Patent ID: 9411953
Filing Date: 2016-08-09
CPC Classification: G06F

Claim Text:
1. A method of detecting a malicious file at a client, comprising: detecting thread creation events performed by an operating system of the client; collecting data about detected thread creation events, the collected data for a thread creation event including an identity of a created thread, an identity of a process that created the thread, and an identity of a file stored by the client that was executed to form the process that created the thread; analyzing an address space of a process executing on the client to identify legitimate memory regions in the address space known to not contain malware; identifying a thread of the process executing on the client referencing a location in the address space of the process outside of the legitimate memory regions, the location designated as a suspicious memory region; designating the thread referencing the suspicious memory region as a suspicious thread; identifying a malicious file associated with the suspicious thread by accessing the collected data about detected thread creation events to identify a file stored by the client that was executed to form a process that created the suspicious thread, identifying the malicious file comprising: remediating the malicious file associated with the suspicious thread.