{"id":90735,"date":"2020-08-05T13:42:06","date_gmt":"2020-08-05T11:42:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust"},"modified":"2020-08-05T13:42:06","modified_gmt":"2020-08-05T11:42:06","slug":"vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","title":{"rendered":"Activ\u0103m colectarea evenimentelor privind lansarea proceselor suspecte \u00een Windows \u0219i identific\u0103m amenin\u021b\u0103rile folosind Quest InTrust","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Activ\u0103m colectarea evenimentelor privind lansarea proceselor suspecte \u00een Windows \u0219i identific\u0103m amenin\u021b\u0103rile folosind Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/6377476bf0527b75b61e174ed9915c07.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nUnul dintre cele mai frecvente tipuri de atacuri este generarea unui proces mali\u021bios \u00een arborele de procese legitime. Suspiciunea poate fi st\u00e2rnit\u0103 de calea c\u0103tre fi\u0219ierul executabil: software-ul mali\u021bios utilizeaz\u0103 adesea folderele AppData sau Temp, ceea ce nu este caracteristic programelor legitime. De altfel, merit\u0103 men\u021bionat c\u0103 unele utilitare de actualizare automat\u0103 sunt executate \u00een AppData, a\u0219a c\u0103 simpla verificare a locului de lansare nu este suficient\u0103 pentru a afirma c\u0103 un program este mali\u021bios.<\/p>\n<p>Un alt factor de legitimitate este semn\u0103tura criptografic\u0103: multe programe originale sunt semnate de furnizor. Absen\u021ba semn\u0103turii poate fi utilizat\u0103 ca metod\u0103 de identificare a elementelor suspecte din autostart. Dar, din nou, exist\u0103 software mali\u021bios care folose\u0219te un certificat furat pentru a se semna singur.<\/p>\n<p>De asemenea, se pot verifica valorile hash-urilor criptografice MD5 sau SHA256, care pot corespunde unor programe mali\u021bioase cunoscute anterior. Se poate efectua o analiz\u0103 static\u0103, examin\u00e2nd semn\u0103turile din program (prin reguli Yara sau produse antivirus). De asemenea, exist\u0103 analiza dinamic\u0103 (executarea programului \u00eentr-un mediu sigur \u0219i monitorizarea ac\u021biunilor sale) \u0219i inginerie invers\u0103.<\/p>\n<p>Exist\u0103 numeroase semne ale unui proces mali\u021bios. \u00cen acest articol, vom explica cum s\u0103 activ\u0103m auditul evenimentelor corespunz\u0103toare \u00een Windows \u0219i vom analiza semnele de baz\u0103 pe care se bazeaz\u0103 regula \u00eencorporat\u0103 pentru identificarea unui proces suspect. <noindex><a rel=\"nofollow\" href=\"https:\/\/gals.software\/vendors\/quest\/intrust\">InTrust<\/a><\/noindex> InTrust este o <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/512908\/\">platform\u0103 CLM<\/a><\/noindex> pentru colectarea, analiza \u0219i stocarea datelor nestructurate, care dispune deja de sute de reac\u021bii prestabilite la diferite tipuri de atacuri.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nAtunci c\u00e2nd un program este lansat, acesta se \u00eencarc\u0103 \u00een memoria computerului. Fi\u0219ierul executabil con\u021bine instruc\u021biuni computerizate \u0219i biblioteci auxiliare (de exemplu, *.dll). Odat\u0103 ce procesul este deja pornit, acesta poate crea fire suplimentare. Firele permit procesului s\u0103 execute seturi diferite de instruc\u021biuni \u00een mod simultan. Exist\u0103 multe moduri de infiltrare a codului mali\u021bios \u00een memorie \u0219i de lansare a acestuia, s\u0103 examin\u0103m unele dintre ele.<\/p>\n<p>Cea mai simpl\u0103 metod\u0103 de a lansa un proces mali\u021bios este de a determina utilizatorul s\u0103 \u00eel execute direct (de exemplu, dintr-o ata\u0219are de e-mail), apoi, cu ajutorul unei chei RunOnce, s\u0103-l ruleze la fiecare pornire a computerului. De asemenea, se poate include \u0219i malware-ul \u201ef\u0103r\u0103 fi\u0219iere\u201d, care stocheaz\u0103 scripturi PowerShell \u00een cheile registrului, ce sunt executate pe baza unui declan\u0219ator. \u00cen acest caz, scriptul PowerShell este cod mali\u021bios.