{"id":76039,"date":"2020-03-30T13:43:09","date_gmt":"2020-03-30T11:43:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery"},"modified":"2020-03-30T13:43:09","modified_gmt":"2020-03-30T11:43:09","slug":"kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery","title":{"rendered":"Cum sistemele de analiz\u0103 a traficului descoper\u0103 tacticile hackerilor conform MITRE ATT&amp;CK, exemplul PT Network Attack Discovery","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/pt\/blog\/493082\/\"><img decoding=\"async\" alt=\"Cum sistemele de analiz\u0103 a traficului detecteaz\u0103 tacticile hackerilor conform MITRE ATT&amp;CK, folosind PT Network Attack Discovery ca exemplu\" src=\"\/wp-content\/uploads\/2020\/03\/75b6c4846867a15776529105f9657ffb.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.verizonenterprise.com\/resources\/reports\/rp_DBIR_2018_Report_execsummary_en_xg.pdf\">Conform Verizon<\/a><\/noindex>, majoritatea (87%) incidentelor de securitate informatic\u0103 se \u00eent\u00e2mpl\u0103 \u00een c\u00e2teva minute, iar pentru 68% dintre companii, detectarea lor dureaz\u0103 luni de zile. Acest lucru este confirmat \u0219i de <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ibm.com\/security\/data-breach\">studiul Institutului Ponemon<\/a><\/noindex>, conform c\u0103ruia majoritatea organiza\u021biilor au nevoie \u00een medie de 206 zile pentru a detecta un incident. Din experien\u021ba anchetelor noastre, hackerii pot controla infrastructura unei companii timp de ani de zile f\u0103r\u0103 a fi descoperi\u021bi. De exemplu, \u00eentr-o organiza\u021bie unde exper\u021bii no\u0219tri au investigat un incident de securitate informatic\u0103, s-a constatat c\u0103 hackerii controlau complet \u00eentreaga infrastructur\u0103 a organiza\u021biei \u0219i furau \u00een mod regulat informa\u021bii importante <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ptsecurity.com\/ru-ru\/research\/analytics\/operation-taskmasters-2019\/?sphrase_id=71910\">timp de opt ani<\/a><\/noindex>.<\/p>\n<p>S\u0103 presupunem c\u0103 ave\u021bi deja un SIEM care colecteaz\u0103 jurnalele \u0219i analizeaz\u0103 evenimentele, iar antivirusurile sunt instalate pe punctele finale. Cu toate acestea, <noindex><a rel=\"nofollow\" href=\"https:\/\/safe.cnews.ru\/articles\/2019-10-15_pochemu_hakery_legko_vzlamyvayut_nasa\">nu totul poate fi detectat prin SIEM<\/a><\/noindex>, la fel cum nu este posibil s\u0103 implementa\u021bi sisteme EDR \u00een \u00eentreaga re\u021bea, ceea ce \u00eenseamn\u0103 c\u0103 nu pute\u021bi evita zonele \"orb\". Acestea sunt gestionate cu ajutorul sistemelor de analiz\u0103 a traficului de re\u021bea (network traffic analysis, NTA). Aceste solu\u021bii identific\u0103 activitatea atacatorilor \u00een cele mai timpurii etape de penetrare \u00een re\u021bea, precum \u0219i \u00een timpul \u00eencerc\u0103rilor de a se stabili \u0219i de a dezvolta un atac \u00een interiorul re\u021belei. <\/p>\n<p>NTA sunt de dou\u0103 tipuri: unele func\u021bioneaz\u0103 cu NetFlow, altele analizeaz\u0103 traficul brut. Avantajul sistemelor de analiz\u0103 a traficului brut este c\u0103 acestea pot stoca \u00eenregistr\u0103ri ale traficului brut. Gra\u021bie acestui fapt, specialistul \u00een securitate informatic\u0103 poate verifica succesul atacului, localiza amenin\u021barea, \u00een\u021belege cum a avut loc atacul \u0219i cum s\u0103 previn\u0103 unul similar \u00een viitor.