Script dynamic execution monitoring method and device, electronic equipment and storage medium

Abstract

The invention provides a script dynamic execution monitoring method and device, electronic equipment and a storage medium, and the method comprises the steps: in a process that a Windows script host process executes a script, a hook function preset in a script engine monitors the call of the script engine to a target function; the hook function obtains information of the target function and transmits the information of the target function to a threat behavior recognition engine, so that the threat behavior recognition engine performs security detection on the information of the target function; and receiving a security detection result of the target function, and processing the target function based on the security detection result. According to the method, the target function called by the script engine is obtained through the preset hook function, and the target function information is detected through the threat behavior recognition engine, so that the security protection monitoring capability on malicious script execution is greatly improved.

Description

technical field [0001] The invention relates to the technical field of network security attack protection, in particular to a script dynamic execution monitoring method, device, electronic equipment and storage medium. Background technique [0002] WSH (Windows Script Host) is a Windows system built-in management tool component provided by Microsoft, which supports the execution of VBScript or Jscript script code by default. The scripting languages ​​of VBScript and JScript are very powerful. They take advantage of the openness of the Windows system to directly operate on the network, file system, registry, WMI, etc. by calling some ready-made Windows objects and components. The functions are very powerful. Attackers can execute VBScript or Jscript scripts through WSH without using other third-party executable files to launch attacks. At the same time, VBScript or Jscript has the advantages of script type. They are text type (non-binary executable files), easy to write and ...

AI Technical Summary

Problems solved by technology

[0003] The purpose of the present invention is to provide a script dynamic execution monitoring method, device, electronic equipment and storage medium, in order to solve the problem in the prior art that the assailant executes the Vbs / JS script to initiate an attack through WSH, by monitoring the Vbscript / Jscript engine in the Execute all the information of the calling function in the script, which greatly improves the security protection and monitoring ability for malicious script execution

Images