<\/p>\n<p>Problema cu lansarea explicit\u0103 a software-ului mali\u021bios este c\u0103 este o abordare cunoscut\u0103, u\u0219or de descoperit. Unele programe mali\u021bioase fac lucruri mai subtile, de exemplu, folosesc un alt proces pentru a \u00eencepe executarea \u00een memorie. Prin urmare, procesul poate crea un alt proces, execut\u00e2nd o anumit\u0103 instruc\u021biune computerizat\u0103 \u0219i specific\u00e2nd fi\u0219ierul executabil (.exe) pentru a fi lansat.<\/p>\n<p>Fi\u0219ierul poate fi specificat folosind calea complet\u0103 (de exemplu, C:Windowssystem32cmd.exe) sau calea par\u021bial\u0103 (de exemplu, cmd.exe). Dac\u0103 procesul surs\u0103 nu este sigur, acesta va permite rularea programelor ilegitime. Atacul poate ar\u0103ta astfel: procesul ruleaz\u0103 cmd.exe f\u0103r\u0103 a specifica calea complet\u0103, iar atacatorul plaseaz\u0103 propriul cmd.exe \u00eentr-un loc astfel \u00eenc\u00e2t procesul s\u0103-l lanseze \u00eenaintea celui legitim. Dup\u0103 ce malware-ul este lansat, acesta, la r\u00e2ndul s\u0103u, poate rula un program legitim (de exemplu, C:Windowssystem32cmd.exe), pentru ca programul surs\u0103 s\u0103 continue s\u0103 func\u021bioneze corect.<\/p>\n<p>O variant\u0103 a atacului anterior este injectarea DLL \u00een procesul legitim. C\u00e2nd procesul este lansat, acesta caut\u0103 \u0219i \u00eencarc\u0103 biblioteci care \u00eei extind func\u021bionalit\u0103\u021bile. Folosind injectarea DLL, atacatorul creeaz\u0103 o bibliotec\u0103 mali\u021bioas\u0103 cu acela\u0219i nume \u0219i API ca \u0219i cea legitim\u0103. Programul \u00eencarc\u0103 biblioteca mali\u021bioas\u0103, care, la r\u00e2ndul s\u0103u, \u00eencarc\u0103 biblioteca legitim\u0103 \u0219i, dup\u0103 cum este necesar, o cheam\u0103 pentru a efectua opera\u021biuni. Biblioteca mali\u021bioas\u0103 \u00eencepe s\u0103 joace rolul de intermediar pentru biblioteca bun\u0103.<\/p>\n<p>O alt\u0103 modalitate de a introduce cod mali\u021bios \u00een memorie este de a-l insera \u00eentr-un proces nesigur care este deja \u00een execu\u021bie. Procesele primesc date din diverse surse \u2014 citesc din re\u021bea sau din fi\u0219iere. De obicei, ele efectueaz\u0103 verific\u0103ri pentru a se asigura de legitimitatea datelor de intrare. \u00cens\u0103, unele procese nu au o protec\u021bie adecvat\u0103 atunci c\u00e2nd execut\u0103 instruc\u021biuni. \u00cen cadrul acestui tip de atac, nu exist\u0103 o bibliotec\u0103 pe disc sau un fi\u0219ier executabil cu cod mali\u021bios. Totul este stocat \u00een memorie \u00eempreun\u0103 cu procesul exploatat.<\/p>\n<p>Acum s\u0103 analiz\u0103m metodologia de activare a colect\u0103rii acestor evenimente \u00een Windows \u0219i a regulii din InTrust, care implementeaz\u0103 protec\u021bia \u00eempotriva unor astfel de amenin\u021b\u0103ri. \u00cen primul r\u00e2nd, activ\u0103m aceasta prin consola de administrare InTrust.<\/p>\n<p><img decoding=\"async\" alt=\"Activ\u0103m colectarea evenimentelor privind lansarea proceselor suspecte \u00een Windows \u0219i identific\u0103m amenin\u021b\u0103rile folosind Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/3ffc159a9b220c56b288256b286fdd8d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nRegula utilizeaz\u0103 capacit\u0103\u021bile de urm\u0103rire a proceselor din Windows. Din p\u0103cate, activarea colect\u0103rii acestor evenimente nu este deloc evident\u0103. Este necesar s\u0103 modifici 3 set\u0103ri diferite ale politicii de grup:<\/p>\n<p><b>Configurare Computer &gt; Politici &gt; Set\u0103ri Windows &gt; Set\u0103ri de Securitate &gt; Politici Locale &gt; Politica de Audit &gt; Auditarea urm\u0103rii proceselor<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Activ\u0103m colectarea evenimentelor privind lansarea proceselor suspecte \u00een Windows \u0219i identific\u0103m amenin\u021b\u0103rile folosind Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/03abc319d24bf82dbf9c728b6b37c794.