{"id":90735,"date":"2020-08-05T13:42:06","date_gmt":"2020-08-05T11:42:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust"},"modified":"2020-08-05T13:42:06","modified_gmt":"2020-08-05T11:42:06","slug":"vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","title":{"rendered":"Aktivujeme shroma\u017e\u010fov\u00e1n\u00ed ud\u00e1lost\u00ed o spu\u0161t\u011bn\u00ed podez\u0159el\u00fdch proces\u016f ve Windows a odhalujeme hrozby pomoc\u00ed Quest InTrust.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Aktivujeme shroma\u017e\u010fov\u00e1n\u00ed ud\u00e1lost\u00ed o spu\u0161t\u011bn\u00ed podez\u0159el\u00fdch proces\u016f ve Windows a odhalujeme hrozby pomoc\u00ed Quest InTrust.\" src=\"\/wp-content\/uploads\/2020\/08\/6377476bf0527b75b61e174ed9915c07.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJedn\u00edm z \u010dasto se vyskytuj\u00edc\u00edch typ\u016f \u00fatok\u016f je generov\u00e1n\u00ed \u0161kodliv\u00e9ho procesu v r\u00e1mci zcela \u0159\u00e1dn\u00fdch proces\u016f. Podez\u0159en\u00ed m\u016f\u017ee vzbudit cesta k spustiteln\u00e9mu souboru: \u010dasto \u0161kodliv\u00fd software pou\u017e\u00edv\u00e1 slo\u017eky AppData nebo Temp, co\u017e nen\u00ed charakteristick\u00e9 pro legitimn\u00ed programy. Spravedlnosti se mus\u00ed uznat, \u017ee n\u011bkter\u00e9 automatizovan\u00e9 aktualiza\u010dn\u00ed utility se spou\u0161t\u00ed v AppData, proto pouh\u00e1 kontrola m\u00edsta spu\u0161t\u011bn\u00ed nesta\u010d\u00ed k tvrzen\u00ed, \u017ee program je \u0161kodliv\u00fd.<\/p>\n<p>Dal\u0161\u00edm faktorem legitimity je kryptografick\u00fd podpis: mnoho origin\u00e1ln\u00edch program\u016f je podeps\u00e1no v\u00fdrobcem. \u010cinidlo absence podpisu lze pou\u017e\u00edt jako metodu pro zji\u0161t\u011bn\u00ed podez\u0159el\u00fdch prvk\u016f v autoloadu. Ale op\u011bt existuje \u0161kodliv\u00fd software, kter\u00fd vyu\u017e\u00edv\u00e1 ukraden\u00fd certifik\u00e1t k vlastn\u00edmu podeps\u00e1n\u00ed.<\/p>\n<p>Je tak\u00e9 mo\u017en\u00e9 kontrolovat hodnoty kryptografick\u00fdch hash\u016f MD5 nebo SHA256, kter\u00e9 mohou odpov\u00eddat n\u011bkter\u00fdm d\u0159\u00edve zji\u0161t\u011bn\u00fdm \u0161kodliv\u00fdm program\u016fm. Lze prov\u00e1d\u011bt statickou anal\u00fdzu prohl\u00ed\u017een\u00edm podpis\u016f v programu (pomoc\u00ed pravidel Yara nebo antivirov\u00fdch produkt\u016f). Existuje i dynamick\u00e1 anal\u00fdza (spu\u0161t\u011bn\u00ed programu v bezpe\u010dn\u00e9m prost\u0159ed\u00ed a sledov\u00e1n\u00ed jeho chov\u00e1n\u00ed) a reverzn\u00ed in\u017een\u00fdrstv\u00ed.<\/p>\n<p>Existuje mnoho znak\u016f \u0161kodliv\u00e9ho procesu. V tomto \u010dl\u00e1nku se pod\u00edv\u00e1me, jak povolit audit p\u0159\u00edslu\u0161n\u00fdch ud\u00e1lost\u00ed ve Windows, a probereme znaky, na kter\u00e9 se spol\u00e9h\u00e1 vestav\u011bn\u00e9 pravidlo <noindex><a rel=\"nofollow\" href=\"https:\/\/gals.software\/vendors\/quest\/intrust\">InTrust<\/a><\/noindex> pro identifikaci podez\u0159el\u00e9ho procesu. InTrust je <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/512908\/\">platforma CLM<\/a><\/noindex> pro sb\u011br, anal\u00fdzu a ukl\u00e1d\u00e1n\u00ed nestrukturovan\u00fdch dat, kter\u00e1 ji\u017e obsahuje stovky p\u0159edem nastaven\u00fdch reakc\u00ed na r\u016fzn\u00e9 typy \u00fatok\u016f.