<\/p>\n<p>V\u0103 vom ar\u0103ta cum, cu ajutorul NTA, se pot identifica toate tacticile de atac cunoscute, descrise \u00een baza de cuno\u0219tin\u021be <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/\">MITRE ATT&amp;CK<\/a><\/noindex>. Vom vorbi despre fiecare dintre cele 12 tactici, vom analiza tehnicile care pot fi detectate prin trafic \u0219i vom demonstra detectarea acestora cu ajutorul sistemului nostru NTA. <noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Despre baza de cuno\u0219tin\u021be ATT&amp;CK<\/h2>\n<p>\nMITRE ATT&amp;CK este o baz\u0103 de cuno\u0219tin\u021be public\u0103, dezvoltat\u0103 \u0219i \u00eentre\u021binut\u0103 de MITRE pe baza analizei APT-urilor reale. Aceasta constituie un set structurat de tactici \u0219i tehnici utilizate de atacatori. Acest lucru permite speciali\u0219tilor \u00een securitate informatic\u0103 din \u00eentreaga lume s\u0103 comunice pe aceea\u0219i limb\u0103. Baza este constant extins\u0103 \u0219i \u00eembog\u0103\u021bit\u0103 cu noi cuno\u0219tin\u021be.<\/p>\n<p>\u00cen cadrul bazei sunt eviden\u021biate 12 tactici, care sunt divizate pe etapele atacului cibernetic: <\/p>\n<ul>\n<li>acces ini\u021bial (initial access);<\/li>\n<li>execu\u021bie (execution);<\/li>\n<li>persistence (persisten\u021b\u0103);<\/li>\n<li>escaladarea privilegiilor (privilege escalation);<\/li>\n<li>evitarea descoperirii (defense evasion);<\/li>\n<li>accesul la datele de autentificare (credential access);<\/li>\n<li>descoperire (discovery);<\/li>\n<li>mi\u0219care lateral\u0103 (lateral movement);<\/li>\n<li>colectare de date (collection);<\/li>\n<li>comand\u0103 \u0219i control (command and control);<\/li>\n<li>exfiltrarea datelor (exfiltration);<\/li>\n<li>impact (impact).<\/li>\n<\/ul>\n<p>\nPentru fiecare tactic\u0103 din baza de cuno\u0219tin\u021be ATT&amp;CK, este disponibil\u0103 o list\u0103 de tehnici care ajut\u0103 atacatorii s\u0103 \u00ee\u0219i ating\u0103 obiectivele \u00een etapa actual\u0103 a atacului. Deoarece aceea\u0219i tehnic\u0103 poate fi utilizat\u0103 \u00een diferite etape, ea poate fi asociat\u0103 cu mai multe tactici. <\/p>\n<p>Descrierea fiec\u0103rei tehnici include:<\/p>\n<ul>\n<li>identificator;<\/li>\n<li>lista de tactici \u00een care este aplicat\u0103;<\/li>\n<li>exemple de utilizare de c\u0103tre grupuri APT;<\/li>\n<li>m\u0103suri de reducere a impactului aplic\u0103rii acesteia;<\/li>\n<li>recomand\u0103ri pentru detectare. <\/li>\n<\/ul>\n<p>\nSpeciali\u0219tii \u00een securitate IT pot utiliza cuno\u0219tin\u021bele din baza de date pentru a structura informa\u021biile despre metodele de atac actuale \u0219i pentru a construi un sistem de securitate eficient. \u00cen\u021belegerea modului \u00een care ac\u021bioneaz\u0103 grupurile APT reale poate, de asemenea, s\u0103 devin\u0103 o surs\u0103 de ipoteze pentru c\u0103utarea proactiv\u0103 a amenin\u021b\u0103rilor \u00een cadrul <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ptsecurity.com\/ru-ru\/research\/webinar\/302112\/\">threat hunting<\/a><\/noindex>. <\/p>\n<h3>Despre Descoperirea Atacurilor \u00een Re\u021bele PT<\/h3>\n<p>\nIdentificarea utiliz\u0103rii tehnicilor din matricea ATT&amp;CK va fi realizat\u0103 cu ajutorul sistemului <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ptsecurity.com\/ru-ru\/products\/network-attack-discovery\/?utm_source=press_release&amp;utm_medium=press_release&amp;utm_campaign=new_nad\">Descoperirea atacurilor \u00een re\u021bea PT <\/a><\/noindex>\u2014 sistemul NTA Positive Technologies, destinat identific\u0103rii atacurilor la perimetru \u0219i \u00een interiorul re\u021belei. PT NAD acoper\u0103 \u00eentr-o m\u0103sur\u0103 variat\u0103 toate cele 12 tactici ale matricei MITRE ATT&amp;CK. Este cel mai eficient \u00een identificarea tehnicilor de acces ini\u021bial (initial access), mi\u0219care lateral\u0103 (lateral movement) \u0219i comand\u0103 \u0219i control (command and control). \u00cen acestea, PT NAD acoper\u0103 mai mult de jum\u0103tate din tehnicile cunoscute, identific\u00e2nd utilizarea lor pe baza unor caracteristici directe sau indirecte. <\/p>\n<p>Sistemul identific\u0103 atacurile care utilizeaz\u0103 tehnici ATT&amp;CK prin reguli de detectare create de echipa <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ptsecurity.com\/ru-ru\/products\/network-attack-discovery\/?utm_source=press_release&amp;utm_medium=press_release&amp;utm_campaign=new_nad\">PT Expert Security Center<\/a><\/noindex> (PT ESC), \u00eenv\u0103\u021bare automat\u0103, indicatori de compromitere, analize profunde \u0219i analize retrospective. Analiza traficului \u00een timp real, combinat\u0103 cu analiza retrospectiv\u0103, permite identificarea activit\u0103\u021bii mali\u021bioase ascunse \u00een cursul desf\u0103\u0219ur\u0103rii \u0219i urm\u0103rirea vectorilor de dezvoltare \u0219i a cronologiei atacurilor.<\/p>\n<blockquote><p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/-l\/o8\/yc\/-lo8ycywq-rl1g_v1pt9-lmnj3y.png\">Aici<\/a><\/noindex> mapping-ul complet PT NAD pe matricea MITRE ATT&amp;CK. Imaginea este complex\u0103, a\u0219a c\u0103 v\u0103 proponem s\u0103 o analiza\u021bi \u00eentr-o fereastr\u0103 separat\u0103.<\/p><\/blockquote>\n<p><\/p>\n<h3>acces ini\u021bial (initial access)<\/h3>\n<p><img decoding=\"async\" alt=\"Cum sistemele de analiz\u0103 a traficului detecteaz\u0103 tacticile hackerilor conform MITRE ATT&amp;CK, folosind PT Network Attack Discovery ca exemplu\" src=\"\/wp-content\/uploads\/2020\/03\/93cc3669c7de3b5193897d685e63a72f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTactica ob\u021binerii accesului ini\u021bial include tehnici pentru infiltrarea \u00een re\u021beaua unei companii. Scopul atacatorilor \u00een aceast\u0103 etap\u0103 este de a introduce cod mali\u021bios \u00een sistemul atacat \u0219i de a asigura capabilitatea de a-l executa ulterior.<\/p>\n<p>Analiza traficului cu PT NAD permite identificarea a \u0219apte tehnici de ob\u021binere a accesului ini\u021bial:<\/p>\n<h3>1. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1189\/\">T1189<\/a><\/noindex>: compromiterea prin vizionarea site-urilor.<\/h3>\n<p>\nO tehnic\u0103 prin care victima acceseaz\u0103 un site web folosit de atacatori pentru a exploata browserul web, ob\u021bin\u00e2nd tokenuri de acces pentru aplica\u021bie. <\/p>\n<p><b>Ce face PT NAD<\/b>: dac\u0103 traficul web nu este criptat, PT NAD inspecteaz\u0103 con\u021binutul r\u0103spunsurilor serverelor HTTP. \u00cen aceste r\u0103spunsuri se afl\u0103 exploituri care permit atacatorilor s\u0103 execute cod arbitrar \u00een browser. PT NAD identific\u0103 automat astfel de exploituri folosind reguli de detec\u021bie. <\/p>\n<p>\u00cen plus, PT NAD descoper\u0103 amenin\u021b\u0103rile la pasul anterior. Regulile \u0219i indicatorii de compromitere se activeaz\u0103 dac\u0103 utilizatorul a vizitat un site care l-a direc\u021bionat c\u0103tre un site cu un set de exploituri.<\/p>\n<h3>2. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1190\">T1190<\/a><\/noindex>: exploatarea aplica\u021biei ce este accesibil\u0103 publicului.<\/h3>\n<p>\nExploatarea vulnerabilit\u0103\u021bilor \u00een servicii care sunt disponibile pe internet. <\/p>\n<p><b>Ce face PT NAD<\/b>: efectueaz\u0103 o inspec\u021bie profund\u0103 a con\u021binutului pachetelor de re\u021bea, identific\u00e2nd semne de activitate anormal\u0103. \u00cen special, exist\u0103 reguli care permit detectarea atacurilor asupra sistemelor de gestionare a con\u021binutului (content management system, CMS), interfe\u021belor web ale echipamentelor de re\u021bea, atacurilor asupra serverelor de e-mail \u0219i FTP.<\/p>\n<h3>3. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1133\/\">T1133<\/a><\/noindex>: servicii externe \u0219i remote. <\/h3>\n<p>\nFolosirea de c\u0103tre atacatori a serviciilor de acces de la distan\u021b\u0103 pentru a se conecta la resursele re\u021belei interne din exterior. <\/p>\n<p><b>Ce face PT NAD<\/b>: deoarece sistemul recunoa\u0219te protocoalele nu dup\u0103 numerele de porturi, ci dup\u0103 con\u021binutul pachetelor, utilizatorii sistemului pot filtra traficul pentru a g\u0103si toate sesiunile protocoalelor de acces de la distan\u021b\u0103 \u0219i a verifica legitimitatea acestora. <\/p>\n<h3>4. