{"id":76039,"date":"2020-03-30T13:43:09","date_gmt":"2020-03-30T11:43:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery"},"modified":"2020-03-30T13:43:09","modified_gmt":"2020-03-30T11:43:09","slug":"kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery","title":{"rendered":"Jak syst\u00e9my anal\u00fdzy provozu odhaluj\u00ed hackersk\u00e9 taktiky podle MITRE ATT&amp;CK na p\u0159\u00edkladu PT Network Attack Discovery","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/pt\/blog\/493082\/\"><img decoding=\"async\" alt=\"Jak syst\u00e9my anal\u00fdzy provozu detekuj\u00ed taktiky hacker\u016f podle MITRE ATT&amp;CK na p\u0159\u00edkladu PT Network Attack Discovery\" src=\"\/wp-content\/uploads\/2020\/03\/75b6c4846867a15776529105f9657ffb.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.verizonenterprise.com\/resources\/reports\/rp_DBIR_2018_Report_execsummary_en_xg.pdf\">Podle spole\u010dnosti Verizon<\/a><\/noindex>, v\u011bt\u0161ina (87 %) incident\u016f kybernetick\u00e9 bezpe\u010dnosti se odehr\u00e1v\u00e1 b\u011bhem n\u011bkolika minut, zat\u00edmco 68 % firem pot\u0159ebuje m\u011bs\u00edce na jejich odhalen\u00ed. To potvrzuje tak\u00e9 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ibm.com\/security\/data-breach\">v\u00fdzkum institutu Ponemon<\/a><\/noindex>, podle kter\u00e9ho v\u011bt\u0161ina organizac\u00ed pot\u0159ebuje v pr\u016fm\u011bru 206 dn\u00ed na odhalen\u00ed incidentu. Z na\u0161ich zku\u0161enost\u00ed s vy\u0161et\u0159ov\u00e1n\u00edm vypl\u00fdv\u00e1, \u017ee hacke\u0159i mohou roky kontrolovat infrastrukturu spole\u010dnosti bez odhalen\u00ed. Nap\u0159\u00edklad v jedn\u00e9 z organizac\u00ed, kde na\u0161i experti prov\u00e1d\u011bli vy\u0161et\u0159ov\u00e1n\u00ed incidentu kybernetick\u00e9 bezpe\u010dnosti, bylo zji\u0161t\u011bno, \u017ee hacke\u0159i pln\u011b kontrolovali celou infrastrukturu organizace a pravideln\u011b ukradli d\u016fle\u017eit\u00e9 informace <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ptsecurity.com\/ru-ru\/research\/analytics\/operation-taskmasters-2019\/?sphrase_id=71910\">po dobu osmi let.<\/a><\/noindex>.<\/p>\n<p>P\u0159edstavte si, \u017ee ji\u017e m\u00e1te funk\u010dn\u00ed SIEM, kter\u00e9 shroma\u017e\u010fuje logy a analyzuje ud\u00e1losti, a na koncov\u00fdch uzlech jsou nainstalov\u00e1ny antivirov\u00e9 programy. Nicm\u00e9n\u011b, <noindex><a rel=\"nofollow\" href=\"https:\/\/safe.cnews.ru\/articles\/2019-10-15_pochemu_hakery_legko_vzlamyvayut_nasa\">nen\u00ed mo\u017en\u00e9 v\u0161e odhalit pomoc\u00ed SIEM<\/a><\/noindex>, stejn\u011b jako nen\u00ed mo\u017en\u00e9 nasadit EDR syst\u00e9my na celou s\u00ed\u0165, co\u017e znamen\u00e1, \u017ee \u201eslep\u00fdm\u201c oblastem se nelze vyhnout. S t\u00edmto probl\u00e9mem pom\u00e1haj\u00ed syst\u00e9my anal\u00fdzy provozu (network traffic analysis, NTA). Tato \u0159e\u0161en\u00ed odhaluj\u00ed aktivitu \u00fato\u010dn\u00edk\u016f v nejran\u011bj\u0161\u00edch f\u00e1z\u00edch pronik\u00e1n\u00ed do s\u00edt\u011b, stejn\u011b jako b\u011bhem pokus\u016f o udr\u017een\u00ed a rozvoj \u00fatok\u016f uvnit\u0159 s\u00edt\u011b. <\/p>\n<p>NTA jsou dvou typ\u016f: jedny pracuj\u00ed s NetFlow, druh\u00e9 analyzuj\u00ed syrov\u00fd provoz. V\u00fdhodou druh\u00fdch syst\u00e9m\u016f je, \u017ee mohou uchov\u00e1vat z\u00e1znamy syrov\u00e9ho provozu. D\u00edky tomu m\u016f\u017ee odborn\u00edk na kybernetickou bezpe\u010dnost ov\u011b\u0159it \u00fasp\u011b\u0161nost \u00fatoku, lokalizovat hrozbu, porozum\u011bt tomu, jak k \u00fatoku do\u0161lo a jak podobn\u00fdm situac\u00edm v budoucnu p\u0159edej\u00edt.<\/p>\n<p>Uk\u00e1\u017eeme, jak pomoc\u00ed NTA lze podle p\u0159\u00edm\u00fdch nebo nep\u0159\u00edm\u00fdch znak\u016f identifikovat v\u0161echny zn\u00e1m\u00e9 taktiky \u00fatok\u016f popsan\u00e9 v datab\u00e1zi znalost\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/\">MITRE ATT&amp;CK<\/a><\/noindex>. P\u0159edstav\u00edme ka\u017edou z 12 taktik, prozkoum\u00e1me techniky, kter\u00e9 jsou detekovateln\u00e9 podle provozu, a p\u0159edvedeme jejich odhalen\u00ed pomoc\u00ed na\u0161eho NTA syst\u00e9mu. <noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>O datab\u00e1zi znalost\u00ed ATT&amp;CK<\/h2>\n<p>\nMITRE ATT&amp;CK \u2013 je ve\u0159ejn\u011b dostupn\u00e1 znalostn\u00ed b\u00e1ze vytvo\u0159en\u00e1 a udr\u017eovan\u00e1 spole\u010dnost\u00ed MITRE na z\u00e1klad\u011b anal\u00fdzy skute\u010dn\u00fdch APT. P\u0159edstavuje strukturovanou sadu taktik a technik pou\u017e\u00edvan\u00fdch \u00fato\u010dn\u00edky. To umo\u017e\u0148uje odborn\u00edk\u016fm na kybernetickou bezpe\u010dnost po cel\u00e9m sv\u011bt\u011b komunikovat stejn\u00fdm jazykem. Z\u00e1kladna se neust\u00e1le roz\u0161i\u0159uje a dopl\u0148uje nov\u00fdmi poznatky.