{"id":31289,"date":"2019-10-31T21:40:29","date_gmt":"2019-10-31T18:40:29","guid":{"rendered":"https:\/\/prohoster.info\/blog\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\/"},"modified":"2019-10-31T21:40:29","modified_gmt":"2019-10-31T18:40:29","slug":"chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","title":{"rendered":"Ce informa\u021bii utile pot fi extrase din jurnalele unei sta\u021bii de lucru bazate pe Windows","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Sta\u021bia de lucru utilizatorului este cel mai vulnerabil loc din infrastructur\u0103 \u00een ceea ce prive\u0219te securitatea informa\u021bional\u0103. Utilizatorii pot primi pe e-mailuri de serviciu mesaje care par a proveni dintr-o surs\u0103 sigur\u0103, dar con\u021bin linkuri c\u0103tre site-uri infectate. Este posibil ca cineva s\u0103 descarce un utilitar util dintr-o surs\u0103 necunoscut\u0103. Se pot imagina nenum\u0103rate cazuri \u00een care malware-ul poate p\u0103trunde \u00een resursele interne prin intermediul utilizatorilor. Prin urmare, sta\u021biile de lucru necesit\u0103 o aten\u021bie sporit\u0103, iar \u00een acest articol vom discuta despre sursele \u0219i evenimentele pe care trebuie s\u0103 le monitoriz\u0103m pentru a urm\u0103ri atacurile.<\/p>\n<p><img decoding=\"async\" alt=\"Ce informa\u021bii utile pot fi extrase din jurnalele unei sta\u021bii de lucru bazate pe Windows\" src=\"\/wp-content\/uploads\/2019\/04\/6e0eddfc90ae158b3d532a6b7a069177.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Pentru a identifica un atac \u00een cea mai timpurie etap\u0103, \u00een sistemul de operare Windows exist\u0103 trei surse utile de evenimente: jurnalul de evenimente de securitate, jurnalul de monitorizare a sistemului \u0219i jurnalele PowerShell.<\/p>\n<h2>Jurnalul de evenimente de securitate (Security Log)<\/h2>\n<p>\nAcesta este principalul loc de stocare a jurnalele de securitate ale sistemului. Aici sunt \u00eenregistrate evenimentele de logare\/dezlogin ale utilizatorilor, accesul la obiecte, modific\u0103rile politicilor \u0219i alte activit\u0103\u021bi legate de securitate. Desigur, cu condi\u021bia ca politica corespunz\u0103toare s\u0103 fie configurat\u0103.<\/p>\n<p><img decoding=\"async\" alt=\"Ce informa\u021bii utile pot fi extrase din jurnalele unei sta\u021bii de lucru bazate pe Windows\" src=\"\/wp-content\/uploads\/2019\/04\/82e59ad17a09a8211dc6fe9737208fd7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Enumerarea utilizatorilor \u0219i grupurilor (evenimentele 4798 \u0219i 4799).<\/b> Malware-ul, la \u00eenceputul atacului, verific\u0103 adesea conturile locale de utilizator \u0219i grupurile locale pe sta\u021bia de lucru pentru a g\u0103si acreditive pentru faptele sale necurate. Aceste evenimente pot ajuta la descoperirea codului mali\u021bios \u00eenainte ca acesta s\u0103 avanseze \u0219i, folosind informa\u021biile colectate, s\u0103 se r\u0103sp\u00e2ndeasc\u0103 la alte sisteme.<\/p>\n<p><b>Crearea unui cont local \u0219i modific\u0103ri \u00een grupurile locale (evenimentele 4720, 4722\u20134726, 4738, 4740, 4767, 4780, 4781, 4794, 5376 \u0219i 5377).<\/b> Atacul poate \u00eencepe, de exemplu, prin ad\u0103ugarea unui nou utilizator \u00een grupul administratorilor locali.<\/p>\n<p><b>\u00cencerc\u0103ri de logare cu un cont local (evenimentul 4624).<\/b> Utilizatorii corec\u021bi se conecteaz\u0103 cu un cont de domeniu, iar identificarea unei log\u0103ri cu un cont local poate \u00eensemna \u00eenceputul unui atac. Evenimentul 4624 include, de asemenea, log\u0103rile cu conturi de domeniu, a\u0219a c\u0103, \u00een timpul proces\u0103rii evenimentelor, trebuie filtrate evenimentele \u00een care domeniul difer\u0103 de numele sta\u021biei de lucru.<\/p>\n<p><b>\u00cencercare de logare cu un cont specific (evenimentul 4648).<\/b> Acest lucru se \u00eent\u00e2mpl\u0103 c\u00e2nd procesul este executat \u00een modul \u201eExecutare ca\u201d (run as). \u00cen mod normal, \u00een condi\u021bii de func\u021bionare a sistemului, acest lucru nu ar trebui s\u0103 se \u00eent\u00e2mple, a\u0219a c\u0103 astfel de evenimente trebuie s\u0103 fie monitorizate.<\/p>\n<p><b>Blocheaz\u0103\/Dezbloaz\u0103 sta\u021bia de lucru (evenimente 4800-4803).