[ad_1]
CrowdStrike included a CPU characteristic developed by Intel into its Falcon platform to detect advanced assault strategies that might in any other case not be detected by the working system, the corporate says.
The CPU characteristic, known as the Intel Processor Hint (Intel PT), traces an executable whereas it runs, shops the hint on the disk, and afterwards analyzes the hint to breed the precise sequence of directions that was executed. As a result of Intel PT can document code execution on the method, it offers visibility in varied areas of program conduct evaluation, together with static and dynamic evaluation, efficiency evaluation and diagnostics, exploit detection, software program failure understanding, and autopsy crash dump evaluation. The characteristic has been beforehand utilized by risk detection instruments to boost malware and exploit evaluation.
CrowdStrike says Intel PT delivers in depth telemetry helpful for the detection and prevention of code reuse exploits.
The Falcon sensor’s {Hardware} Enhanced Exploit Detection characteristic makes use of Intel PT telemetry to investigate the captured hint for a specific set of applications and appears for suspicious operations related to exploit strategies, equivalent to shellcode injection and return-oriented programming. On techniques the place Intel PT is enabled and supported, safety software program operating within the kernel “can now verify for various suspicious operations, like returns not matching calls, suspicious stack pointer hundreds, extreme use of oblique calls and jumps, and extra,” CrowdStrike notes.
The characteristic has already been used to detect ROP-based exploit chains focusing on Firefox, CrowdStrike says.
Intel PT has been current on Intel CPUs for the reason that fifth era (“Broadwell”), which suggests this characteristic is current on older techniques. The mixture of Intel PT with the Falcon sensor can present reminiscence security protections for older techniques missing fashionable built-in safety protections. {Hardware} Enhanced Exploit Detection is out there with model 6.27 of the Falcon sensor for techniques with Intel CPUs, sixth era or newer, operating Home windows 10 RS4 or later.
Learn extra right here from CrowdStrike.
[ad_2]