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1193\/\">T1193<\/a><\/noindex>: ata\u0219amente de spearphishing. <\/h3>\n<p>\nSe refer\u0103 la celebrele trimiterea de ata\u0219amente de phishing.<\/p>\n<p><b>Ce face PT NAD<\/b>: extrage automat fi\u0219iere din trafic \u0219i le verific\u0103 \u00een func\u021bie de indicatorii de compromitere. Fi\u0219ierele executabile din ata\u0219amente sunt identificate prin reguli care analizeaz\u0103 con\u021binutul traficului de e-mail. \u00cen mediul corporativ, un astfel de ata\u0219ament este considerat anormal. <\/p>\n<h3>5. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1192\/\">T1192<\/a><\/noindex>: linkuri de spearphishing. <\/h3>\n<p>\nUtilizarea linkurilor de phishing. Tehnica implic\u0103 trimiterea de c\u0103tre agresori a unui e-mail de phishing cu un link, pe care, atunci c\u00e2nd este accesat, se descarc\u0103 un program malware. De obicei, linkul este \u00eenso\u021bit de un text elaborat conform tuturor regulilor ingineriei sociale. <\/p>\n<p><b>Ce face PT NAD<\/b>: detecteaz\u0103 linkurile de phishing prin intermediul indicatorilor de compromitere. De exemplu, \u00een interfa\u021ba PT NAD vedem o sesiune \u00een care a existat o conexiune HTTP printr-un link care a fost inclus \u00een lista de adrese de phishing (phishing-urls).<\/p>\n<p><img decoding=\"async\" alt=\"Cum sistemele de analiz\u0103 a traficului detecteaz\u0103 tacticile hackerilor conform MITRE ATT&amp;CK, folosind PT Network Attack Discovery ca exemplu\" src=\"\/wp-content\/uploads\/2020\/03\/f8b8f0ed7e64da6a9ceb2c3e8d3b3202.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Conexiunea printr-un link din lista indicatorilor de compromitere phishing-urls<\/i><\/p>\n<h3>6. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1199\">T1199<\/a><\/noindex>: rela\u021bie de \u00eencredere<\/h3>\n<p>\nAccesul la re\u021beaua victimei prin intermediul ter\u021bilor, cu care victima are rela\u021bii de \u00eencredere. Agresorii pot sparge o organiza\u021bie de \u00eencredere \u0219i se pot conecta la re\u021beaua \u021bint\u0103 prin aceasta. Pentru aceasta, ei folosesc conexiuni VPN sau rela\u021bii de \u00eencredere \u00eentre domenii, ceea ce poate fi identificat prin analiza traficului. <\/p>\n<p><b>Ce face PT NAD<\/b>: analizeaz\u0103 protocoalele aplica\u021biilor \u0219i salveaz\u0103 c\u00e2mpurile analizate \u00een baza de date, permi\u021b\u00e2nd astfel analistului de securitate s\u0103 g\u0103seasc\u0103 prin filtre toate conexiunile VPN suspecte sau conexiunile \u00eentre domenii.<\/p>\n<h3>7. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1078\/\">T1078<\/a><\/noindex>: conturi valide<\/h3>\n<p>\nUtilizarea acreditivelor standard, locale sau de domeniu pentru autentificarea pe servicii externe \u0219i interne.<\/p>\n<p><b>Ce face PT NAD<\/b>: extrage automat acreditivele din protocoalele HTTP, FTP, SMTP, POP3, IMAP, SMB, DCE\/RPC, SOCKS5, LDAP, Kerberos. \u00cen general, acestea includ numele de utilizator, parola \u0219i semnul de succes al autentific\u0103rii. Dac\u0103 au fost utilizate, acestea sunt afi\u0219ate \u00een cardul corespunz\u0103tor al sesiunii.<\/p>\n<h2>Executare (execution)<\/h2>\n<p><img decoding=\"async\" alt=\"Cum sistemele de analiz\u0103 a traficului detecteaz\u0103 tacticile hackerilor conform MITRE ATT&amp;CK, folosind PT Network Attack Discovery ca exemplu\" src=\"\/wp-content\/uploads\/2020\/03\/54cfa8b924eb5061d7cc8bc93335c735.