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nP\u0159i spu\u0161t\u011bn\u00ed programu se na\u010dte do pam\u011bti po\u010d\u00edta\u010de. Spustiteln\u00fd soubor obsahuje po\u010d\u00edta\u010dov\u00e9 instrukce a pomocn\u00e9 knihovny (nap\u0159\u00edklad *.dll). Jakmile je proces spu\u0161t\u011bn, m\u016f\u017ee vytv\u00e1\u0159et dal\u0161\u00ed vl\u00e1kna. Vl\u00e1kna umo\u017e\u0148uj\u00ed procesu vykon\u00e1vat r\u016fzn\u00e9 sady instrukc\u00ed sou\u010dasn\u011b. Existuje mnoho zp\u016fsob\u016f, jak se \u0161kodliv\u00fd k\u00f3d dostat do pam\u011bti a spustit se, prozkoumejme n\u011bkter\u00e9 z nich.<\/p>\n<p>Nejjednodu\u0161\u0161\u00ed zp\u016fsob, jak spustit \u0161kodliv\u00fd proces, je p\u0159im\u011bt u\u017eivatele, aby jej spustil p\u0159\u00edmo (nap\u0159\u00edklad z p\u0159\u00edlohy e-mailu), a pot\u00e9 pomoc\u00ed kl\u00ed\u010de RunOnce jej spou\u0161t\u011bt p\u0159i ka\u017ed\u00e9m zapnut\u00ed po\u010d\u00edta\u010de. Sem pat\u0159\u00ed tak\u00e9 \"bezsouborov\u00fd\" malware, kter\u00fd ukl\u00e1d\u00e1 PowerShell skripty v registrech, kter\u00e9 se spou\u0161t\u011bj\u00ed na z\u00e1klad\u011b spou\u0161t\u011b\u010de. V tomto p\u0159\u00edpad\u011b je PowerShell skript \u0161kodliv\u00fdm k\u00f3dem.<\/p>\n<p>Probl\u00e9m s explicitn\u00edm spou\u0161t\u011bn\u00edm \u0161kodliv\u00e9ho software je ten, \u017ee se jedn\u00e1 o zn\u00e1m\u00fd p\u0159\u00edstup, kter\u00fd se snadno odhaluje. N\u011bkter\u00e9 \u0161kodliv\u00e9 programy prov\u00e1d\u011bj\u00ed mazan\u011bj\u0161\u00ed taktiky, nap\u0159\u00edklad pou\u017e\u00edvaj\u00ed jin\u00fd proces, aby mohly za\u010d\u00edt b\u011b\u017eet v pam\u011bti. V d\u016fsledku toho m\u016f\u017ee proces vytvo\u0159it jin\u00fd proces spu\u0161t\u011bn\u00edm ur\u010dit\u00e9 po\u010d\u00edta\u010dov\u00e9 instrukce a ur\u010den\u00edm spustiteln\u00e9ho souboru (.exe) k rozb\u011bhu.<\/p>\n<p>Soubor lze zadat pomoc\u00ed pln\u00e9 cesty (nap\u0159\u00edklad C:Windowssystem32cmd.exe) nebo zkr\u00e1cen\u011b (nap\u0159\u00edklad cmd.exe). Pokud je zdrojov\u00fd proces nebezpe\u010dn\u00fd, umo\u017en\u00ed spou\u0161t\u011bn\u00ed nelegitimn\u00edch program\u016f. \u00datok m\u016f\u017ee vypadat takto: proces spust\u00ed cmd.exe bez uveden\u00ed pln\u00e9 cesty, \u00fato\u010dn\u00edk um\u00edst\u00ed svou vlastn\u00ed verzi cmd.exe do takov\u00e9ho m\u00edsta, aby proces spustil jeho p\u0159ed leg\u00e1ln\u00edm. Po spu\u0161t\u011bn\u00ed \u0161kodliv\u00e9ho programu m\u016f\u017ee on s\u00e1m spustit leg\u00e1ln\u00ed program (nap\u0159\u00edklad C:Windowssystem32cmd.exe), aby p\u016fvodn\u00ed aplikace pokra\u010dovala ve spr\u00e1vn\u00e9m fungov\u00e1n\u00ed.<\/p>\n<p>Varianta p\u0159edchoz\u00edho \u00fatoku \u2014 DLL injekce do legitimn\u00edho procesu. Kdy\u017e je proces spu\u0161t\u011bn, vyhled\u00e1v\u00e1 a na\u010d\u00edt\u00e1 knihovny, kter\u00e9 roz\u0161i\u0159uj\u00ed jeho funk\u010dnost. Pomoc\u00ed DLL injekce \u00fato\u010dn\u00edk vytv\u00e1\u0159\u00ed \u0161kodlivou knihovnu se stejn\u00fdm n\u00e1zvem a API jako ta legitimn\u00ed. Program na\u010d\u00edt\u00e1 \u0161kodlivou knihovnu a ta n\u00e1sledn\u011b na\u010d\u00edt\u00e1 legitimn\u00ed, a podle pot\u0159eby pro vykon\u00e1n\u00ed operac\u00ed ji vyvol\u00e1v\u00e1. \u0160kodliv\u00e1 knihovna za\u010d\u00edn\u00e1 vykon\u00e1vat roli proxy pro dobrou knihovnu.