<\/p>\n<p>V datab\u00e1zi se vyzna\u010duje 12 taktik, kter\u00e9 jsou rozd\u011bleny podle f\u00e1z\u00ed kybernetick\u00e9ho \u00fatoku: <\/p>\n<ul>\n<li>po\u010d\u00e1te\u010dn\u00ed p\u0159\u00edstup (initial access);<\/li>\n<li>prov\u00e1d\u011bn\u00ed (execution);<\/li>\n<li>zachov\u00e1n\u00ed (persistence);<\/li>\n<li>zv\u00fd\u0161en\u00ed opr\u00e1vn\u011bn\u00ed (privilege escalation);<\/li>\n<li>p\u0159edch\u00e1zen\u00ed detekci (defense evasion);<\/li>\n<li>z\u00edsk\u00e1v\u00e1n\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f (credential access);<\/li>\n<li>zkoum\u00e1n\u00ed (discovery);<\/li>\n<li>pohyb uvnit\u0159 perimetru (lateral movement);<\/li>\n<li>sb\u011br dat (collection);<\/li>\n<li>\u0159\u00edzen\u00ed a kontrola (command and control);<\/li>\n<li>exfiltrace dat (exfiltration);<\/li>\n<li>dopad (impact).<\/li>\n<\/ul>\n<p>\nPro ka\u017edou taktiku v datab\u00e1zi ATT&amp;CK je uveden seznam technik, kter\u00e9 \u00fato\u010dn\u00edk\u016fm pom\u00e1haj\u00ed dos\u00e1hnout c\u00edle v aktu\u00e1ln\u00ed f\u00e1zi \u00fatoku. Jeliko\u017e m\u016f\u017ee b\u00fdt stejn\u00e1 technika pou\u017eita v r\u016fzn\u00fdch f\u00e1z\u00edch, m\u016f\u017ee se vztahovat na v\u00edce taktik. <\/p>\n<p>Popis ka\u017ed\u00e9 techniky zahrnuje:<\/p>\n<ul>\n<li>identifik\u00e1tor;<\/li>\n<li>seznam taktik, ve kter\u00fdch se pou\u017e\u00edv\u00e1;<\/li>\n<li>p\u0159\u00edklady pou\u017eit\u00ed APT skupinami;<\/li>\n<li>opat\u0159en\u00ed k omezen\u00ed \u0161kod z jej\u00edho pou\u017eit\u00ed;<\/li>\n<li>doporu\u010den\u00ed k detekci. <\/li>\n<\/ul>\n<p>\nOdborn\u00edci na informa\u010dn\u00ed bezpe\u010dnost mohou vyu\u017e\u00edvat znalosti z datab\u00e1ze k strukturov\u00e1n\u00ed informac\u00ed o aktu\u00e1ln\u00edch metod\u00e1ch \u00fatok\u016f a na jejich z\u00e1klad\u011b vybudovat efektivn\u00ed bezpe\u010dnostn\u00ed syst\u00e9m. Porozum\u011bn\u00ed skute\u010dn\u00fdm APT skupin\u00e1m m\u016f\u017ee b\u00fdt rovn\u011b\u017e zdrojem hypot\u00e9z pro proaktivn\u00ed vyhled\u00e1v\u00e1n\u00ed hrozeb v r\u00e1mci <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ptsecurity.com\/ru-ru\/research\/webinar\/302112\/\">threat hunting<\/a><\/noindex>. <\/p>\n<h3>O PT Network Attack Discovery<\/h3>\n<p>\nIdentifikace pou\u017eit\u00ed technik z matice ATT&amp;CK bude prob\u00edhat pomoc\u00ed syst\u00e9mu <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ptsecurity.com\/ru-ru\/products\/network-attack-discovery\/?utm_source=press_release&amp;utm_medium=press_release&amp;utm_campaign=new_nad\">PT Network Attack Discovery <\/a><\/noindex>\u2013 NTA syst\u00e9mu Positive Technologies, ur\u010den\u00e9ho k identifikaci \u00fatok\u016f na perimetru a uvnit\u0159 s\u00edt\u011b. PT NAD pokr\u00fdv\u00e1 v r\u016fzn\u00e9 m\u00ed\u0159e v\u0161ech 12 taktik matice MITRE ATT&amp;CK. Nejl\u00e9pe se osv\u011bd\u010duje p\u0159i identifikaci technik po\u010d\u00e1te\u010dn\u00edho p\u0159\u00edstupu (initial access), pohybu uvnit\u0159 perimetru (lateral movement) a \u0159\u00edzen\u00ed a kontroly (command and control). V t\u011bchto oblastech PT NAD pokr\u00fdv\u00e1 v\u00edce ne\u017e polovinu zn\u00e1m\u00fdch technik, detekuje jejich pou\u017eit\u00ed na z\u00e1klad\u011b p\u0159\u00edm\u00fdch nebo nep\u0159\u00edm\u00fdch znak\u016f. <\/p>\n<p>Syst\u00e9m detekuje \u00fatoky pomoc\u00ed technik ATT&amp;CK pomoc\u00ed detek\u010dn\u00edch pravidel vytvo\u0159en\u00fdch t\u00fdmem <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ptsecurity.com\/ru-ru\/products\/network-attack-discovery\/?utm_source=press_release&amp;utm_medium=press_release&amp;utm_campaign=new_nad\">PT Expert Security Center<\/a><\/noindex> (PT ESC), strojov\u00e9ho u\u010den\u00ed, indik\u00e1tor\u016f kompromitace, hlubok\u00e9 anal\u00fdzy a retrospektivn\u00ed anal\u00fdzy. Anal\u00fdza provozu v re\u00e1ln\u00e9m \u010dase v kombinaci s retrospektivou umo\u017e\u0148uje odhalit aktu\u00e1ln\u00ed skrytou \u0161kodlivou aktivitu a sledovat vektory v\u00fdvoje a chronologii \u00fatok\u016f.