CPC G06F 21/6218 (2013.01) [G06F 21/45 (2013.01); G06F 21/604 (2013.01)] | 20 Claims |
1. A computer device, comprising:
a processing circuit;
a memory;
an operating system; and
an agent cooperating with the operating system; wherein the agent is configured to:
intercept a request on the computer device to create a process according to first privileges on the computer device and to obtain information related to the request;
determine whether to create the process on the computer device according to second privileges different from the first privileges, based at least in part on the obtained information, by:
hooking a query provided by the operating system, wherein the hooked query is configured to identify whether a control service is enabled,
enquiring of the operating system whether to create the process on the computer device according to the second privileges, and
confirming, by invoking the hooked query and in response to the enquiring of the operating system, that the control service is enabled; and
in response to determining to create the process on the computer device according to the second privileges, cause the process to be created according to the second privileges by the operating system on the computer device.
|