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n\u00cen tactica Executare se includ tehnici pe care agresorii le aplic\u0103 pentru a executa cod \u00een sistemele compromise. Rularea codului malware ajut\u0103 atacatorii s\u0103 \u00ee\u0219i consolideze prezen\u021ba (tactica persistence) \u0219i s\u0103 extind\u0103 accesul la sistemele de la distan\u021b\u0103 din re\u021bea, deplas\u00e2ndu-se \u00een interiorul perimetrului. <\/p>\n<p>PT NAD permite identificarea utiliz\u0103rii de c\u0103tre agresori a 14 tehnici utilizate pentru executarea codului malware. <\/p>\n<h3>1. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1191\/\">T1191<\/a><\/noindex>: CMSTP (Microsoft Connection Manager Profile Installer)<\/h3>\n<p>\nO tactic\u0103 \u00een care atacatorii preg\u0103tesc un fi\u0219ier de instalare INF malware special pentru utilitarul CMSTP.exe \u00eencorporat \u00een Windows (instalatorul profilurilor managerului de conexiuni). CMSTP.exe prime\u0219te fi\u0219ierul ca parametru \u0219i instaleaz\u0103 un profil de serviciu pentru conectarea la distan\u021b\u0103. Astfel, CMSTP.exe poate fi utilizat pentru a desc\u0103rca \u0219i executa biblioteci partajate dinamice (*.dll) sau scripturi (*.sct) de pe servere externe. <\/p>\n<p><b>Ce face PT NAD<\/b>: detecteaz\u0103 automat \u00een traficul HTTP transmiterea fi\u0219ierelor INF de un anumit tip. \u00cen plus, detecteaz\u0103 transmisia prin protocolul HTTP a scripturilor malware \u0219i a bibliotecilor partajate dinamice de pe un server extern. <\/p>\n<h3>2. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1059\">T1059<\/a><\/noindex>: interfa\u021b\u0103 de linie de comand\u0103 <\/h3>\n<p>\nInterac\u021biunea cu interfa\u021ba de linie de comand\u0103. Poate fi realizat\u0103 local sau la distan\u021b\u0103, de exemplu, prin intermediul utilitarelor de acces la distan\u021b\u0103.<\/p>\n<p><b>Ce face PT NAD<\/b>: detecteaz\u0103 automat prezen\u021ba shell-urilor prin r\u0103spunsurile la comenzile de lansare ale diverselor utilitare de linie de comand\u0103, cum ar fi ping, ifconfig.<\/p>\n<h3>3. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1175\/\">T1175<\/a><\/noindex>: modelul de obiecte componente \u0219i COM distribuit <\/h3>\n<p>\nUtilizarea tehnologiilor COM sau DCOM pentru a executa cod pe sisteme locale sau la distan\u021b\u0103 \u00een timpul avans\u0103rii prin re\u021bea.<\/p>\n<p><b>Ce face PT NAD<\/b>: detecteaz\u0103 apelurile DCOM suspecte, pe care atacatorii le folosesc de obicei pentru a lansa programe. <\/p>\n<h3>4. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1203\/\">T1203<\/a><\/noindex>: exploatarea pentru execu\u021bie client <\/h3>\n<p>\nExploatarea vulnerabilit\u0103\u021bilor pentru a executa cod arbitrar pe sta\u021bia de lucru. Cele mai utile exploata\u021bii pentru atacatori sunt cele care permit rularea codului \u00een sistemul de la distan\u021b\u0103, deoarece prin acestea atacatorii pot accesa acel sistem. Tehnica poate fi implementat\u0103 prin urm\u0103toarele metode: campanii de propagare malware prin email, site-uri cu exploat\u0103ri pentru browsere \u0219i exploatarea de la distan\u021b\u0103 a vulnerabilit\u0103\u021bilor aplica\u021biilor. <\/p>\n<p><b>Ce face PT NAD<\/b>: \u00een timpul analizei traficului de email, PT NAD verific\u0103 prezen\u021ba fi\u0219ierelor executabile \u00een ata\u0219amente. Extrage automat documentele de birou din email-uri care pot con\u021bine exploat\u0103ri. Tentativele de exploatare a vulnerabilit\u0103\u021bilor sunt vizibile \u00een trafic, ceea ce este detectat automat de PT NAD.<\/p>\n<h3>5. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1170\">T1170<\/a><\/noindex>: mshta<\/h3>\n<p>\nUtilizarea utilitarului mshta.exe, care ruleaz\u0103 aplica\u021bii Microsoft HTML (HTA) cu extensia .hta. Deoarece mshta proceseaz\u0103 fi\u0219ierele ocolind set\u0103rile de securitate ale browserului, atacatorii pot folosi mshta.exe pentru a executa fi\u0219iere HTA, JavaScript sau VBScript malware. <\/p>\n<p><b>Ce face PT NAD<\/b>: fi\u0219ierele .hta pentru execu\u021bie prin mshta sunt transmise inclusiv prin re\u021bea \u2014 acest lucru este vizibil \u00een trafic. PT NAD detecteaz\u0103 automat transferul acestor fi\u0219iere malware. \u00cenf\u0103\u021bi\u0219eaz\u0103 fi\u0219ierele, iar informa\u021biile despre ele pot fi vizualizate \u00een cardul de sesiune.