The kernel drivers in Sophos Intercept X Superior – Sophos Information

Working in ‘kernel-space’ – essentially the most privileged layer of an working system, with direct entry to reminiscence, {hardware}, useful resource administration, and storage – is vitally necessary for safety merchandise. It allows them to observe ‘user-space’ – the non-privileged setting the place purposes run – and shield towards malware that executes in that setting, even when it tries to evade detection. However kernel entry additionally permits safety merchandise to counter extra insidious threats throughout the kernel itself. As we’ve reported beforehand, for instance, some menace actors use BYOVD (Convey Your Personal Weak Driver) assaults, or try to get their very own malicious drivers cryptographically signed, with a purpose to entry kernel-space and make the most of that elevated degree of entry.

Nonetheless, from a safety standpoint, working in kernel-space comes with its personal dangers. A mistaken step on this setting – comparable to a foul replace to a kernel driver – could cause outages. If the driving force in query begins at boot time, when the working system first hundreds, that may result in extended impacts, doubtlessly requiring affected hosts to be began in a restoration mode to mitigate the issue and permit the machines as well usually.

Sophos’ Intercept X Superior product makes use of 5 kernel drivers as of launch 2024.2. All drivers are extensively examined* with relevant flags enabled and disabled, and shipped with new flags disabled. (Sophos Intercept X and Sophos Central use characteristic flags to steadily allow new options. Characteristic flags are deployed by means of Sophos Central. New options are usually ‘guarded’ by characteristic flags – turned off except the flag is enabled – in order that the characteristic will be rolled out steadily and doubtlessly revised earlier than wider enablement.)

On this article, within the pursuits of transparency, we’ll discover what these drivers are, what they do, after they begin, how they’re signed, and what their inputs are. We’ll additionally discover a few of the safeguards we put in place round these drivers to attenuate the chance of disruption (comparable to staged rollouts, as talked about above; we offer an instance of this later within the article), and the choices out there to prospects on the subject of configuring them. It’s additionally price noting that Intercept X Superior and all its parts, together with the kernel drivers, has been a part of an external bug bounty program since December 14, 2017; we welcome scrutiny by way of exterior bug bounty submissions, and we foster a tradition of collaboration with the analysis neighborhood.

* ‘Testing’ refers to a variety of inside testing, together with Microsoft-provided instruments and verifiers

The next desk gives an at-a-glance overview of the 5 kernel drivers that are a part of Intercept X Superior launch 2024.2.

Desk 1: An outline of the kernel drivers in Intercept X Advanced2024.2
* Microsoft Home windows Early Launch Anti-malware Writer
+ Microsoft Home windows {Hardware} Compatibility Writer

Determine 1: A conceptual depiction of user-space/kernel boundaries and the place Intercept X Superior parts function

What it does: SophosEL.sys is the Sophos Early Launch Anti-Malware (ELAM) driver.

Inputs: This driver has one enter – a blocklist of known-bad drivers which have to be prevented from executing as boot begin drivers at machine startup. This blocklist, situated on the registry key under, is ready by Sophos user-space menace detection logic when it detects a malicious driver. On the subsequent boot cycle, SophosEL.sys ensures that this driver just isn’t loaded.

Buyer choices: Prospects can configure remediation and allowed gadgets within the Threat Protection policy from Sophos Central.

Extra measures: Any Microsoft or Sophos-signed driver is exempt from cleanup/blocking.

What it does: SophosED.sys (Endpoint Protection) is a boot begin driver, began throughout ELAM processing and earlier than many different kernel drivers are loaded, Home windows user-space is initialized, and the system drive is mounted. It has three broad duties:

1. Offering tamper safety for the Sophos set up and configuration
2. Exposing system exercise occasions to Sophos user-space parts for defense and detection
3. Recording low-level system exercise occasions to the Sophos Occasion Journals for after-the-fact forensics and evaluation

Inputs: Since SophosED.sys begins earlier than the filesystem is on the market, its total configuration is offered by means of its service key. Notice that every one the under inputs are underneath HKLMSYSTEMCurrentControlSetServicesSophos Endpoint Protection.

Filter driver altitudes inputs

SophosED.sys registers with Home windows as a Mini-Filter driver at a number of altitudes (a singular identifier that defines a driver’s place on the ‘stack’ of drivers, with ‘decrease’ drivers being nearer to reveal steel) allocated and approved by Microsoft.

Tamper Safety inputs

Sophos Tamper Safety is configured by a mixture of buyer insurance policies, Sophos characteristic flags, and signed manifests constructed into the agent.

* The configuration password is hashed with PBKDF2-SHA512 and a salt

System Exercise Occasions inputs

The Sophos Central Risk Safety coverage helps a number of configuration choices, which Sophos user-space processes write to the SophosED.sys registry key, in order that they’re out there when the driving force is loaded.