<\/p>\n<blockquote><p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/-l\/o8\/yc\/-lo8ycywq-rl1g_v1pt9-lmnj3y.png\">Zde<\/a><\/noindex> je kompletn\u00ed mapov\u00e1n\u00ed PT NAD na matici MITRE ATT&amp;CK. Obr\u00e1zek je velk\u00fd, proto v\u00e1m doporu\u010dujeme se na n\u011bj pod\u00edvat v samostatn\u00e9m okn\u011b.<\/p><\/blockquote>\n<p><\/p>\n<h3>Po\u010d\u00e1te\u010dn\u00ed p\u0159\u00edstup (initial access)<\/h3>\n<p><img decoding=\"async\" alt=\"Jak syst\u00e9my anal\u00fdzy provozu detekuj\u00ed taktiky hacker\u016f podle MITRE ATT&amp;CK na p\u0159\u00edkladu PT Network Attack Discovery\" src=\"\/wp-content\/uploads\/2020\/03\/93cc3669c7de3b5193897d685e63a72f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTaktika z\u00edsk\u00e1n\u00ed po\u010d\u00e1te\u010dn\u00edho p\u0159\u00edstupu zahrnuje techniky pro pronik\u00e1n\u00ed do s\u00edt\u011b spole\u010dnosti. C\u00edl \u00fato\u010dn\u00edk\u016f v t\u00e9to f\u00e1zi je doru\u010dit do napaden\u00e9ho syst\u00e9mu \u0161kodliv\u00fd k\u00f3d a zajistit mo\u017enost jeho dal\u0161\u00edch vykon\u00e1v\u00e1n\u00ed.<\/p>\n<p>Anal\u00fdza provozu s PT NAD umo\u017e\u0148uje odhalit sedm technik z\u00edsk\u00e1n\u00ed po\u010d\u00e1te\u010dn\u00edho p\u0159\u00edstupu:<\/p>\n<h3>1. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1189\/\">T1189<\/a><\/noindex>: drive-by compromise<\/h3>\n<p>\nTechnika, p\u0159i kter\u00e9 ob\u011b\u0165 otev\u0159e webovou str\u00e1nku, kter\u00e1 je vyu\u017e\u00edv\u00e1na \u00fato\u010dn\u00edky k exploataci webov\u00e9ho prohl\u00ed\u017ee\u010de a z\u00edsk\u00e1n\u00ed token\u016f pro p\u0159\u00edstup do aplikace. <\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: pokud webov\u00fd provoz nen\u00ed \u0161ifrovan\u00fd, PT NAD inspek\u010dn\u011b prozkoum\u00e1v\u00e1 obsah odpov\u011bd\u00ed HTTP server\u016f. Pr\u00e1v\u011b v t\u011bchto odpov\u011bd\u00edch se nach\u00e1zej\u00ed exploity, kter\u00e9 umo\u017e\u0148uj\u00ed \u00fato\u010dn\u00edk\u016fm vykon\u00e1vat libovoln\u00fd k\u00f3d uvnit\u0159 prohl\u00ed\u017ee\u010de. PT NAD automaticky odhaluje takov\u00e9 exploity pomoc\u00ed detek\u010dn\u00edch pravidel. <\/p>\n<p>Nav\u00edc PT NAD odhaluje hrozbu na p\u0159edchoz\u00edm kroku. Pravidla a indik\u00e1tory kompromitace se aktivuj\u00ed, pokud u\u017eivatel nav\u0161t\u00edvil web, kter\u00fd ho p\u0159esm\u011broval na web s sadou exploit\u016f.<\/p>\n<h3>2. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1190\">T1190<\/a><\/noindex>: exploit public-facing application<\/h3>\n<p>\nExploatace zranitelnost\u00ed v slu\u017eb\u00e1ch, kter\u00e9 jsou p\u0159\u00edstupn\u00e9 z internetu. <\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: prov\u00e1d\u00ed hlubokou inspekci obsahu s\u00ed\u0165ov\u00fdch paket\u016f a odhaluje v n\u011bm zn\u00e1mky anom\u00e1ln\u00ed aktivity. Zejm\u00e9na existuj\u00ed pravidla, kter\u00e1 umo\u017e\u0148uj\u00ed odhalit \u00fatoky na hlavn\u00ed syst\u00e9my \u0159\u00edzen\u00ed obsahu (content management system, CMS), webov\u00e9 rozhran\u00ed s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00ed, \u00fatoky na e-mailov\u00e9 a FTP servery.<\/p>\n<h3>3. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1133\/\">T1133<\/a><\/noindex>: external remote services <\/h3>\n<p>\nPou\u017eit\u00ed \u00fato\u010dn\u00edky slu\u017eeb vzd\u00e1len\u00e9ho p\u0159\u00edstupu k p\u0159ipojen\u00ed k prost\u0159edk\u016fm vnit\u0159n\u00ed s\u00edt\u011b zven\u010d\u00ed. <\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: proto\u017ee syst\u00e9m rozpozn\u00e1v\u00e1 protokoly ne podle \u010d\u00edsel port\u016f, ale podle obsahu paket\u016f, mohou u\u017eivatel\u00e9 syst\u00e9mu filtrovat provoz tak, aby na\u0161li v\u0161echny relace protokol\u016f vzd\u00e1len\u00e9ho p\u0159\u00edstupu a zkontrolovali jejich legitimitu. <\/p>\n<h3>4. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1193\/\">T1193<\/a><\/noindex>: spearphishing attachment <\/h3>\n<p>\nJedn\u00e1 se o notoricky zn\u00e1m\u00e9 odes\u00edl\u00e1n\u00ed phishingov\u00fdch p\u0159\u00edloh.