{"id":31289,"date":"2019-10-31T21:40:29","date_gmt":"2019-10-31T18:40:29","guid":{"rendered":"https:\/\/prohoster.info\/blog\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\/"},"modified":"2019-10-31T21:40:29","modified_gmt":"2019-10-31T18:40:29","slug":"chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","title":{"rendered":"Mit hasznot h\u00fazhatunk a Windows alap\u00fa munka\u00e1llom\u00e1s napl\u00f3ib\u00f3l?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>A felhaszn\u00e1l\u00f3i munka\u00e1llom\u00e1s a legsebezhet\u0151bb pont az inform\u00e1ci\u00f3s biztons\u00e1g ter\u00e9n az infrastrukt\u00far\u00e1ban. A felhaszn\u00e1l\u00f3k a munkahelyi postafi\u00f3kjukban kaphatnak olyan levelet, amely l\u00e1tsz\u00f3lag biztons\u00e1gos forr\u00e1sb\u00f3l \u00e9rkezik, de egy fert\u0151z\u00f6tt weboldalra mutat\u00f3 linket tartalmaz. El\u0151fordulhat, hogy valaki egy, a munk\u00e1hoz hasznos eszk\u00f6zt t\u00f6lt le ismeretlen helyr\u0151l. Sz\u00e1mos forgat\u00f3k\u00f6nyvet lehet kital\u00e1lni arra, hogyan juthat be a k\u00e1rt\u00e9kony szoftver a v\u00e1llalati er\u0151forr\u00e1sokba a felhaszn\u00e1l\u00f3kon kereszt\u00fcl. Ez\u00e9rt a munka\u00e1llom\u00e1sok fokozott figyelmet ig\u00e9nyelnek, \u00e9s a cikkben arr\u00f3l besz\u00e9l\u00fcnk, honnan \u00e9s milyen esem\u00e9nyeket \u00e9rdemes figyelemmel k\u00eds\u00e9rni a t\u00e1mad\u00e1sok nyomon k\u00f6vet\u00e9s\u00e9hez.<\/p>\n<p><img decoding=\"async\" alt=\"Mit hasznot h\u00fazhatunk a Windows alap\u00fa munka\u00e1llom\u00e1s napl\u00f3ib\u00f3l?\" src=\"\/wp-content\/uploads\/2019\/04\/6e0eddfc90ae158b3d532a6b7a069177.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>A t\u00e1mad\u00e1s legkor\u00e1bbi szakasz\u00e1nak \u00e9szlel\u00e9s\u00e9re a Windows oper\u00e1ci\u00f3s rendszerben h\u00e1rom hasznos esem\u00e9nyforr\u00e1s \u00e1ll rendelkez\u00e9sre: a biztons\u00e1gi esem\u00e9nynapl\u00f3, a rendszerfigyel\u0151 napl\u00f3 \u00e9s a Power Shell napl\u00f3k.<\/p>\n<h2>Biztons\u00e1gi esem\u00e9nynapl\u00f3 (Security Log)<\/h2>\n<p>\nEz a legfontosabb hely a rendszer biztons\u00e1gi napl\u00f3inak t\u00e1rol\u00e1s\u00e1ra. Itt gy\u0171lnek \u00f6ssze a felhaszn\u00e1l\u00f3i be- \u00e9s kijelentkez\u00e9si esem\u00e9nyek, az objektumokhoz val\u00f3 hozz\u00e1f\u00e9r\u00e9sek, a politik\u00e1k m\u00f3dos\u00edt\u00e1sa \u00e9s m\u00e1s, a biztons\u00e1ggal kapcsolatos tev\u00e9kenys\u00e9gek. Term\u00e9szetesen, ha a megfelel\u0151 politika be van \u00e1ll\u00edtva.<\/p>\n<p><img decoding=\"async\" alt=\"Mit hasznot h\u00fazhatunk a Windows alap\u00fa munka\u00e1llom\u00e1s napl\u00f3ib\u00f3l?\" src=\"\/wp-content\/uploads\/2019\/04\/82e59ad17a09a8211dc6fe9737208fd7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Felhaszn\u00e1l\u00f3k \u00e9s csoportok felfedez\u00e9se (4798-as \u00e9s 4799-es esem\u00e9nyek).