoring at runtime, Upwind is able to immediately identify malicious processes running in a customer’s environment and provide them with the ability to kill the process or create a prevention policy to stop it from running in the future.
Syscall Analysis
Syscalls, or system calls, are interfaces that allow user-mode processes to request services or functions from the kernel, such as file operations, process management, or network communication. They serve as a controlled gateway for running kernel-level code, ensuring security and stability while accessing core system resources. Monitoring syscalls is more effective than just monitoring processes and arguments because it provides deeper visibility into how applications interact with the kernel.
Upwind monitors low-level system calls to detect:
- Raw Socket Creation: Identifying unauthorized attempts to create raw sockets, which are often used in network attacks like packet sniffing or spoofing.
- Suspicious Module Loads: Detecting unusual or malicious modules being loaded into memory, which can indicate malware or unauthorized modifications.
- Remote Code Execution (RCE): Flagging RCE attempts through syscall anomalies, helping prevent attackers from executing arbitrary code on your systems.
By leveraging syscall analysis, Upwind is able to provide even more granular visibility into process-level monitoring and detect actions made by the process. By doing so, we provide earlier detection of malicious behavior and more granular insights into potential threats.
Key Threat Spotlight: Late-Stage Module Loading
To give a deeper example of how these threat detection policies provide advanced runtime protection, we will spotlight one of the policies listed above – Suspicious Module Loads.
Containers are typically built with specific, pre-approved binaries and libraries. Any deviation from this, especially the loading of new modules long after the container’s initialization, can indicate malicious activity. Such late-stage module loading might be used to introduce spyware, backdoors, or data exfiltration tools, bypassing initial build-time security measures.
How Upwind’s Syscall Monitoring Captures This
By using syscall monitoring, Upwind detects when a process within a container loads a new library or module that was not part of the container’s build configuration.
We then send out real-time alerts when these unexpected module loads occur, enabling security teams to investigate and respond immediately before the activity escalates.
Why It Matters
Attackers often exploit runtime vulnerabilities to inject malicious code or libraries into memory. By monitoring for these module load anomalies, organizations can detect and halt attacks such as the introduction of credential stealers, encryption malware for ransomware, or tools designed for lateral movement.
These detections are particularly effective against sophisticated threats where attackers attempt to evade traditional security measures by running inside a legitimate process.
How Upwind Provides Advanced Threat Detection Capabilities
Cloud workloads have become a cornerstone of modern application deployment, but their nature and dynamic environments create unique security challenges. Our new capabilities directly address these challenges by:
- Detecting Advanced Attack Techniques: By monitoring syscall activities, processes, and audit logs, we can uncover common and advanced attack techniques, including reconnaissance, privilege escalation, and exploitation attempts.
- Ensuring Runtime Integrity: Monitoring binaries, processes, and system calls ensures that your containerized environment remains secure and free from unauthorized modifications.
Coming Soon
As we continue to advance our next-generation threat detection machine, we will be adding a number of new functionalities in the Upwind platform:
- Threat Detection Orbital View: Easily visualize threat findings and associated context, including resources, identities, and APIs.
- Detection Timelines: Detailed timelines to connect events from build to runtime leading up to a detection.
- Threat Correlation: Automatically view other active threats and threat detections over time.
To learn more about Upwind’s advanced threat detection capabilities, visit the Upwind Documentation Center (login required) or schedule a demo.