<\/b> Orice ac\u021biuni care au avut loc pe o sta\u021bie de lucru blocat\u0103 pot fi considerate evenimente suspecte.<\/p>\n<p><b>Modific\u0103ri ale configura\u021biei firewall-ului (evenimente 4944-4958).<\/b> Este evident c\u0103, \u00een timpul instal\u0103rii unui nou software, set\u0103rile de configurare ale firewall-ului se pot schimba, ceea ce va provoca false alerte. \u00cen cele mai multe cazuri, nu este necesar s\u0103 monitoriz\u0103m aceste schimb\u0103ri, dar a fi con\u0219tient de ele nu stric\u0103.<\/p>\n<p><b>Conectarea dispozitivelor Plug\u2019n\u2019play (eveniment 6416 \u0219i doar pentru Windows 10).<\/b> Este important s\u0103 monitoriz\u0103m acest lucru dac\u0103 utilizatorii \u00een mod normal nu conecteaz\u0103 noi dispozitive la sta\u021bia de lucru, iar acum, dintr-o dat\u0103, au conectat unul.<\/p>\n<p>Windows include 9 categorii de audit \u0219i 50 de subcategorii pentru o configurare fin\u0103. Setul minim de subcategorii care ar trebui activat \u00een set\u0103ri este:<\/p>\n<p><b>Autentificare\/Dezautentificare<\/b><\/p>\n<ul>\n<li>Autentificare;<\/li>\n<li>Dezautentificare;<\/li>\n<li>Blocarea contului;<\/li>\n<li>Alte evenimente de autentificare\/dezautentificare.<\/li>\n<\/ul>\n<p>\n<b>Gestionarea conturilor<\/b><\/p>\n<ul>\n<li>Gestionarea contului de utilizator;<\/li>\n<li>Gestionarea grupurilor de securitate.<\/li>\n<\/ul>\n<p>\n<b>Schimbarea politicii<\/b><\/p>\n<ul>\n<li>Schimbarea politicii de audit;<\/li>\n<li>Schimbarea politicii de autentificare;<\/li>\n<li>Schimbarea politicii de autorizare.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Monitorizarea sistemului (Sysmon)<\/h2>\n<p>\nSysmon este un utilitar integrat \u00een Windows care poate \u00eenregistra evenimente \u00een jurnalul sistemului. De obicei, este necesar s\u0103 fie instalat separat.<\/p>\n<p><img decoding=\"async\" alt=\"Ce informa\u021bii utile pot fi extrase din jurnalele unei sta\u021bii de lucru bazate pe Windows\" src=\"\/wp-content\/uploads\/2019\/04\/0b1e14fb9ba4d63a4d9d94bd9d62d112.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAceste evenimente pot fi, \u00een principiu, g\u0103site \u0219i \u00een jurnalul de securitate (activ\u00e2nd politica de audit corespunz\u0103toare), dar Sysmon ofer\u0103 mai multe detalii. Ce evenimente pot fi extrase din Sysmon?<\/p>\n<p><b>Crearea unui proces (ID eveniment 1).<\/b> Jurnalul de evenimente de securitate al sistemului poate spune, de asemenea, c\u00e2nd a fost lansat un anumit *.exe \u0219i poate chiar s\u0103 arate numele \u0219i calea de lansare. Dar, spre deosebire de Sysmon, nu poate ar\u0103ta hash-ul aplica\u021biei. Malware-ul poate purta un nume inofensiv, cum ar fi notepad.exe, dar hash-ul va dezv\u0103lui adev\u0103rata sa identitate.<\/p>\n<p><b>Conexiuni de re\u021bea (ID eveniment 3).<\/b> Este evident c\u0103 sunt multe conexiuni de re\u021bea \u0219i nu este posibil s\u0103 le monitoriz\u0103m pe toate. Dar este important de men\u021bionat c\u0103 Sysmon, spre deosebire de Security Log, poate corela conexiunea de re\u021bea cu c\u00e2mpurile ProcessID \u0219i ProcessGUID, ar\u0103t\u00e2nd portul \u0219i <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/lir\/ipv4\/\"   title=\"adrese IP\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"622\">adrese IP<\/a> sursele \u0219i destina\u021biile.<\/p>\n<p><b>Modific\u0103ri \u00een registrul de sistem (ID eveniment 12-14).<\/b> Cea mai simpl\u0103 modalitate de a te ad\u0103uga \u00een pornire automat\u0103 este s\u0103 te \u00eenscrii \u00een registru. Security Log poate face asta, dar Sysmon arat\u0103 cine a efectuat modific\u0103rile, c\u00e2nd, de unde, ID-ul procesului \u0219i valoarea anterioar\u0103 a cheii.<\/p>\n<p><b>Crearea fi\u0219ierului (ID eveniment 11).<\/b> Sysmon, spre deosebire de Security Log, va ar\u0103ta nu doar loca\u021bia fi\u0219ierului, ci \u0219i numele acestuia. Este clar c\u0103 nu po\u021bi urm\u0103ri totul, dar este posibil s\u0103 se efectueze un audit al anumitor directoare.<\/p>\n<p>\u0218i acum, ceea ce nu se reg\u0103se\u0219te \u00een politicile Security Log, dar se g\u0103se\u0219te \u00een Sysmon:<\/p>\n<p><b>Modificarea timpului de creare a fi\u0219ierului (ID eveniment 2).