<\/b> A k\u00e1rt\u00e9kony szoftver a t\u00e1mad\u00e1s elej\u00e9n gyakran \u00e1tn\u00e9zi a helyi felhaszn\u00e1l\u00f3i fi\u00f3kokat \u00e9s helyi csoportokat a munka\u00e1llom\u00e1son, hogy megtal\u00e1lja a hiteles\u00edt\u0151 adatokat s\u00f6t\u00e9t \u00fcgyeinek lebonyol\u00edt\u00e1s\u00e1hoz. Ezek az esem\u00e9nyek seg\u00edthetnek a k\u00e1rt\u00e9kony k\u00f3d korai felfedez\u00e9s\u00e9ben, m\u00e9g miel\u0151tt az tov\u00e1bbhaladhatna \u00e9s az \u00f6sszegy\u0171jt\u00f6tt adatok seg\u00edts\u00e9g\u00e9vel elterjedne m\u00e1s rendszerekre.<\/p>\n<p><b>Helyi felhaszn\u00e1l\u00f3i fi\u00f3k l\u00e9trehoz\u00e1sa \u00e9s m\u00f3dos\u00edt\u00e1sok a helyi csoportokban (4720, 4722\u20134726, 4738, 4740, 4767, 4780, 4781, 4794, 5376 \u00e9s 5377 esem\u00e9nyek).<\/b> A t\u00e1mad\u00e1s p\u00e9ld\u00e1ul \u00faj felhaszn\u00e1l\u00f3 hozz\u00e1ad\u00e1s\u00e1val is kezd\u0151dhet a helyi rendszergazd\u00e1k csoportj\u00e1hoz.<\/p>\n<p><b>K\u00eds\u00e9rletek bejelentkez\u00e9sre helyi felhaszn\u00e1l\u00f3i fi\u00f3kkal (4624-es esem\u00e9ny).<\/b> A j\u00f3hiszem\u0171 felhaszn\u00e1l\u00f3k domain fi\u00f3kkal jelentkeznek be, \u00edgy a helyi felhaszn\u00e1l\u00f3i fi\u00f3kkal val\u00f3 bejelentkez\u00e9s \u00e9szlel\u00e9se a t\u00e1mad\u00e1s kezdet\u00e9t jelentheti. A 4624-es esem\u00e9ny tartalmazza a domain fi\u00f3kkal val\u00f3 bejelentkez\u00e9seket is, ez\u00e9rt az esem\u00e9nyek feldolgoz\u00e1sa sor\u00e1n sz\u0171rni kell azokat az esem\u00e9nyeket, ahol a domain elt\u00e9r a munka\u00e1llom\u00e1s nev\u00e9t\u0151l.<\/p>\n<p><b>K\u00eds\u00e9rlet bejelentkez\u00e9sre meghat\u00e1rozott fi\u00f3kkal (4648-as esem\u00e9ny).<\/b> Ez akkor fordul el\u0151, amikor a folyamat \"Futtat\u00e1s mint\" (run as) m\u00f3dban fut. Norm\u00e1l m\u0171k\u00f6d\u00e9si k\u00f6r\u00fclm\u00e9nyek k\u00f6z\u00f6tt ilyen nem t\u00f6rt\u00e9nhet, ez\u00e9rt az ilyen esem\u00e9nyeket figyelemmel kell k\u00eds\u00e9rni.<\/p>\n<p><b>Munka\u00e1llom\u00e1s z\u00e1rol\u00e1sa \/ felold\u00e1sa (4800-4803 esem\u00e9nyek).<\/b> Gyan\u00fas esem\u00e9nyek k\u00f6z\u00e9 tartozik minden olyan cselekv\u00e9s, amely a z\u00e1rolt munka\u00e1llom\u00e1son t\u00f6rt\u00e9nt.<\/p>\n<p><b>A t\u0171zfal konfigur\u00e1ci\u00f3s v\u00e1ltoz\u00e1sai (4944-4958 esem\u00e9nyek).<\/b> Nyilv\u00e1nval\u00f3, hogy \u00faj szoftver telep\u00edt\u00e9sekor a t\u0171zfal konfigur\u00e1ci\u00f3s be\u00e1ll\u00edt\u00e1sai megv\u00e1ltozhatnak, ami hamis riaszt\u00e1sokat okozhat. Az ilyen v\u00e1ltoz\u00e1sok ellen\u0151rz\u00e9s\u00e9re a legt\u00f6bb esetben nincs sz\u00fcks\u00e9g, de ha tudunk r\u00f3luk, az hasznos lehet.<\/p>\n<p><b>Plug\u2019n\u2019play eszk\u00f6z\u00f6k csatlakoztat\u00e1sa (6416 esem\u00e9ny \u00e9s csak Windows 10 eset\u00e9n).<\/b> Fontos odafigyelni erre, k\u00fcl\u00f6n\u00f6sen ha a felhaszn\u00e1l\u00f3k \u00e1ltal\u00e1ban nem csatlakoztatnak \u00faj eszk\u00f6z\u00f6ket a munka\u00e1llom\u00e1sukhoz, majd hirtelen csak \u00fagy csatlakoztatnak egyet.