Create signature for spawning/injecting many processes

[kevross33]

This is a simple signature to detect malware with large process trees. One indicator for malware is lots of processes, this includes injection, creation or even running command windows etc as well as malware trying to be evasive (or rather annoying when viewing) by spawning large process trees from copies of itself.

Anyway as mentioned simple and just take action based on the number of processes minus 1 for the parent process. Tested on various samples. I pondered whether or not to display the processes as appended information but decided against it as wasted processing time as user can click on behavior tab and see them anyway one this has been highlighted to them.

Also on a side note any feedback regarding the ransomware message submission now the suggested improvements have been made and tested as not had feedback since?

[spender-sandbox]

This seems like it would be very prone to false positives. I'd like to see better checks, like for deep process trees (for the cases where the malware continuously replicates as a child process of itself), or for a large number of actual injections.

-Brad

[kevross33]

Ok thanks. I will look at implementing various checks. The child process one might be OK but the injection one may be more difficult without replicating injection sigs unless there is some ideas?

I will have a look to start things off though by implementing first suggested check of deep process trees and then other oddities can be added after.