Abstract: Disclosed embodiments relate to systems and methods for detecting fuzzing activity associated with a target program. Techniques include accessing a target program, monitoring, by a monitoring agent in a kernel space environment, the target program, and analyzing dynamic and static patterns of the target program. The techniques may further include assessing process parameters and inputs, evaluating instrumentation patterns in at least one basic block, assessing process creation frequency, assessing Syscalls invocation frequency, identifying suspicious processes, or comparing a runtime coverage ratio of a process to an expected coverage ratio. Systems and methods may also include calculating a confidence score, including applying a weighted value to an analyzed individual pattern based on the analysis, and identifying a likelihood of fuzzing activity based on the confidence score.

Abstract: Disclosed embodiments relate to systems and methods for dynamically identifying potential file system privilege escalation and manipulation vulnerabilities. Techniques include monitoring a file system of a computing system; detecting a privileged file operation involving the file system; determining that a target of the path is writable by a non-privileged identity; and determining whether the target of the path is a dynamic link library. If the target of the path is a dynamic link library, techniques may further include creating a semi-malicious dynamic link library. If the target of the path is not a dynamic link library, techniques may further include creating an object manager symbolic link in a protected file.