<\/p>\n<p>A Windows 9 audit kateg\u00f3ri\u00e1t \u00e9s 50 al-kateg\u00f3ri\u00e1t tartalmaz a finomhangol\u00e1shoz. A legkisebb al-kateg\u00f3ria k\u00e9szlet, amit \u00e9rdemes aktiv\u00e1lni a be\u00e1ll\u00edt\u00e1sokban:<\/p>\n<p><b>Bejelentkez\u00e9s \/ Kijelentkez\u00e9s<\/b><\/p>\n<ul>\n<li>Bejelentkez\u00e9s;<\/li>\n<li>Kijelentkez\u00e9s;<\/li>\n<li>Felhaszn\u00e1l\u00f3i fi\u00f3k z\u00e1rol\u00e1s;<\/li>\n<li>Egy\u00e9b bejelentkez\u00e9si \/ kijelentkez\u00e9si esem\u00e9nyek.<\/li>\n<\/ul>\n<p>\n<b>Fi\u00f3kmenedzsment<\/b><\/p>\n<ul>\n<li>Felhaszn\u00e1l\u00f3i fi\u00f3k kezel\u00e9se;<\/li>\n<li>Biztons\u00e1gi csoport kezel\u00e9se.<\/li>\n<\/ul>\n<p>\n<b>Politika v\u00e1ltoz\u00e1sa<\/b><\/p>\n<ul>\n<li>Audit politikai v\u00e1ltoz\u00e1sa;<\/li>\n<li>Hiteles\u00edt\u00e9si politika v\u00e1ltoz\u00e1sa;<\/li>\n<li>Hozz\u00e1f\u00e9r\u00e9si politika v\u00e1ltoz\u00e1sa.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Rendszerfigyel\u0151 (Sysmon)<\/h2>\n<p>\nA Sysmon, a Windows-ba be\u00e9p\u00edtett eszk\u00f6z, k\u00e9pes esem\u00e9nyeket r\u00f6gz\u00edteni a rendszer napl\u00f3ba. \u00c1ltal\u00e1ban k\u00fcl\u00f6n kell telep\u00edteni.<\/p>\n<p><img decoding=\"async\" alt=\"Mit hasznot h\u00fazhatunk a Windows alap\u00fa munka\u00e1llom\u00e1s napl\u00f3ib\u00f3l?\" src=\"\/wp-content\/uploads\/2019\/04\/0b1e14fb9ba4d63a4d9d94bd9d62d112.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nEzeket az esem\u00e9nyeket egy\u00e9bk\u00e9nt megtal\u00e1lhatjuk a biztons\u00e1gi napl\u00f3ban (a sz\u00fcks\u00e9ges audit politika aktiv\u00e1l\u00e1s\u00e1val), de a Sysmon r\u00e9szletesebb inform\u00e1ci\u00f3kat ad. Milyen esem\u00e9nyeket gy\u0171jthet\u00fcnk a Sysmon-b\u00f3l?<\/p>\n<p><b>Folyamat l\u00e9trehoz\u00e1sa (1 esem\u00e9ny ID).<\/b> A biztons\u00e1gi esem\u00e9nynapl\u00f3 is meg tudja mondani, mikor indult el egy *.exe f\u00e1jl, \u00e9s m\u00e9g az nev\u00e9t \u00e9s ind\u00edt\u00e1si \u00fatvonal\u00e1t is megjelen\u00edti. De a Sysmonhoz k\u00e9pest nem tudja megjelen\u00edteni az alkalmaz\u00e1s hash-j\u00e9t. A rosszindulat\u00fa szoftver ak\u00e1r \u00e1rtalmatlan notepad.exe n\u00e9ven is ismerheti, de a hash k\u00e9pes leleplezni azt.<\/p>\n<p><b>H\u00e1l\u00f3zati kapcsolatok (3 esem\u00e9ny ID).<\/b> Nyilv\u00e1nval\u00f3, hogy sok h\u00e1l\u00f3zati kapcsolatra van sz\u00fcks\u00e9g, \u00e9s nem lehet mindet figyelemmel k\u00eds\u00e9rni. Fontos figyelembe venni, hogy a Sysmon, ellent\u00e9tben a biztons\u00e1gi napl\u00f3val, k\u00e9pes a h\u00e1l\u00f3zati kapcsolatokat a ProcessID \u00e9s a ProcessGUID mez\u0151kh\u00f6z kapcsolni, tov\u00e1bb\u00e1 megjelen\u00edti a portot \u00e9s <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/hu\/lir\/ipv4\/\"   title=\"IP address\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"622\">IP address<\/a> a forr\u00e1st \u00e9s a c\u00e9lt.