Java Memory Trojan

Overview

Host security (CWP) supports real-time monitoring, capturing unknown classes in the memory of Java Web service processes. Combined with security attack and defense experience and expert knowledge, it can automatically identify memory trojans. If a Java memory Trojan is detected, the system will provide you with real-time alarm notification.

Operation Steps

1. Log in to the CWPP tenant-side console. In the left sidebar, select Intrusion Defense > Java Memory Horse to open the Java Memory Horse page.
2. Select Plug-in Configuration. Plug-in configuration is a prerequisite for monitoring Java memory Trojans. You can turn the plug-in on and off for flagship hosts and observe the specific running status of the plug-in.

   Note:

   • After enabling the Java Memory Trojan plugin, CWPP will automatically detect the Java Web service process on the host and inject a detection probe into the service process to monitor in real time the Java Memory Trojan injected by hackers through vulnerabilities, Shell, etc.
   • Hosts injected with Java memory Trojan plugins will monitor in real time and capture unknown classes in the memory of Java Web service processes. Combining security attack and defense experience and expert knowledge, they can automatically identify memory trojans. If a Java memory Trojan is detected, the system will provide you with real-time alarm notifications.

<Field Description:

• Enable/disable the plugin: Java Memory Horse Plugin is off by default. It supports users to manually set the switch. It can be set for a single host or in batch for multiple selected hosts.
• Plug-in status: all normal, existence of anomalies, not enabled.
• Initial start time: the time when the plug-in is enabled for the first time.
• Update time: the time when the plug-in was recently enabled or disabled.
• Details: You can view the running state of the currently injected Java Memory Horse Plugin, including process PID, main class name of process, plug-in status (injecting, injection successful, plugin timed out, insertion and exit, injection failure), injection log.

After the Java Memory Trojan plugin is enabled, you can select the Alarm List to view detected Java Memory Trojan events and perform related processing operations.

Field Descriptions:

• Host name/instance ID: the host name and instance ID of the host where Java Memory Trojan has been detected.
• Host IP address where Java Memory Trojan has been detected.
• Memory trojan types of Java: including Filter type, Listener type, Servlet type, Interceptors type, Agent type, and other.
• Summary: summarize the general overview of Java Memory Trojan.
• First detected time: the time when this Java Memory Trojan was first detected.
• Latest detection time: the time when detection found this Java Memory Trojan still exists recently.
• Status: to be processed, processed, ignored.
• Operation
  • Click Details to view details of the memory Trojan event.
  • Click View Files in Memory Horse Details to view the decompiled Java file of the landing file. Copying is supported. Support downloading decompiled Java files or original Class files.
  • Click Handle to mark the event as processed, ignored, or delete the record. You can process events individually or select multiple events for batch processing.