<\/b> Unele programe malware pot schimba data de creare a fi\u0219ierului pentru a-l ascunde din rapoartele cu fi\u0219iere recent create.<\/p>\n<p><b>\u00cenc\u0103rcarea driverelor \u0219i bibliotecilor dinamice (ID evenimente 6-7).<\/b> Urm\u0103rirea \u00eenc\u0103rc\u0103rii \u00een memorie a DLL-urilor \u0219i driverelor de dispozitive, verificarea semn\u0103turii digitale \u0219i a validit\u0103\u021bii acesteia.<\/p>\n<p><b>Crearea unui fir \u00een procesul executabil (ID eveniment 8).<\/b> Un tip de atac care trebuie de asemenea monitorizat.<\/p>\n<p><b>Evenimente RawAccessRead (ID eveniment 9).<\/b> Opera\u021biunile de citire de pe disc utiliz\u00e2nd \u2018.\u2019. \u00cen majoritatea cazurilor, aceast\u0103 activitate ar trebui considerat\u0103 anormal\u0103.<\/p>\n<p><b>Crearea unui flux de fi\u0219ier denumit (ID eveniment 15).<\/b> Evenimentul este \u00eenregistrat atunci c\u00e2nd se creeaz\u0103 un flux de fi\u0219ier denumit, care genereaz\u0103 evenimente cu hash-ul con\u021binutului fi\u0219ierului.<\/p>\n<p><b>Crearea unui pipe denumit \u0219i conexiuni (ID evenimente 17-18).<\/b> Urm\u0103rirea codului malware care comunic\u0103 cu alte componente prin intermediul unui pipe denumit.<\/p>\n<p><b>Activitate WMI (ID eveniment 19).<\/b> \u00cenregistrarea evenimentelor care sunt generate atunci c\u00e2nd se acceseaz\u0103 sistemul prin protocolul WMI.<\/p>\n<p>Pentru a proteja Sysmon, trebuie s\u0103 monitorizezi evenimentele cu ID 4 (oprirea \u0219i pornirea Sysmon) \u0219i ID 16 (modificarea configura\u021biei Sysmon).<\/p>\n<h2>Jurnalele Power Shell<\/h2>\n<p>\nPower Shell este un instrument puternic de gestionare a infrastructurii Windows, astfel c\u0103 exist\u0103 \u0219anse mari ca atacatorul s\u0103 \u00eel aleag\u0103. Pentru a ob\u021bine date despre evenimentele Power Shell pot fi folosite dou\u0103 surse: log-ul Windows PowerShell \u0219i log-ul Microsoft-WindowsPowerShell \/ Operational.<\/p>\n<h4>Log-ul Windows PowerShell<\/h4>\n<p>\n<img decoding=\"async\" alt=\"Ce informa\u021bii utile pot fi extrase din jurnalele unei sta\u021bii de lucru bazate pe Windows\" src=\"\/wp-content\/uploads\/2019\/04\/03d830871fc2c47ceeb8f0822f3f20e0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Furnizor de date \u00eenc\u0103rcat (ID eveniment 600).<\/b> Furnizorii PowerShell sunt programe care servesc ca surs\u0103 de date pentru PowerShell pentru a le vizualiza \u0219i gestiona. De exemplu, furnizorii \u00eencorpora\u021bi pot fi variabilele de mediu Windows sau registrul de sistem. Este important s\u0103 urm\u0103ri\u021bi apari\u021bia de noi furnizori pentru a detecta la timp activit\u0103\u021bile mali\u021bioase. De exemplu, dac\u0103 observa\u021bi c\u0103 \u00eentre furnizori a ap\u0103rut WSMan, \u00eenseamn\u0103 c\u0103 a fost ini\u021biat\u0103 o sesiune PowerShell de la distan\u021b\u0103.<\/p>\n<h4>Jurnalul Microsoft-WindowsPowerShell \/ Operational (sau MicrosoftWindows-PowerShellCore \/ Operational \u00een PowerShell 6)<\/h4>\n<p>\n<img decoding=\"async\" alt=\"Ce informa\u021bii utile pot fi extrase din jurnalele unei sta\u021bii de lucru bazate pe Windows\" src=\"\/wp-content\/uploads\/2019\/04\/d0a1a74aad59c7c4f64446b52846429f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Jurnalizarea modulelor (ID eveniment 4103).<\/b> Evenimentele stocheaz\u0103 informa\u021bii despre fiecare comand\u0103 executat\u0103 \u0219i parametrii cu care a fost apelat\u0103.<\/p>\n<p><b>Jurnalizarea bloc\u0103rii scripturilor (ID eveniment 4104).<\/b> Jurnalizarea bloc\u0103rii scripturilor arat\u0103 fiecare bloc de cod PowerShell executat. Chiar dac\u0103 un atacator \u00eencearc\u0103 s\u0103 ascund\u0103 comanda, acest tip de eveniment va ar\u0103ta efectiv comanda PowerShell executat\u0103. De asemenea, \u00een acest tip de eveniment pot fi \u00eenregistrate anumite apeluri API de nivel jos; aceste evenimente sunt de obicei \u00eenregistrate ca Verbose, dar dac\u0103 o comand\u0103 sau un script suspect este utilizat \u00eentr-un bloc de cod, acesta va fi \u00eenregistrat cu severitate Warning.