<\/p>\n<p><b>M\u00f3dos\u00edt\u00e1sok a rendszerle\u00edr\u00f3 adatb\u00e1zisban (12-14 esem\u00e9ny ID).<\/b> A legjobb m\u00f3dszer, hogy automatikusan ind\u00edtsd el magad, ha regisztr\u00e1lsz a rendszerle\u00edr\u00f3 adatb\u00e1zisban. A Security Log ezt tudja, de a Sysmon megmutatja, ki, mikor, honnan, a process ID-t \u00e9s a kulcs kor\u00e1bbi \u00e9rt\u00e9k\u00e9t m\u00f3dos\u00edtotta.<\/p>\n<p><b>F\u00e1jl l\u00e9trehoz\u00e1sa (11-es esem\u00e9ny ID).<\/b> A Sysmon, ellent\u00e9tben a Security Log-gal, nemcsak a f\u00e1jl hely\u00e9t, hanem a nev\u00e9t is megmutatja. Nyilv\u00e1nval\u00f3, hogy mindent nem lehet nyomon k\u00f6vetni, de bizonyos k\u00f6nyvt\u00e1rak audit\u00e1l\u00e1sa lehets\u00e9ges.<\/p>\n<p>Most pedig j\u00f6jj\u00f6n az, ami a Security Log politik\u00e1iban nincs, de a Sysmonban megtal\u00e1lhat\u00f3:<\/p>\n<p><b>A f\u00e1jl l\u00e9trehoz\u00e1si id\u0151pontj\u00e1nak megv\u00e1ltoztat\u00e1sa (2-es esem\u00e9ny ID).<\/b> N\u00e9h\u00e1ny k\u00e1rtev\u0151 megv\u00e1ltoztathatja a f\u00e1jl l\u00e9trehoz\u00e1si d\u00e1tum\u00e1t, hogy elrejtse azt a nemr\u00e9g l\u00e9trehozott f\u00e1jlok jelent\u00e9s\u00e9b\u0151l.<\/p>\n<p><b>Illeszt\u0151programok \u00e9s dinamikus k\u00f6nyvt\u00e1rak bet\u00f6lt\u00e9se (6-7-es esem\u00e9ny ID).<\/b> DLL-ek \u00e9s eszk\u00f6zilleszt\u0151k mem\u00f3ri\u00e1ba t\u00f6lt\u00e9s\u00e9nek nyomon k\u00f6vet\u00e9se, digit\u00e1lis al\u00e1\u00edr\u00e1s ellen\u0151rz\u00e9se \u00e9s \u00e9rv\u00e9nyess\u00e9ge.<\/p>\n<p><b>Sz\u00e1l l\u00e9trehoz\u00e1sa egy fut\u00f3 folyamatban (8-as esem\u00e9ny ID).<\/b> Ez az egyik t\u00e1mad\u00e1si forma, amelyre szint\u00e9n figyelni kell.<\/p>\n<p><b>RawAccessRead esem\u00e9nyek (9-es esem\u00e9ny ID).<\/b> Olyan lemezes olvas\u00e1si m\u0171veletek, amelyek a \u201e.\u201d seg\u00edts\u00e9g\u00e9vel t\u00f6rt\u00e9nnek. A legt\u00f6bb esetben ez a tev\u00e9kenys\u00e9g abnormalit\u00e1sk\u00e9nt kell, hogy sz\u00e1m\u00edtson.<\/p>\n<p><b>Nevzett f\u00e1jlfolyam l\u00e9trehoz\u00e1sa (15-\u00f6s esem\u00e9ny ID).<\/b> Az esem\u00e9ny akkor regisztr\u00e1l\u00f3dik, amikor egy n\u00e9vvel ell\u00e1tott f\u00e1jlfolyam j\u00f6n l\u00e9tre, amely a f\u00e1jl tartalm\u00e1nak hash \u00e9rt\u00e9k\u00e9vel esem\u00e9nyeket gener\u00e1l.<\/p>\n<p><b>N\u00e9vcs\u0151 l\u00e9trehoz\u00e1sa \u00e9s csatlakoz\u00e1sok (17-18-as esem\u00e9ny ID).<\/b> K\u00e1rtev\u0151 k\u00f3d nyomon k\u00f6vet\u00e9se, amely n\u00e9vcs\u00f6v\u00f6n kereszt\u00fcl kommunik\u00e1l m\u00e1s \u00f6sszetev\u0151kkel.<\/p>\n<p><b>WMI tev\u00e9kenys\u00e9g (19-es esem\u00e9ny ID).<\/b> Azok az esem\u00e9nyek, amelyek akkor j\u00f6nnek l\u00e9tre, amikor a rendszerhez WMI protokollon kereszt\u00fcl fordulnak.