<\/p>\n<p>Jin\u00fd zp\u016fsob, jak um\u00edstit \u0161kodliv\u00fd k\u00f3d do pam\u011bti, je vlo\u017eit ho do nezabezpe\u010den\u00e9ho procesu, kter\u00fd ji\u017e b\u011b\u017e\u00ed. Procesy p\u0159ij\u00edmaj\u00ed vstupy z r\u016fzn\u00fdch zdroj\u016f \u2013 \u010dtou z internetu nebo soubor\u016f. Obvykle prov\u00e1d\u011bj\u00ed kontrolu, aby zajistily legitimitu vstupn\u00edch dat. Ale n\u011bkter\u00e9 procesy nemaj\u00ed dostate\u010dnou ochranu p\u0159i vykon\u00e1v\u00e1n\u00ed instrukc\u00ed. P\u0159i takov\u00e9m \u00fatoku neexistuje \u017e\u00e1dn\u00e1 knihovna na disku nebo spustiteln\u00fd soubor se \u0161kodliv\u00fdm k\u00f3dem. V\u0161echno je ulo\u017eeno v pam\u011bti spolu se zneu\u017e\u00edvan\u00fdm procesem.<\/p>\n<p>Nyn\u00ed se pod\u00edv\u00e1me na metodu zahrnut\u00ed sb\u011bru podobn\u00fdch ud\u00e1lost\u00ed ve Windows a na pravidlo v InTrust, kter\u00e9 implementuje ochranu proti podobn\u00fdm hrozb\u00e1m. Nejprve jej aktivujeme prost\u0159ednictv\u00edm konzole pro spr\u00e1vu InTrust.<\/p>\n<p><img decoding=\"async\" alt=\"Aktivujeme shroma\u017e\u010fov\u00e1n\u00ed ud\u00e1lost\u00ed o spu\u0161t\u011bn\u00ed podez\u0159el\u00fdch proces\u016f ve Windows a odhalujeme hrozby pomoc\u00ed Quest InTrust.\" src=\"\/wp-content\/uploads\/2020\/08\/3ffc159a9b220c56b288256b286fdd8d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPravidlo vyu\u017e\u00edv\u00e1 mo\u017enosti sledov\u00e1n\u00ed proces\u016f opera\u010dn\u00edho syst\u00e9mu Windows. Bohu\u017eel aktivace sb\u011bru t\u011bchto ud\u00e1lost\u00ed nen\u00ed v\u016fbec z\u0159ejm\u00e1. Je pot\u0159eba zm\u011bnit 3 r\u016fzn\u00e9 nastaven\u00ed skupinov\u00e9 politiky:<\/p>\n<p><b>Konfigurace po\u010d\u00edta\u010de &gt; Politiky &gt; Nastaven\u00ed Windows &gt; Bezpe\u010dnostn\u00ed nastaven\u00ed &gt; M\u00edstn\u00ed politiky &gt; Politika auditu &gt; Auditov\u00e1n\u00ed sledov\u00e1n\u00ed proces\u016f<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Aktivujeme shroma\u017e\u010fov\u00e1n\u00ed ud\u00e1lost\u00ed o spu\u0161t\u011bn\u00ed podez\u0159el\u00fdch proces\u016f ve Windows a odhalujeme hrozby pomoc\u00ed Quest InTrust.\" src=\"\/wp-content\/uploads\/2020\/08\/03abc319d24bf82dbf9c728b6b37c794.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Konfigurace po\u010d\u00edta\u010de &gt; Politiky &gt; Nastaven\u00ed Windows &gt; Bezpe\u010dnostn\u00ed nastaven\u00ed &gt; Pokro\u010dil\u00e1 konference politiky auditu &gt; Politiky auditu &gt; Podrobn\u00e9 sledov\u00e1n\u00ed &gt; Auditov\u00e1n\u00ed vytv\u00e1\u0159en\u00ed proces\u016f<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Aktivujeme shroma\u017e\u010fov\u00e1n\u00ed ud\u00e1lost\u00ed o spu\u0161t\u011bn\u00ed podez\u0159el\u00fdch proces\u016f ve Windows a odhalujeme hrozby pomoc\u00ed Quest InTrust.\" src=\"\/wp-content\/uploads\/2020\/08\/3b017dc39789d55ae478e70e0034bd73.