Patent ID: 11899782
Assignee: SENTINELONE, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A method performed by a computer system, the method comprising:
modifying memory to include a reference to a security dynamic link library (DLL) such that invocation of a function associated with a native DLL is redirected to the security DLL using the reference to the security DLL, the security DLL being different from the native DLL and invoking performance of a threat mitigation function that the native DLL is not programmed to perform;
generating an entry in a mapping, wherein the entry comprises the reference to the security DLL and a representation of the native DLL;
receiving, from a source, instructions referencing an address in memory; and
restricting the address in memory from direct access by the source based on a determination that the address in memory corresponds to the entry in the mapping, wherein restricting the address in the one or more memory devices from direct access by the source comprises restricting access to the reference to the security DLL by modifying an operating system to restrict use of debugging privileges.