Occasion Journal inputs

Buyer choices: Prospects can configure disk limits and handle exclusions in Sophos Central Risk Safety coverage.

Extra measures: If a driver facility is on the market (based mostly on a mixture of Buyer Coverage plus Sophos flag), then Sophos user-space processes can configure numerous parameters at runtime:

• A bitmask of mitigations to use per-process
• What occasions to allow or disable for every course of
• The period of time the driving force ought to watch for a response from user-space (or whether or not it must be an asynchronous notification).

What it does: Sntp.sys (Sophos Community Risk Safety) is a kernel driver that registers for numerous Windows Filtering Platform occasions to intercept and doubtlessly modify community circulate knowledge. Relying on options enabled by Sophos Central Risk Safety and Net Management insurance policies, totally different filters and callouts are registered.

Inputs: Characteristic configuration is communicated to the driving force from a number of of the next consumer mode processes:

• SophosNtpService.exe
• SophosNetFilter.exe
• SophosIPS.exe
• SSPService.exe

Consumer-space processes talk with the driving force by way of the Windows Driver Framework, utilizing IOCTLs, Learn, and Write. Communications to and from the driving force are protected, solely accepting connections from approved and genuine Sophos processes.

Buyer choices: The filter driver intercepts community visitors by browser and non-browser processes based mostly on the insurance policies outlined in Sophos Central. Processing of the intercepted visitors is carried out in user-space by SophosNetFilter.exe and SophosIPS.exe, which can ship modified content material again to the driving force (for instance, to show a block web page for malicious content material).

Extra measures: Prospects can add particular person websites to their permit or block checklist in Sophos Central.

What it does: Hmpalert.sys enforces Sophos CryptoGuard, which detects and prevents bulk encryption of information by ransomware. It additionally configures what exploit mitigations are enforced as processes are executed.

Inputs: Hmpalert.sys has quite a lot of inputs, together with a number of registry subkeys and IOCTLS.

Buyer choices: Prospects can allow/disable exploit mitigations and handle exclusions in Sophos Central Risk Safety coverage.

Extra measures: N/A

What it does: SophosZtnaTap.sys is a Sophos-built OpenVPN TAP driver. If the shopper deploys the Sophos Zero Belief Community Entry (ZTNA) agent, the driving force intercepts DNS lookups for managed purposes, and redirects visitors for these purposes to the relevant Sophos ZTNA gateways. ZTNA purposes and gateways are configured by means of Sophos Central insurance policies and saved within the registry.

Inputs: Inputs into SophosZtnaTap.sys are by way of a registry subkey.

Buyer choices: Prospects can handle their ZTNA-protected purposes and gateways from Sophos Central.

Extra measures: N/A

Sophos CryptoGuard has protected towards bulk encryption on everlasting disks for over a decade. Intercept X model 2024.1.1 launched a brand new characteristic, CryptoGuard ExFAT, which extends this safety to ExFAT partitions (usually discovered on detachable USB drives).

CryptoGuard ExFAT growth and testing passed off in September 2023 by means of March 2024. This characteristic was guarded by the flag ‘hmpa.cryptoguard-exfat.out there.’

Sophos Engineering ran the software program internally with the flag enabled (our ‘Dogfood launch’) beginning March 22, 2024.

Intercept X model 2024.1.1 was launched to Sophos, then to prospects utilizing our gradual software program deployment course of, between Might 21, 2024 by means of June 6, 2024. At this stage the characteristic was nonetheless dormant for everybody other than Sophos engineers.

The ’hmpa.cryptoguard-exfat.out there’ flag was enabled utilizing our gradual flag enablement course of, between June 10, 2024 by means of June 26, 2024.

Prospects can choose a set software program model (Endpoint Software Management: Fastened-term assist, Lengthy-term assist). This locks the software program and flags till the shopper selects a unique software program package deal. Prospects who use the ‘Sophos really helpful’ possibility obtain new software program periodically. Except for software program rollouts, additionally they obtain gradual feature-flag enablements for brand spanking new options within the software program, as with a standard software program launch. Sophos has advanced this course of to enhance stability and keep away from enabling new occasions globally for all prospects.

Kernel drivers are elementary to the Intercept X Superior product – and to sturdy Home windows endpoint safety, basically – however we additionally acknowledge that working in kernel-space just isn’t with out its dangers.

On this article, we’ve walked by means of the kernel drivers in Intercept X Superior (as of launch 2024.02), what they do, how they’re signed, what their inputs are, the management prospects have over their administration, and extra safeguards we’ve put in place – together with gradual, phased rollouts of latest options, and exemptions to attenuate the chance of disruption.

Whereas no safeguard can ever remove threat altogether, we wished to share the main points of our drivers within the pursuits of transparency, and to elucidate in depth how we strategy the advanced drawback of attempting to guard our prospects from threats, in as secure a way as doable.