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Konfigurace po\u010d\u00edta\u010de &gt; Politiky &gt; \u0160ablony pro spr\u00e1vu &gt; Syst\u00e9m &gt; Auditov\u00e1n\u00ed vytv\u00e1\u0159en\u00ed proces\u016f &gt; Zahrnout p\u0159\u00edkazov\u00fd \u0159\u00e1dek do ud\u00e1lost\u00ed vytv\u00e1\u0159en\u00ed proces\u016f<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Aktivujeme shroma\u017e\u010fov\u00e1n\u00ed ud\u00e1lost\u00ed o spu\u0161t\u011bn\u00ed podez\u0159el\u00fdch proces\u016f ve Windows a odhalujeme hrozby pomoc\u00ed Quest InTrust.\" src=\"\/wp-content\/uploads\/2020\/08\/13122278bc9ab6f7f6ff982654ce6dec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPo aktivaci pravidla InTrust umo\u017e\u0148uj\u00ed odhalovat dosud nezn\u00e1m\u00e9 hrozby, kter\u00e9 vykazuj\u00ed podez\u0159el\u00e9 chov\u00e1n\u00ed. Nap\u0159\u00edklad lze identifikovat <noindex><a rel=\"nofollow\" href=\"https:\/\/www.bromium.com\/dridex-threat-analysis-july-2019-variant\/\">popisovan\u00e9 zde<\/a><\/noindex> \u0161kodliv\u00fd software Dridex. D\u00edky projektu HP Bromium je zn\u00e1mo, jak takov\u00e1 hrozba funguje.<\/p>\n<p><img decoding=\"async\" alt=\"Aktivujeme shroma\u017e\u010fov\u00e1n\u00ed ud\u00e1lost\u00ed o spu\u0161t\u011bn\u00ed podez\u0159el\u00fdch proces\u016f ve Windows a odhalujeme hrozby pomoc\u00ed Quest InTrust.\" src=\"\/wp-content\/uploads\/2020\/08\/cbc09c039a088a3b6737d2d467c6a2ac.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVe sv\u00e9m postupu Dridex pou\u017e\u00edv\u00e1 schtasks.exe k vytvo\u0159en\u00ed napl\u00e1novan\u00e9 \u00falohy. Pou\u017eit\u00ed t\u00e9to utility z p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku se pova\u017euje za velmi podez\u0159el\u00e9 chov\u00e1n\u00ed, podobn\u00e9 jako spu\u0161t\u011bn\u00ed svchost.exe s parametry, kter\u00e9 ukazuj\u00ed na u\u017eivatelsk\u00e9 slo\u017eky, nebo s parametry, kter\u00e9 p\u0159ipom\u00ednaj\u00ed p\u0159\u00edkazy \u201enet view\u201c nebo \u201ewhoami\u201c. Tady je \u00faryvek odpov\u00eddaj\u00edc\u00edho <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Neo23x0\/sigma\/blob\/master\/rules\/windows\/process_creation\/win_malware_dridex.yml\">pravidla SIGMA<\/a><\/noindex>:<\/p>\n<pre><code class=\"xml\">detection:\n    selection1:\n        CommandLine: '*svchost.exe C:Users\\*Desktop\\*'\n    selection2:\n        ParentImage: '*svchost.exe*'\n        CommandLine:\n            - '*whoami.exe \/all'\n            - '*net.exe view'\n    condition: 1 of them<\/code><\/pre>\n<p>\nV InTrust je ve\u0161ker\u00e9 podez\u0159el\u00e9 chov\u00e1n\u00ed zahrnuto do jedn\u00e9 pravidla, proto\u017ee v\u011bt\u0161ina t\u011bchto akc\u00ed nen\u00ed specifick\u00e1 pro konkr\u00e9tn\u00ed hrozbu, ale sp\u00ed\u0161e je podez\u0159el\u00e1 v celku a v 99 % p\u0159\u00edpad\u016f je pou\u017e\u00edv\u00e1na pro ne zcela u\u0161lechtil\u00e9 \u00fa\u010dely. Tento seznam akc\u00ed zahrnuje, ale nen\u00ed omezen na:<\/p>\n<ul>\n<li>Procesy vykon\u00e1van\u00e9 z neobvykl\u00fdch m\u00edst, jako jsou u\u017eivatelsk\u00e9 do\u010dasn\u00e9 slo\u017eky.<\/li>\n<li>Dob\u0159e zn\u00e1m\u00fd syst\u00e9mov\u00fd proces s podez\u0159el\u00fdm d\u011bdictv\u00edm \u2014 n\u011bkter\u00e9 hrozby se mohou pokusit pou\u017e\u00edt n\u00e1zev syst\u00e9mov\u00fdch proces\u016f, aby z\u016fstaly skryt\u00e9.