<\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: automaticky extrahuje soubory z provozu a kontroluje je pomoc\u00ed indik\u00e1tor\u016f kompromitace. Spustiteln\u00e9 soubory v p\u0159\u00edloh\u00e1ch jsou identifikov\u00e1ny pravidly, kter\u00e1 analyzuj\u00ed obsah e-mailov\u00e9ho provozu. V korpor\u00e1tn\u00edm prost\u0159ed\u00ed je takov\u00e1 p\u0159\u00edloha pova\u017eov\u00e1na za anom\u00e1ln\u00ed. <\/p>\n<h3>5. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1192\/\">T1192<\/a><\/noindex>: spearphishing link <\/h3>\n<p>\nPou\u017eit\u00ed phishingov\u00fdch odkaz\u016f. Taktika zahrnuje zas\u00edl\u00e1n\u00ed phishingov\u00e9ho e-mailu s odkazem, po jeho\u017e kliknut\u00ed se st\u00e1hne \u0161kodliv\u00fd program. Odkaz obvykle doprov\u00e1z\u00ed text, kter\u00fd je sestaven podle v\u0161ech pravidel soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed. <\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: identifikuje phishingov\u00e9 odkazy pomoc\u00ed indik\u00e1tor\u016f kompromitace. Nap\u0159\u00edklad v rozhran\u00ed PT NAD vid\u00edme relaci, ve kter\u00e9 bylo HTTP spojen\u00ed podle odkazu uveden\u00e9ho na seznamu phishingov\u00fdch adres (phishing-urls).<\/p>\n<p><img decoding=\"async\" alt=\"Jak syst\u00e9my anal\u00fdzy provozu detekuj\u00ed taktiky hacker\u016f podle MITRE ATT&amp;CK na p\u0159\u00edkladu PT Network Attack Discovery\" src=\"\/wp-content\/uploads\/2020\/03\/f8b8f0ed7e64da6a9ceb2c3e8d3b3202.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Spojen\u00ed podle odkazu ze seznamu indik\u00e1tor\u016f kompromitace phishing-urls<\/i><\/p>\n<h3>6. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1199\">T1199<\/a><\/noindex>: trusted relationship<\/h3>\n<p>\nP\u0159\u00edstup k s\u00edti ob\u011bti prost\u0159ednictv\u00edm t\u0159et\u00edch stran, se kter\u00fdmi m\u00e1 ob\u011b\u0165 d\u016fv\u011bryhodn\u00e9 vztahy. \u00dato\u010dn\u00edci mohou hackersk\u00fdm zp\u016fsobem proniknout do d\u016fv\u011bryhodn\u00e9 organizace a p\u0159ipojit se k c\u00edlov\u00e9 s\u00edti p\u0159es ni. Pro tento \u00fa\u010del pou\u017e\u00edvaj\u00ed VPN p\u0159ipojen\u00ed nebo d\u016fv\u011bryhodn\u00e1 dom\u00e9nov\u00e1 spojen\u00ed, co\u017e lze odhalit pomoc\u00ed anal\u00fdzy provozu. <\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: analyzuje aplika\u010dn\u00ed protokoly a ukl\u00e1d\u00e1 rozebran\u00e1 pole do datab\u00e1ze, d\u00edky \u010demu\u017e m\u016f\u017ee analytik IT bezpe\u010dnosti pomoc\u00ed filtr\u016f nal\u00e9zt v datab\u00e1zi v\u0161echny podez\u0159el\u00e9 VPN p\u0159ipojen\u00ed nebo mezidom\u00e9nov\u00e1 spojen\u00ed.<\/p>\n<h3>7. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1078\/\">T1078<\/a><\/noindex>: valid accounts<\/h3>\n<p>\nPou\u017eit\u00ed standardn\u00edch, m\u00edstn\u00edch nebo dom\u00e9nov\u00fdch p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f pro autorizaci na extern\u00edch a intern\u00edch slu\u017eb\u00e1ch.<\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: automaticky extrahuje p\u0159ihla\u0161ovac\u00ed \u00fadaje z protokol\u016f HTTP, FTP, SMTP, POP3, IMAP, SMB, DCE\/RPC, SOCKS5, LDAP, Kerberos. Obecn\u011b se jedn\u00e1 o u\u017eivatelsk\u00e9 jm\u00e9no, heslo a indik\u00e1tor \u00fasp\u011b\u0161nosti autentizace. Pokud byly pou\u017eity, zobraz\u00ed se v odpov\u00eddaj\u00edc\u00ed kart\u011b relace.<\/p>\n<h2>Prov\u00e1d\u011bn\u00ed (execution)<\/h2>\n<p><img decoding=\"async\" alt=\"Jak syst\u00e9my anal\u00fdzy provozu detekuj\u00ed taktiky hacker\u016f podle MITRE ATT&amp;CK na p\u0159\u00edkladu PT Network Attack Discovery\" src=\"\/wp-content\/uploads\/2020\/03\/54cfa8b924eb5061d7cc8bc93335c735.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nDo taktiky prov\u00e1d\u011bn\u00ed pat\u0159\u00ed techniky, kter\u00e9 \u00fato\u010dn\u00edci pou\u017e\u00edvaj\u00ed k vykon\u00e1n\u00ed k\u00f3du v kompromitovan\u00fdch syst\u00e9mech. Spu\u0161t\u011bn\u00ed \u0161kodliv\u00e9ho k\u00f3du pom\u00e1h\u00e1 \u00fato\u010dn\u00edk\u016fm upevnit p\u0159\u00edtomnost (taktika persistence) a roz\u0161\u00ed\u0159it p\u0159\u00edstup k vzd\u00e1len\u00fdm syst\u00e9m\u016fm v s\u00edti, p\u0159i\u010dem\u017e se pohybuje uvnit\u0159 perimetru. <\/p>\n<p>PT NAD umo\u017e\u0148uje odhalit pou\u017eit\u00ed 14 technik, kter\u00e9 \u00fato\u010dn\u00edci vyu\u017e\u00edvaj\u00ed k vykon\u00e1n\u00ed \u0161kodliv\u00e9ho k\u00f3du. <\/p>\n<h3>1. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1191\/\">T1191<\/a><\/noindex>: CMSTP (Instal\u00e1tor profilu Spr\u00e1vce p\u0159ipojen\u00ed Microsoft)<\/h3>\n<p>\nTaktika, p\u0159i kter\u00e9 \u00fato\u010dn\u00edci p\u0159ipravuj\u00ed speci\u00e1ln\u00ed \u0161kodliv\u00fd instala\u010dn\u00ed INF soubor pro vestav\u011bnou utilitu CMSTP.exe (instal\u00e1tor profil\u016f spr\u00e1vce p\u0159ipojen\u00ed) v syst\u00e9mu Windows. CMSTP.exe p\u0159ij\u00edm\u00e1 soubor jako parametr a instaluje profil slu\u017eby pro vzd\u00e1len\u00e9 p\u0159ipojen\u00ed. V d\u016fsledku toho m\u016f\u017ee b\u00fdt CMSTP.exe pou\u017eit ke sta\u017een\u00ed a proveden\u00ed dynamicky p\u0159ipojen\u00fdch knihoven (*.dll) nebo skript\u016f (*.sct) z vzd\u00e1len\u00fdch server\u016f. <\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: automaticky odhaluje v HTTP provozu p\u0159enosy INF soubor\u016f speci\u00e1ln\u00edho typu. Krom\u011b toho, detekuje p\u0159enosy \u0161kodliv\u00fdch skript\u016f a dynamicky p\u0159ipojen\u00fdch knihoven z vzd\u00e1len\u00e9ho serveru prost\u0159ednictv\u00edm protokolu HTTP. <\/p>\n<h3>2. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1059\">T1059<\/a><\/noindex>: rozhran\u00ed p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku <\/h3>\n<p>\nInterakce s rozhran\u00edm p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku. S rozhran\u00edm p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku lze interagovat m\u00edstn\u011b nebo vzd\u00e1len\u011b, nap\u0159\u00edklad pomoc\u00ed n\u00e1stroj\u016f pro vzd\u00e1len\u00fd p\u0159\u00edstup.<\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: automaticky detekuje p\u0159\u00edtomnost shell\u016f podle odpov\u011bd\u00ed na p\u0159\u00edkazy spou\u0161t\u011bn\u00ed r\u016fzn\u00fdch n\u00e1stroj\u016f p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku, jako je ping, ifconfig.<\/p>\n<h3>3. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1175\/\">T1175<\/a><\/noindex>: komponentn\u00ed objektov\u00fd model a distribuovan\u00e9 COM <\/h3>\n<p>\nPou\u017eit\u00ed technologi\u00ed COM nebo DCOM k vykon\u00e1v\u00e1n\u00ed k\u00f3du na m\u00edstn\u00edch nebo vzd\u00e1len\u00fdch syst\u00e9mech p\u0159i postupu v s\u00edti.<\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: detekuje podez\u0159el\u00e9 DCOM vol\u00e1n\u00ed, kter\u00e9 \u00fato\u010dn\u00edci obvykle pou\u017e\u00edvaj\u00ed k spou\u0161t\u011bn\u00ed program\u016f. <\/p>\n<h3>4. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1203\/\">T1203<\/a><\/noindex>: zneu\u017eit\u00ed pro klientsk\u00e9 vykon\u00e1n\u00ed <\/h3>\n<p>\nZneu\u017eit\u00ed zranitelnost\u00ed pro vykon\u00e1n\u00ed libovoln\u00e9ho k\u00f3du na pracovn\u00ed stanici. Nejv\u00edce u\u017eite\u010dn\u00e9 pro \u00fato\u010dn\u00edky jsou exploit\u016f, kter\u00e9 dovoluj\u00ed vykon\u00e1n\u00ed k\u00f3du v vzd\u00e1len\u00e9m syst\u00e9mu, nebo\u0165 t\u00edmto zp\u016fsobem mohou \u00fato\u010dn\u00edci z\u00edskat p\u0159\u00edstup k takov\u00e9mu syst\u00e9mu. Technika m\u016f\u017ee b\u00fdt realizov\u00e1na n\u00e1sleduj\u00edc\u00edmi metodami: \u0161kodliv\u00e9 e-mailov\u00e9 rozes\u00edl\u00e1n\u00ed, webov\u00e9 str\u00e1nky s exploity pro prohl\u00ed\u017ee\u010de a vzd\u00e1len\u00e9 zneu\u017eit\u00ed zranitelnost\u00ed aplikac\u00ed. <\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: P\u0159i anal\u00fdze e-mailov\u00e9ho provozu PT NAD zkontroluje, zda neobsahuje spustiteln\u00e9 soubory v p\u0159\u00edloh\u00e1ch. Automaticky extrahuje kancel\u00e1\u0159sk\u00e9 dokumenty z e-mail\u016f, kter\u00e9 mohou obsahovat exploit. Pokusy o zneu\u017eit\u00ed zranitelnost\u00ed jsou viditeln\u00e9 v provozu, co\u017e PT NAD detekuje automaticky.<\/p>\n<h3>5. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1170\">T1170<\/a><\/noindex>: mshta<\/h3>\n<p>\nPou\u017eit\u00ed n\u00e1stroje mshta.exe, kter\u00fd spou\u0161t\u00ed aplikace Microsoft HTML (HTA) s p\u0159\u00edponou .hta. Proto\u017ee mshta zpracov\u00e1v\u00e1 soubory obch\u00e1z\u00ed bezpe\u010dnostn\u00ed nastaven\u00ed prohl\u00ed\u017ee\u010de, \u00fato\u010dn\u00edci mohou pou\u017e\u00edt mshta.exe ke spu\u0161t\u011bn\u00ed \u0161kodliv\u00fdch soubor\u016f HTA, JavaScript nebo VBScript. <\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: soubory .hta pro vykon\u00e1n\u00ed p\u0159es mshta jsou p\u0159en\u00e1\u0161eny i po s\u00edti \u2014 to je viditeln\u00e9 v provozu. PT NAD automaticky detekuje p\u0159enos takov\u00fdch \u0161kodliv\u00fdch soubor\u016f. Zaznamen\u00e1v\u00e1 soubory, a informace o nich lze zobrazit v kart\u011b relace.<\/p>\n<h3>6. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1086\">T1086<\/a><\/noindex>: PowerShell <\/h3>\n<p>\nPou\u017eit\u00ed PowerShellu pro vyhled\u00e1v\u00e1n\u00ed informac\u00ed a vykon\u00e1v\u00e1n\u00ed \u0161kodliv\u00e9ho k\u00f3du. <\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: kdy\u017e je PowerShell pou\u017e\u00edv\u00e1n \u00fato\u010dn\u00edky vzd\u00e1len\u011b, PT NAD to detekuje pomoc\u00ed pravidel. Detekuje kl\u00ed\u010dov\u00e1 slova jazyka PowerShell, kter\u00e1 jsou nej\u010dast\u011bji pou\u017e\u00edv\u00e1na ve \u0161kodliv\u00fdch skriptech, a p\u0159enos PowerShell skript\u016f protokolem SMB.<\/p>\n<p>7. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1053\">T1053<\/a><\/noindex>: napl\u00e1novan\u00e1 \u00faloha<br \/>\nPou\u017eit\u00ed pl\u00e1nova\u010de \u00faloh Windows a dal\u0161\u00edch n\u00e1stroj\u016f pro automatick\u00e9 spu\u0161t\u011bn\u00ed program\u016f nebo skript\u016f v ur\u010dit\u00e9m \u010dase. <\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: \u00fato\u010dn\u00edci obvykle vytv\u00e1\u0159ej\u00ed takov\u00e9 \u00falohy vzd\u00e1len\u011b, co\u017e znamen\u00e1, \u017ee takov\u00e9 relace jsou viditeln\u00e9 v provozu. PT NAD automaticky detekuje podez\u0159el\u00e9 operace p\u0159i vytv\u00e1\u0159en\u00ed a zm\u011bn\u011b \u00faloh pomoc\u00ed RPC rozhran\u00ed ATSVC a ITaskSchedulerService.<\/p>\n<h3>8. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1064\">T1064<\/a><\/noindex>: skriptov\u00e1n\u00ed <\/h3>\n<p>\nVykon\u00e1v\u00e1n\u00ed skript\u016f pro automatizaci r\u016fzn\u00fdch \u010dinnost\u00ed \u00fato\u010dn\u00edk\u016f. <\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: detekuje p\u0159\u00edpady p\u0159enosu skript\u016f po s\u00edti, tedy je\u0161t\u011b p\u0159ed jejich spu\u0161t\u011bn\u00edm. Objevuje obsah skript\u016f v surov\u00e9m provozu a detekuje p\u0159enos po s\u00edti soubor\u016f s p\u0159\u00edponami odpov\u00eddaj\u00edc\u00edmi popul\u00e1rn\u00edm skriptovac\u00edm jazyk\u016fm.<\/p>\n<h3>9. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1035\">T1035<\/a><\/noindex>: prov\u00e1d\u011bn\u00ed slu\u017eeb<\/h3>\n<p>\nSpou\u0161t\u011bn\u00ed spustiteln\u00e9ho souboru, pokyn\u016f p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku nebo skriptu prost\u0159ednictv\u00edm interakce se slu\u017ebami Windows, nap\u0159\u00edklad s \u0159\u00edzen\u00edm slu\u017eeb (Service Control Manager, SCM). <\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: inspekce SMB provozu a detekce p\u0159\u00edstupu k SCM pomoc\u00ed pravidel pro vytv\u00e1\u0159en\u00ed, zm\u011bnu a spu\u0161t\u011bn\u00ed slu\u017eby. <\/p>\n<p>Technika spou\u0161t\u011bn\u00ed slu\u017eeb m\u016f\u017ee b\u00fdt realizov\u00e1na pomoc\u00ed n\u00e1stroje pro vzd\u00e1len\u00e9 prov\u00e1d\u011bn\u00ed p\u0159\u00edkaz\u016f PSExec. PT NAD analyzuje protokol SMB a detekuje pou\u017eit\u00ed PSExec, kdy\u017e vyu\u017e\u00edv\u00e1 soubor PSEXESVC.exe nebo standardn\u00ed n\u00e1zev slu\u017eby PSEXECSVC k prov\u00e1d\u011bn\u00ed k\u00f3du na vzd\u00e1len\u00e9m stroji. U\u017eivatel by m\u011bl zkontrolovat seznam proveden\u00fdch p\u0159\u00edkaz\u016f a legitimnost vzd\u00e1len\u00e9ho prov\u00e1d\u011bn\u00ed p\u0159\u00edkaz\u016f z uzlu. <\/p>\n<blockquote><p>V kart\u011b \u00fatoku v PT NAD jsou zobrazeny \u00fadaje o pou\u017eit\u00fdch taktik\u00e1ch a technik\u00e1ch podle matice ATT&amp;CK, aby u\u017eivatel mohl pochopit, v jak\u00e9 f\u00e1zi \u00fatoku se nach\u00e1zej\u00ed \u00fato\u010dn\u00edci, jak\u00e9 c\u00edle sleduj\u00ed a jak\u00e1 protiopat\u0159en\u00ed podniknout. <\/p><\/blockquote>\n<p>\n<img decoding=\"async\" alt=\"Jak syst\u00e9my anal\u00fdzy provozu detekuj\u00ed taktiky hacker\u016f podle MITRE ATT&amp;CK na p\u0159\u00edkladu PT Network Attack Discovery\" src=\"\/wp-content\/uploads\/2020\/03\/cef63cd458947bf4b4a7735a44362f30.