<\/p>\n<p>Re\u021bine\u021bi c\u0103 dup\u0103 configurarea instrumentului de colectare \u0219i analiz\u0103 a acestor evenimente va fi necesar un timp suplimentar pentru depanare pentru a reduce num\u0103rul de alarme false.<\/p>\n<p>Spune\u021bi-ne \u00een comentarii ce jurnale colecta\u021bi pentru auditul securit\u0103\u021bii informa\u021biei \u0219i ce instrumente folosi\u021bi pentru aceasta. Una dintre direc\u021biile noastre este solu\u021bii pentru auditurile evenimentelor de securitate a informa\u021biei. \u00cen ceea ce prive\u0219te sarcina de colectare \u0219i analiz\u0103 a jurnalelor, v\u0103 putem recomanda s\u0103 lua\u021bi \u00een considerare <noindex><a rel=\"nofollow\" href=\"https:\/\/www.quest.com\/products\/intrust\/\">Quest InTrust<\/a><\/noindex>, care poate comprima datele stocate cu un raport de 20:1, iar un singur exemplu instalat poate procesa p\u00e2n\u0103 la 60.000 de evenimente pe secund\u0103 din 10.000 de surse.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447522\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0439\u0442\u0438 \u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u043f\u043e\u0447\u0442\u0443 \u043f\u0438\u0441\u044c\u043c\u043e \u0432\u0440\u043e\u0434\u0435 \u0431\u044b \u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043d\u043e \u0441\u043e \u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u043d\u0430 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0439 \u0441\u0430\u0439\u0442. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043a\u0442\u043e-\u0442\u043e \u0441\u043a\u0430\u0447\u0430\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0443\u0442\u0438\u043b\u0438\u0442\u0443 \u0438\u0437 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043a\u0430\u043a\u043e\u0433\u043e \u043c\u0435\u0441\u0442\u0430. \u0414\u0430 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u0434\u0443\u043c\u0430\u0442\u044c \u043d\u0435 \u043e\u0434\u0438\u043d \u0434\u0435\u0441\u044f\u0442\u043e\u043a \u043a\u0435\u0439\u0441\u043e\u0432, \u043a\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23255,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31289","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0427\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421 Windows | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:40:29+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:40:29+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ce informa\u021bii utile se pot extrage din jurnalele sta\u021biei de lucru bazate pe sistemul de operare Windows | ProHoster","description":"Sta\u021bia de lucru utilizator este cel mai vulnerabil loc al infrastructurii din punct de vedere al securit\u0103\u021bii informa\u021biei.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0442\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0432\u044b\u0442\u0430\u0449\u0438\u0442\u044c \u0438\u0437 \u043b\u043e\u0433\u043e\u0432 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 \u041e\u0421 Windows | ProHoster","og:description":"\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0440\u0430\u0431\u043e\u0447\u0430\u044f \u0441\u0442\u0430\u043d\u0446\u0438\u044f \u2014 \u0441\u0430\u043c\u043e\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/chto-poleznogo-mozhno-vytashhit-iz-logov-rabochej-stantsii-na-baze-os-windows","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:40:29+00:00","article:modified_time":"2019-10-31T18:40:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31289","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:25:31","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:19:49","updated":"2026-02-08 20:25:31","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31289","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=31289"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31289\/revisions"}],"predecessor-version":[{"id":157813,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31289\/revisions\/157813"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/23255"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=31289"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=31289"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=31289"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}