<\/li>\n<li>Podez\u0159el\u00e9 vykon\u00e1n\u00ed administrativn\u00edch n\u00e1stroj\u016f, jako je cmd nebo PsExec, kdy\u017e pou\u017e\u00edvaj\u00ed p\u0159ihla\u0161ovac\u00ed \u00fadaje m\u00edstn\u00edho syst\u00e9mu nebo podez\u0159el\u00e9 d\u011bdictv\u00ed.<\/li>\n<li>Podez\u0159el\u00e9 operace st\u00ednov\u00e9ho kop\u00edrov\u00e1n\u00ed \u2014 obvykl\u00e9 chov\u00e1n\u00ed ransomwaru p\u0159ed \u0161ifrov\u00e1n\u00edm syst\u00e9mu, zab\u00edjej\u00ed z\u00e1lohy:\n<p> \u2014 P\u0159es vssadmin.exe;<br \/>\n \u2014 P\u0159es WMI.<\/li>\n<li>Registrace dump\u016f cel\u00fdch v\u011btv\u00ed registru.<\/li>\n<li>Horizont\u00e1ln\u00ed pohyb \u0161kodliv\u00e9ho k\u00f3du p\u0159i vzd\u00e1len\u00e9m spu\u0161t\u011bn\u00ed procesu pomoc\u00ed p\u0159\u00edkaz\u016f, jako je at.exe.<\/li>\n<li>Podez\u0159el\u00e9 m\u00edstn\u00ed skupinov\u00e9 operace a dom\u00e9nov\u00e9 operace s pou\u017eit\u00edm net.exe.<\/li>\n<li>Podez\u0159el\u00e9 operace br\u00e1ny firewall pomoc\u00ed netsh.exe.<\/li>\n<li>Podez\u0159el\u00e9 manipulace s ACL.<\/li>\n<li>Pou\u017eit\u00ed BITS pro exfiltraci dat.<\/li>\n<li>Podez\u0159el\u00e9 manipulace s WMI.<\/li>\n<li>Podez\u0159el\u00e9 skriptov\u00e9 p\u0159\u00edkazy.<\/li>\n<li>Pokusy o dumpov\u00e1n\u00ed zabezpe\u010den\u00fdch syst\u00e9mov\u00fdch soubor\u016f.<\/li>\n<\/ul>\n<p>\nKombinovan\u00e9 pravidlo funguje velmi dob\u0159e pro detekci hrozeb, jako jsou RUYK, LockerGoga a dal\u0161\u00ed ransomwary, \u0161kodliv\u00e9 programy a kybernetick\u00e9 n\u00e1stroje. Pravidlo bylo ov\u011b\u0159eno dodavatelem v bojov\u00fdch prost\u0159ed\u00edch, aby se minimalizovaly fale\u0161n\u00e9 poplachy. D\u00edky projektu SIGMA v\u011bt\u0161ina t\u011bchto ukazatel\u016f generuje minim\u00e1ln\u00ed mno\u017estv\u00ed \u0161umov\u00fdch ud\u00e1lost\u00ed.<\/p>\n<p>Jeliko\u017e je v InTrust toto pravidlo monitorov\u00e1n\u00ed, m\u016f\u017eete prov\u00e9st reak\u010dn\u00ed skript jako odpov\u011b\u010f na hrozbu. M\u016f\u017eete pou\u017e\u00edt jeden ze zabudovan\u00fdch skript\u016f nebo vytvo\u0159it sv\u016fj vlastn\u00ed, a InTrust jej automaticky roz\u0161\u00ed\u0159\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Aktivujeme shroma\u017e\u010fov\u00e1n\u00ed ud\u00e1lost\u00ed o spu\u0161t\u011bn\u00ed podez\u0159el\u00fdch proces\u016f ve Windows a odhalujeme hrozby pomoc\u00ed Quest InTrust.\" src=\"\/wp-content\/uploads\/2020\/08\/fca2722b0465152e3de8f655af07bc91.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKrom\u011b toho lze zkontrolovat ve\u0161kerou telemetrii souvisej\u00edc\u00ed s ud\u00e1lost\u00ed: skripty PowerShell, prov\u00e1d\u011bn\u00ed proces\u016f, manipulace s napl\u00e1novan\u00fdmi \u00fakoly, administrativn\u00ed aktivitu WMI a pou\u017e\u00edt je pro postmortem p\u0159i incidentech bezpe\u010dnosti.<\/p>\n<p><img decoding=\"async\" alt=\"Aktivujeme shroma\u017e\u010fov\u00e1n\u00ed ud\u00e1lost\u00ed o spu\u0161t\u011bn\u00ed podez\u0159el\u00fdch proces\u016f ve Windows a odhalujeme hrozby pomoc\u00ed Quest InTrust.