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Vyvol\u00e1n\u00ed pravidla o pou\u017eit\u00ed n\u00e1stroje PSExec, co\u017e m\u016f\u017ee nazna\u010dovat pokus o prov\u00e1d\u011bn\u00ed p\u0159\u00edkaz\u016f na vzd\u00e1len\u00e9m stroji<\/i><\/p>\n<h3>10. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1072\/\">T1072<\/a><\/noindex>: t\u0159et\u00ed strany<\/h3>\n<p>\nTechnika, p\u0159i kter\u00e9 \u00fato\u010dn\u00edci z\u00edsk\u00e1vaj\u00ed p\u0159\u00edstup k software pro vzd\u00e1len\u00e9 administraci nebo podnikov\u00e9 syst\u00e9mov\u00e9 nasazen\u00ed softwaru a s jejich pomoc\u00ed spou\u0161t\u011bj\u00ed \u0161kodliv\u00fd k\u00f3d. P\u0159\u00edklady takov\u00e9ho softwaru: SCCM, VNC, TeamViewer, HBSS, Altiris. <br \/>\nMimochodem, tato technika je obzvl\u00e1\u0161\u0165 aktu\u00e1ln\u00ed v souvislosti s masov\u00fdm p\u0159echodem na vzd\u00e1lenou pr\u00e1ci a v d\u016fsledku toho p\u0159ipojov\u00e1n\u00edm mnoha dom\u00e1c\u00edch nezabezpe\u010den\u00fdch za\u0159\u00edzen\u00ed p\u0159es pochybn\u00e1 vzd\u00e1len\u00e1 p\u0159ipojen\u00ed.<\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: automaticky identifikuje v s\u00edti provoz takov\u00e9ho softwaru. Nap\u0159\u00edklad pravidla se spou\u0161t\u011bj\u00ed na z\u00e1klad\u011b p\u0159ipojen\u00ed p\u0159es protokol VNC a aktivitu trojsk\u00e9ho kon\u011b EvilVNC, kter\u00fd skryt\u011b instaluje VNC server na hostitele ob\u011bti a automaticky ho spou\u0161t\u00ed. Tak\u00e9 PT NAD automaticky ur\u010duje protokol TeamViewer, co\u017e analytikovi pom\u00e1h\u00e1 pomoc\u00ed filtru naj\u00edt v\u0161echny tyto sezen\u00ed a zkontrolovat jejich legitimnost.<\/p>\n<h3>11. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1204\/\">T1204<\/a><\/noindex>: proveden\u00ed u\u017eivatelem<\/h3>\n<p>\nTechnika, p\u0159i kter\u00e9 u\u017eivatel spou\u0161t\u00ed soubory, kter\u00e9 mohou v\u00e9st k proveden\u00ed k\u00f3du. To m\u016f\u017ee b\u00fdt nap\u0159\u00edklad, kdy\u017e otev\u0159e spustiteln\u00fd soubor nebo spust\u00ed kancel\u00e1\u0159sk\u00fd dokument s makrem.<\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: vid\u00ed takov\u00e9 soubory ji\u017e ve f\u00e1zi p\u0159enosu, p\u0159ed jejich spu\u0161t\u011bn\u00edm. Informace o nich lze prozkoumat v kart\u011b sezen\u00ed, ve kter\u00fdch byly p\u0159ed\u00e1v\u00e1ny.<\/p>\n<h3>12. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1047\">T1047<\/a><\/noindex>: Windows Management Instrumentation<\/h3>\n<p>\nPou\u017eit\u00ed n\u00e1stroje WMI, kter\u00fd umo\u017e\u0148uje m\u00edstn\u00ed a vzd\u00e1len\u00fd p\u0159\u00edstup k syst\u00e9mov\u00fdm komponent\u016fm Windows. Pomoc\u00ed WMI mohou \u00fato\u010dn\u00edci interagovat s m\u00edstn\u00edmi a vzd\u00e1len\u00fdmi syst\u00e9my a vykon\u00e1vat \u0159adu \u00fakol\u016f, jako nap\u0159\u00edklad shroma\u017e\u010fov\u00e1n\u00ed informac\u00ed za \u00fa\u010delem pr\u016fzkumu a vzd\u00e1len\u00e9 spou\u0161t\u011bn\u00ed proces\u016f p\u0159i horizont\u00e1ln\u00edm pohybu.<\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: proto\u017ee interakce se vzd\u00e1len\u00fdmi syst\u00e9my p\u0159es WMI jsou viditeln\u00e9 v provozu, PT NAD automaticky detekuje s\u00ed\u0165ov\u00e9 po\u017eadavky na ustanoven\u00ed WMI relac\u00ed a kontroluje provoz na p\u0159\u00edtomnost p\u0159enosu skript\u016f, kter\u00e9 pou\u017e\u00edvaj\u00ed WMI.<\/p>\n<h3>13. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1028\">T1028<\/a><\/noindex>: Windows Remote Management <\/h3>\n<p>\nPou\u017eit\u00ed slu\u017eby a protokolu Windows, kter\u00fd umo\u017e\u0148uje u\u017eivateli interakci se vzd\u00e1len\u00fdmi syst\u00e9my. <\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: vid\u00ed s\u00ed\u0165ov\u00e1 spojen\u00ed, kter\u00e1 byla zalo\u017eena pomoc\u00ed Windows Remote Management. Takov\u00e9 relace jsou detekov\u00e1ny automaticky pravidly. <\/p>\n<h3>14. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1220\/\">T1220<\/a><\/noindex>: zpracov\u00e1n\u00ed skript\u016f XSL (Extensible Stylesheet Language)<\/h3>\n<p>\nJazyk styl\u016f XSL se pou\u017e\u00edv\u00e1 k popisu zpracov\u00e1n\u00ed a vizualizace dat v XML souborech. Pro podporu slo\u017eit\u011bj\u0161\u00edch operac\u00ed zahrnuje standard XSL podporu vestav\u011bn\u00fdch skript\u016f v r\u016fzn\u00fdch jazyc\u00edch. Tyto jazyky umo\u017e\u0148uj\u00ed prov\u00e1d\u011bt libovoln\u00fd k\u00f3d, co\u017e vede k obch\u00e1zen\u00ed bezpe\u010dnostn\u00edch politik zalo\u017een\u00fdch na whitelistu. <\/p>\n<p><b>Co d\u011bl\u00e1 PT NAD<\/b>: detekuje p\u0159\u00edpady p\u0159enosu takov\u00fdch soubor\u016f p\u0159es s\u00ed\u0165, tedy je\u0161t\u011b p\u0159ed jejich spu\u0161t\u011bn\u00edm. Automaticky detekuje p\u0159enos XSL soubor\u016f p\u0159es s\u00ed\u0165 a soubory s anom\u00e1ln\u00ed XSL zna\u010dkov\u00e1n\u00edm.<\/p>\n<p>V n\u00e1sleduj\u00edc\u00edch materi\u00e1lech se pod\u00edv\u00e1me na to, jak NTA syst\u00e9m PT Network Attack Discovery identifikuje dal\u0161\u00ed taktiky a techniky \u00fato\u010dn\u00edk\u016f podle MITRE ATT&amp;CK. Z\u016fsta\u0148te s n\u00e1mi!<\/p>\n<p><b>Auto\u0159i<\/b>: <\/p>\n<ul>\n<li>Anton Kutepev, expert z bezpe\u010dnostn\u00edho centra (PT Expert Security Center) Positive Technologies<\/li>\n<li>Natalia Kazankova, produktov\u00e1 marketerka Positive Technologies<\/li>\n<\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/pt\/blog\/493082\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e Verizon, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e (87%) \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432 \u0418\u0411 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u044f\u0442 \u0437\u0430 \u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0435 \u043c\u0438\u043d\u0443\u0442\u044b, \u0430 \u043d\u0430 \u0438\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0443 68% \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0443\u0445\u043e\u0434\u044f\u0442 \u043c\u0435\u0441\u044f\u0446\u044b. \u042d\u0442\u043e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435\u043c Ponemon Institute, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u0443 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0443\u0445\u043e\u0434\u0438\u0442 \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u043c 206 \u0434\u043d\u0435\u0439 \u043d\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430. \u041f\u043e \u043e\u043f\u044b\u0442\u0443 \u043d\u0430\u0448\u0438\u0445 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439, \u0445\u0430\u043a\u0435\u0440\u044b \u043c\u043e\u0433\u0443\u0442 \u0433\u043e\u0434\u0430\u043c\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438 \u043d\u0435 \u0431\u044b\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c\u0438. \u0422\u0430\u043a, \u0432 \u043e\u0434\u043d\u043e\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":76040,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-76039","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e MITRE ATT&amp;CK \u043d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 PT Network Attack Discovery | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-03-30T11:43:09+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-30T11:43:09+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Jak syst\u00e9my anal\u00fdzy provozu detekuj\u00ed taktiky hacker\u016f podle MITRE ATT&amp;CK na p\u0159\u00edkladu PT Network Attack Discovery | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e MITRE ATT&amp;CK \u043d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 PT Network Attack Discovery | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-30T11:43:09+00:00","article:modified_time":"2020-03-30T11:43:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"76039","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:44:27","updated":"2022-09-27 21:17:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/76039","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=76039"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/76039\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/76040"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=76039"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=76039"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=76039"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}