<\/p>\n<h3>6. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1086\">T1086<\/a><\/noindex>: PowerShell <\/h3>\n<p>\nFolosirea PowerShell pentru a c\u0103uta informa\u021bii \u0219i a executa cod mali\u021bios. <\/p>\n<p><b>Ce face PT NAD<\/b>: atunci c\u00e2nd PowerShell este folosit de atacatori de la distan\u021b\u0103, PT NAD detecteaz\u0103 acest lucru prin reguli. Detecteaz\u0103 cuvintele cheie ale limbajului PowerShell care sunt cele mai des utilizate \u00een scripturile mali\u021bioase \u0219i transferul scripturilor PowerShell prin protocolul SMB.<\/p>\n<p>7. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1053\">T1053<\/a><\/noindex>: sarcin\u0103 programat\u0103<br \/>\nFolose\u0219te planificatorul de sarcini Windows \u0219i alte utilitare pentru a lansa automat programe sau scripturi la un moment specific. <\/p>\n<p><b>Ce face PT NAD<\/b>: atacatorii creeaz\u0103 astfel de sarcini, de obicei de la distan\u021b\u0103, ceea ce \u00eenseamn\u0103 c\u0103 aceste sesiuni sunt vizibile \u00een trafic. PT NAD detecteaz\u0103 automat opera\u021biuni suspecte de creare \u0219i modificare a sarcinilor folosind interfe\u021bele RPC ale ATSVC \u0219i ITaskSchedulerService.<\/p>\n<h3>8. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1064\">T1064<\/a><\/noindex>: scripting <\/h3>\n<p>\nExecutarea scripturilor pentru automatizarea diferitelor ac\u021biuni ale atacatorilor. <\/p>\n<p><b>Ce face PT NAD<\/b>: detecteaz\u0103 transferurile de scripturi prin re\u021bea, adic\u0103 chiar \u00eenainte de execu\u021bia lor. Identific\u0103 con\u021binutul scripturilor \u00een traficul brut \u0219i detecteaz\u0103 transferul de fi\u0219iere cu extensiile corespunz\u0103toare limbajelor de scripting populare.<\/p>\n<h3>9. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1035\">T1035<\/a><\/noindex>: execu\u021bie de servicii<\/h3>\n<p>\nExecutarea unui fi\u0219ier executabil, instruc\u021biuni ale interfe\u021bei liniei de comand\u0103 sau script prin interac\u021biunea cu serviciile Windows, cum ar fi Managerul de Control al Serviciilor (Service Control Manager, SCM). <\/p>\n<p><b>Ce face PT NAD<\/b>: inspecteaz\u0103 traficul SMB \u0219i detecteaz\u0103 accesarea SCM prin reguli privind crearea, modificarea \u0219i lansarea serviciului. <\/p>\n<p>Tehnica de lansare a serviciilor poate fi realizat\u0103 cu ajutorul unei utilitare pentru executarea de comenzi de la distan\u021b\u0103, PSExec. PT NAD analizeaz\u0103 protocolul SMB \u0219i detecteaz\u0103 utilizarea PSExec atunci c\u00e2nd folose\u0219te fi\u0219ierul PSEXESVC.exe sau numele standard al serviciului PSEXECSVC pentru a executa cod pe o ma\u0219in\u0103 la distan\u021b\u0103. Utilizatorul trebuie s\u0103 verifice lista comenzilor executate \u0219i legitimitatea execu\u021biei de comenzi de la distan\u021b\u0103 de la nod. <\/p>\n<blockquote><p>\u00cen cardul de atac PT NAD sunt afi\u0219ate date despre tacticile \u0219i tehnicile utilizate conform matricei ATT&amp;CK, astfel \u00eenc\u00e2t utilizatorul s\u0103 poat\u0103 \u00een\u021belege \u00een ce stadiu al atacului se afl\u0103 atacatorii, ce obiective urm\u0103resc \u0219i ce m\u0103suri compensatorii trebuie s\u0103 ia. <\/p><\/blockquote>\n<p>\n<img decoding=\"async\" alt=\"Cum sistemele de analiz\u0103 a traficului detecteaz\u0103 tacticile hackerilor conform MITRE ATT&amp;CK, folosind PT Network Attack Discovery ca exemplu\" src=\"\/wp-content\/uploads\/2020\/03\/cef63cd458947bf4b4a7735a44362f30.