\" src=\"\/wp-content\/uploads\/2020\/08\/81ee58b297523002ee26c25bda40f5bb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV InTrust je stovky dal\u0161\u00edch pravidel, mezi nimi\u017e jsou:<\/p>\n<ul>\n<li>Detekce \u00fatoku verzov\u00e1n\u00ed PowerShell \u2014 kdy\u017e n\u011bkdo z\u00e1m\u011brn\u011b pou\u017e\u00edv\u00e1 star\u0161\u00ed verzi PowerShell, proto\u017ee ve star\u0161\u00ed verzi nebyla mo\u017enost auditu prob\u00edhaj\u00edc\u00edho.<\/li>\n<li>Detekce p\u0159ihl\u00e1\u0161en\u00ed s vysok\u00fdmi privilegii \u2014 kdy\u017e \u00fa\u010dty, kter\u00e9 jsou \u010dleny ur\u010dit\u00e9 privilegovan\u00e9 skupiny (nap\u0159\u00edklad dom\u00e9nov\u00ed administr\u00e1to\u0159i), n\u00e1hodn\u011b nebo v d\u016fsledku incident\u016f bezpe\u010dnosti interaktivn\u011b p\u0159ihl\u00e1s\u00ed na pracovn\u00ed stanice.<\/li>\n<\/ul>\n<p>\nInTrust umo\u017e\u0148uje pou\u017e\u00edvat osv\u011bd\u010den\u00e9 bezpe\u010dnostn\u00ed postupy ve form\u011b p\u0159ednastaven\u00fdch pravidel detekce a reakce. A pokud si mysl\u00edte, \u017ee n\u011bco by m\u011blo fungovat jinak \u2014 m\u016f\u017eete si ud\u011blat vlastn\u00ed kopii pravidla a p\u0159izp\u016fsobit ji podle pot\u0159eby. \u017d\u00e1dost o proveden\u00ed pilotn\u00edho testu nebo z\u00edsk\u00e1n\u00ed distribu\u010dn\u00edch verz\u00ed s do\u010dasn\u00fdmi licencemi lze poslat p\u0159es <noindex><a rel=\"nofollow\" href=\"https:\/\/gals.software\/vendors\/quest\/intrust#feedback\">formul\u00e1\u0159 zp\u011btn\u00e9 vazby<\/a><\/noindex> na na\u0161ich webov\u00fdch str\u00e1nk\u00e1ch.<\/p>\n<p>P\u0159ihlaste se k na\u0161emu <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/GalsSoftware\/\">Facebooku<\/a><\/noindex>, kde zve\u0159ej\u0148ujeme stru\u010dn\u00e9 pozn\u00e1mky a zaj\u00edmav\u00e9 odkazy.<\/p>\n<p><b>P\u0159e\u010dt\u011bte si dal\u0161\u00ed na\u0161e \u010dl\u00e1nky na t\u00e9ma informa\u010dn\u00ed bezpe\u010dnosti:<\/b><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/513208\/\">Jak m\u016f\u017ee InTrust pomoci sn\u00ed\u017eit frekvenci ne\u00fasp\u011b\u0161n\u00fdch pokus\u016f o autorizaci p\u0159es RDP.<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/474574\/\">Identifikujeme \u00fatok programu ransomware, z\u00edsk\u00e1me p\u0159\u00edstup ke kontroleru dom\u00e9ny a pokus\u00edme se t\u011bmto \u00fatok\u016fm \u010delit.<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447522\/\">Co u\u017eite\u010dn\u00e9ho lze z\u00edskat z protokol\u016f pracovn\u00edho stanice na b\u00e1zi OS Windows.<\/a><\/noindex> (popul\u00e1rn\u00ed \u010dl\u00e1nek)<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/464333\/\">Sledov\u00e1n\u00ed \u017eivotn\u00edho cyklu u\u017eivatel\u016f bez kle\u0161t\u00ed a izolepy<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447512\/\">A kdo to ud\u011blal? Automatizujeme audit informa\u010dn\u00ed bezpe\u010dnosti.<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/512908\/\">Jak sn\u00ed\u017eit n\u00e1klady na vlastnictv\u00ed SIEM syst\u00e9mu a pro\u010d je pot\u0159eba Central Log Management (CLM)<\/a><\/noindex><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/513714\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u0434\u043d\u0430 \u0438\u0437 \u0447\u0430\u0441\u0442\u043e \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0449\u0438\u0445\u0441\u044f \u0442\u0438\u043f\u043e\u0432 \u0430\u0442\u0430\u043a \u2014 \u043f\u043e\u0440\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u0437\u043b\u043e\u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0432 \u0434\u0435\u0440\u0435\u0432\u0435 \u043f\u043e\u0434 \u0432\u043f\u043e\u043b\u043d\u0435 \u0441\u0435\u0431\u0435 \u0434\u043e\u0431\u0440\u043e\u043f\u043e\u0440\u044f\u0434\u043e\u0447\u043d\u044b\u043c\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c\u0438. \u041f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0435 \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0443\u0442\u044c \u043a \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u043c\u0443 \u0444\u0430\u0439\u043b\u0443: \u0447\u0430\u0441\u0442\u0435\u043d\u044c\u043a\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043f\u0430\u043f\u043a\u0438 AppData \u0438\u043b\u0438 Temp, \u0430 \u044d\u0442\u043e \u043d\u0435\u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u043e \u0434\u043b\u044f \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c. \u0421\u043f\u0440\u0430\u0432\u0435\u0434\u043b\u0438\u0432\u043e\u0441\u0442\u0438 \u0440\u0430\u0434\u0438, \u0441\u0442\u043e\u0438\u0442 \u0441\u043a\u0430\u0437\u0430\u0442\u044c, \u0447\u0442\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u044e\u0442\u0441\u044f \u0432 AppData, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043e\u0434\u043d\u043e\u0439 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043c\u0435\u0441\u0442\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":90736,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-90735","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u0441\u0431\u043e\u0440 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0432 Windows \u0438 \u0432\u044b\u044f\u0432\u043b\u044f\u0435\u043c \u0443\u0433\u0440\u043e\u0437\u044b \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Quest InTrust | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-05T11:42:06+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-05T11:42:06+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zapojujeme sb\u011br ud\u00e1lost\u00ed o spu\u0161t\u011bn\u00ed podez\u0159el\u00fdch proces\u016f ve Windows a odhalujeme hrozby pomoc\u00ed Quest InTrust | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u0441\u0431\u043e\u0440 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0432 Windows \u0438 \u0432\u044b\u044f\u0432\u043b\u044f\u0435\u043c \u0443\u0433\u0440\u043e\u0437\u044b \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Quest InTrust | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-05T11:42:06+00:00","article:modified_time":"2020-08-05T11:42:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90735","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:43:42","updated":"2022-09-29 04:49:36","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/90735","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=90735"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/90735\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/90736"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=90735"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=90735"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=90735"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}