<\/p>\n<p>A Sysmon v\u00e9delme \u00e9rdek\u00e9ben figyelni kell a 4-es ID-j\u00fa esem\u00e9nyeket (Sysmon le\u00e1ll\u00edt\u00e1s \u00e9s ind\u00edt\u00e1s) \u00e9s a 16-os ID-j\u00fa esem\u00e9nyeket (Sysmon konfigur\u00e1ci\u00f3 m\u00f3dos\u00edt\u00e1sa).<\/p>\n<h2>Power Shell napl\u00f3k<\/h2>\n<p>\nA Power Shell egy er\u0151teljes eszk\u00f6z a Windows infrastrukt\u00fara kezel\u00e9s\u00e9re, ez\u00e9rt nagy a val\u00f3sz\u00edn\u0171s\u00e9ge, hogy a t\u00e1mad\u00f3 \u00e9ppen ezt v\u00e1lasztja. A Power Shell esem\u00e9nyeinek adatainak megszerz\u00e9s\u00e9hez k\u00e9t forr\u00e1st haszn\u00e1lhatunk: Windows PowerShell log \u00e9s Microsoft-WindowsPowerShell \/ Operational log.<\/p>\n<h4>Windows PowerShell log<\/h4>\n<p>\n<img decoding=\"async\" alt=\"Mit hasznot h\u00fazhatunk a Windows alap\u00fa munka\u00e1llom\u00e1s napl\u00f3ib\u00f3l?\" src=\"\/wp-content\/uploads\/2019\/04\/03d830871fc2c47ceeb8f0822f3f20e0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Adatszolg\u00e1ltat\u00f3 bet\u00f6ltve (600-as esem\u00e9ny ID).<\/b> A PowerShell provider is a program that serves as a data source for PowerShell to view and manage. For example, built-in providers might include Windows environment variables or the system registry. It's important to monitor for new providers to promptly identify malicious activity. For instance, if you see that WSMan has appeared among the providers, it means a remote PowerShell session has started.<\/p>\n<h4>Microsoft-WindowsPowerShell \/ Operational log (or MicrosoftWindows-PowerShellCore \/ Operational in PowerShell 6)<\/h4>\n<p>\n<img decoding=\"async\" alt=\"Mit hasznot h\u00fazhatunk a Windows alap\u00fa munka\u00e1llom\u00e1s napl\u00f3ib\u00f3l?\" src=\"\/wp-content\/uploads\/2019\/04\/d0a1a74aad59c7c4f64446b52846429f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Module logging (Event ID 4103).<\/b> Events store information about each executed command and the parameters with which it was invoked.<\/p>\n<p><b>Script block logging (Event ID 4104).<\/b> Script block logging shows every executed block of PowerShell code. Even if an attacker tries to hide a command, this type of event will reveal the actual executed PowerShell command. Additionally, this type of event may record some low-level API calls; these events are usually logged as Verbose, but if a suspicious command or script is used in the code block, it will be logged with a severity of Warning.<\/p>\n<p>Note that after setting up the tool for collecting and analyzing these events, additional time will be needed for debugging to reduce false positives.<\/p>\n<p>Please share in the comments what logs you collect for information security auditing and what tools you use for this. One of our focuses is solutions for auditing information security events. To address the task of collecting and analyzing logs, we can suggest looking into <noindex><a rel=\"nofollow\" href=\"https:\/\/www.quest.com\/products\/intrust\/\">Quest InTrust<\/a><\/noindex>, which can compress stored data at a ratio of 20:1, and a single installed instance can process up to 60,000 events per second from 10,000 sources.