Patent Capital Group
System and method to detect bypass of a sandbox application
Particular embodiments described herein provide for an electronic device that can be configured to receive data related to execution of a sandboxed process, determine if a high privileged process was created by the sandboxed process, and block the sandboxed process from executing if the high privileged process was created by the sandboxed process and the data indicates the sandboxed process is attempting a sandbox bypass attack. In an example, the high privileged process was created by the sandboxed process if a resource folder is associated with a sandbox folder. In another example, the high privileged process was created by the sandboxed process if a resource folder was created by a broker process in response to a request by the sandboxed process.
McAfee, LLC
H G H H
H04L G06F H04L H04L
inventional inventional inventional inventional
Haifei Bing Lu Xiaoning
Li Sun Deng Li