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Activarea regulii privind utilizarea utilitarului PSExec, ceea ce poate indica o tentativ\u0103 de executare a comenzilor pe o ma\u0219in\u0103 la distan\u021b\u0103.<\/i><\/p>\n<h3>10. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1072\/\">T1072<\/a><\/noindex>: software de ter\u021b\u0103 parte<\/h3>\n<p>\nO tehnic\u0103 prin care atacatorii ob\u021bin acces la software-ul de administrare la distan\u021b\u0103 sau la sistemul corporate de implementare a software-ului \u0219i, folosindu-l, lanseaz\u0103 cod mali\u021bios. Exemple de astfel de software: SCCM, VNC, TeamViewer, HBSS, Altiris. <br \/>\nDe altfel, tehnica este deosebit de relevant\u0103 av\u00e2nd \u00een vedere trecerea masiv\u0103 la munca de la distan\u021b\u0103 \u0219i, ca urmare, conectarea unui num\u0103r mare de dispozitive neprotejate acas\u0103 prin canale de acces la distan\u021b\u0103 \u00eendoielnice.<\/p>\n<p><b>Ce face PT NAD<\/b>: detecteaz\u0103 automat \u00een re\u021bea activitatea unui astfel de software. De exemplu, regulile se activeaz\u0103 \u00een cazul conect\u0103rilor prin protocolul VNC \u0219i activitatea troianului EvilVNC, care instaleaz\u0103 secret un server VNC pe gazda victimei \u0219i \u00eel porne\u0219te automat. De asemenea, PT NAD identific\u0103 automat protocolul TeamViewer, ceea ce ajut\u0103 analistul s\u0103 g\u0103seasc\u0103 cu ajutorul filtrului toate aceste sesiuni \u0219i s\u0103 le verifice legitimitatea.<\/p>\n<h3>11. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1204\/\">T1204<\/a><\/noindex>: execu\u021bia de c\u0103tre utilizator<\/h3>\n<p>\nO tehnic\u0103 prin care utilizatorul lanseaz\u0103 fi\u0219iere care pot duce la execu\u021bia de cod. Acest lucru poate fi, de exemplu, dac\u0103 deschide un fi\u0219ier executabil sau ruleaz\u0103 un document de birou cu macro-uri.<\/p>\n<p><b>Ce face PT NAD<\/b>: observ\u0103 astfel de fi\u0219iere \u00eenc\u0103 din etapa de transfer, \u00eenainte de a fi executate. Informa\u021biile despre acestea pot fi studiate \u00een cardul sesiunilor \u00een care au fost transferate.<\/p>\n<h3>12. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1047\">T1047<\/a><\/noindex>: Instrumenta\u021bia de gestionare Windows<\/h3>\n<p>\nUtilizarea instrumentului WMI, care ofer\u0103 acces local \u0219i la distan\u021b\u0103 la componentele sistemului Windows. Prin WMI, atacatorii pot interac\u021biona cu sistemele locale \u0219i la distan\u021b\u0103 \u0219i pot efectua multe sarcini, de exemplu, colectarea de informa\u021bii \u00een scopuri de cercetare \u0219i lansarea de procese la distan\u021b\u0103 \u00een timpul deplas\u0103rii orizontale.<\/p>\n<p><b>Ce face PT NAD<\/b>: deoarece interac\u021biunile cu sistemele la distan\u021b\u0103 prin WMI sunt vizibile \u00een trafic, PT NAD detecteaz\u0103 automat cererile de re\u021bea pentru stabilirea sesiunilor WMI \u0219i verific\u0103 traficul pentru a observa transferul scripturilor care utilizeaz\u0103 WMI.<\/p>\n<h3>13. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1028\">T1028<\/a><\/noindex>: Managementul la distan\u021b\u0103 Windows <\/h3>\n<p>\nUtilizarea serviciului \u0219i protocolului Windows care permite utilizatorului s\u0103 interac\u021bioneze cu sisteme la distan\u021b\u0103. <\/p>\n<p><b>Ce face PT NAD<\/b>: vede conexiunile de re\u021bea stabilite prin Windows Remote Management. Aceste sesiuni sunt detectate automat prin reguli. <\/p>\n<h3>14. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1220\/\">T1220<\/a><\/noindex>: procesare scripturi XSL (Extensible Stylesheet Language)<\/h3>\n<p>\nLimbajul de marcare a stilurilor XSL este utilizat pentru a descrie procesarea \u0219i vizualizarea datelor \u00een fi\u0219ierele XML. Pentru a sus\u021bine opera\u021biuni complexe, standardul XSL include suport pentru scripturi \u00eencorporate \u00een diferite limbaje. Aceste limbaje permit executarea de cod arbitrar, ceea ce duce la ocolirea politicilor de securitate bazate pe liste albe. <\/p>\n<p><b>Ce face PT NAD<\/b>: detecteaz\u0103 transferurile acestor fi\u0219iere prin re\u021bea, adic\u0103 \u00eenainte de a fi executate. Acesta detecteaz\u0103 automat transferul de fi\u0219iere XSL \u0219i fi\u0219iere cu marcare XSL anormal\u0103.