<br \/>\n<br \/>Forr\u00e1s: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447522\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0439\u0442\u0438 \u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u043f\u043e\u0447\u0442\u0443 \u043f\u0438\u0441\u044c\u043c\u043e \u0432\u0440\u043e\u0434\u0435 \u0431\u044b \u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043d\u043e \u0441\u043e \u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0439 \u0441\u0430\u0439\u0442. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043a\u0442\u043e-\u0442\u043e \u0441\u043a\u0430\u0447\u0430\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0438\u0437 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043a\u0430\u043a\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430. \u0414\u0430 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c \u043d\u0435 \u043e\u0434\u0438\u043d \u0434\u0435\u0441\u044f\u0442\u043e\u043a \u043a\u0435\u0439\u0441\u043e\u0432, \u043a\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23255,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31289","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"hu_HU\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0427\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421 Windows | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:40:29+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:40:29+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47What valuable information can be extracted from Windows OS workstation logs | ProHoster","description":"The user workstation is the most vulnerable part of the infrastructure in terms of information security.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421 Windows | ProHoster","og:description":"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:40:29+00:00","article:modified_time":"2019-10-31T18:40:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31289","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:25:31","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:19:49","updated":"2026-02-08 20:25:31","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/31289","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=31289"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/31289\/revisions"}],"predecessor-version":[{"id":157813,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/31289\/revisions\/157813"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/23255"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=31289"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=31289"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=31289"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}