<\/p>\n<p>\u00cen materialele urm\u0103toare, vom explora modul \u00een care sistemul NTA PT Network Attack Discovery identific\u0103 alte tactici \u0219i tehnici ale atacatorilor conform MITRE ATT&amp;CK. R\u0103m\u00e2ne\u021bi pe faz\u0103!<\/p>\n<p><b>Autori<\/b>: <\/p>\n<ul>\n<li>Anton Kute pov, specialist al centrului de expertiz\u0103 \u00een securitate (PT Expert Security Center) Positive Technologies<\/li>\n<li>Natalia Kazankova, marketer de produs la Positive Technologies<\/li>\n<\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/pt\/blog\/493082\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e Verizon, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e (87%) \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432 \u0418\u0411 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u044f\u0442 \u0437\u0430 \u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0435 \u043c\u0438\u043d\u0443\u0442\u044b, \u0430 \u043d\u0430 \u0438\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0443 68% \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0443\u0445\u043e\u0434\u044f\u0442 \u043c\u0435\u0441\u044f\u0446\u044b. \u042d\u0442\u043e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435\u043c Ponemon Institute, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u0443 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0443\u0445\u043e\u0434\u0438\u0442 \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u043c 206 \u0434\u043d\u0435\u0439 \u043d\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430. \u041f\u043e \u043e\u043f\u044b\u0442\u0443 \u043d\u0430\u0448\u0438\u0445 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439, \u0445\u0430\u043a\u0435\u0440\u044b \u043c\u043e\u0433\u0443\u0442 \u0433\u043e\u0434\u0430\u043c\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438 \u043d\u0435 \u0431\u044b\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c\u0438. \u0422\u0430\u043a, \u0432 \u043e\u0434\u043d\u043e\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":76040,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-76039","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e MITRE ATT&amp;CK \u043d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 PT Network Attack Discovery | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-03-30T11:43:09+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-30T11:43:09+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cum sistemele de analiz\u0103 a traficului detecteaz\u0103 tacticile hackerilor conform MITRE ATT&amp;CK, folosind PT Network Attack Discovery ca exemplu | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e MITRE ATT&amp;CK \u043d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 PT Network Attack Discovery | ProHoster","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-30T11:43:09+00:00","article:modified_time":"2020-03-30T11:43:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"76039","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:44:27","updated":"2022-09-27 21:17:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/76039","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=76039"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/76039\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/76040"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=76039"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=76039"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=76039"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}