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Configurare Computer &gt; Politici &gt; Set\u0103ri Windows &gt; Set\u0103ri de Securitate &gt; Configurarea avansat\u0103 a politicii de audit &gt; Politici de Audit &gt; Urm\u0103rire Detaliat\u0103 &gt; Auditarea cre\u0103rii proceselor<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Activ\u0103m colectarea evenimentelor privind lansarea proceselor suspecte \u00een Windows \u0219i identific\u0103m amenin\u021b\u0103rile folosind Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/3b017dc39789d55ae478e70e0034bd73.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Configurare Computer &gt; Politici &gt; \u0218abloane administrative &gt; Sistem &gt; Auditarea cre\u0103rii proceselor &gt; Inclusiv linia de comand\u0103 \u00een evenimentele de creare a proceselor<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Activ\u0103m colectarea evenimentelor privind lansarea proceselor suspecte \u00een Windows \u0219i identific\u0103m amenin\u021b\u0103rile folosind Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/13122278bc9ab6f7f6ff982654ce6dec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDup\u0103 activare, regulile InTrust permit detectarea amenin\u021b\u0103rilor necunoscute anterior, care manifest\u0103 un comportament suspect. De exemplu, se pot identifica <noindex><a rel=\"nofollow\" href=\"https:\/\/www.bromium.com\/dridex-threat-analysis-july-2019-variant\/\">cele descrise aici<\/a><\/noindex> programul mali\u021bios Dridex. Datorit\u0103 proiectului HP Bromium, se \u0219tie cum este structurat un astfel de pericol.<\/p>\n<p><img decoding=\"async\" alt=\"Activ\u0103m colectarea evenimentelor privind lansarea proceselor suspecte \u00een Windows \u0219i identific\u0103m amenin\u021b\u0103rile folosind Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/cbc09c039a088a3b6737d2d467c6a2ac.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00cen desf\u0103\u0219urarea ac\u021biunilor sale, Dridex folose\u0219te schtasks.exe pentru a crea o sarcin\u0103 programat\u0103. Utilizarea acestei utilit\u0103\u021bi din linia de comand\u0103 este considerat\u0103 un comportament foarte suspect, similar fiind \u0219i lansarea svchost.exe cu parametrii care indic\u0103 folderele utilizatorului sau cu parametrii asem\u0103n\u0103tori cu comenzile \u201enet view\u201d sau \u201ewhoami\u201d. Iat\u0103 un fragment din regula corespunz\u0103toare <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Neo23x0\/sigma\/blob\/master\/rules\/windows\/process_creation\/win_malware_dridex.yml\">regula SIGMA<\/a><\/noindex>:<\/p>\n<pre><code class=\"xml\">detection:\n    selection1:\n        CommandLine: '*svchost.exe C:Users\\*Desktop\\*'\n    selection2:\n        ParentImage: '*svchost.exe*'\n        CommandLine:\n            - '*whoami.exe \/all'\n            - '*net.exe view'\n    condition: 1 din acestea<\/code><\/pre>\n<p>\n\u00cen InTrust, tot comportamentul suspect este inclus \u00eentr-o singur\u0103 regul\u0103, deoarece cele mai multe dintre aceste ac\u021biuni nu sunt specifice unei amenin\u021b\u0103ri anume, ci sunt mai degrab\u0103 suspecte \u00een ansamblu \u0219i sunt utilizate \u00een 99% din cazuri \u00een scopuri mai pu\u021bin nobile. Aceast\u0103 list\u0103 de ac\u021biuni include, dar nu se limiteaz\u0103 la:<\/p>\n<ul>\n<li>Procesele care ruleaz\u0103 din locuri neobi\u0219nuite, cum ar fi folderele temporare ale utilizatorului.<\/li>\n<li>Un proces de sistem bine cunoscut cu un mo\u0219tenire suspect\u0103 \u2014 unele amenin\u021b\u0103ri pot \u00eencerca s\u0103 foloseasc\u0103 numele proceselor de sistem pentru a r\u0103m\u00e2ne nedetectate.<\/li>\n<li>Executarea suspect\u0103 a instrumentelor administrative, cum ar fi cmd sau PsExec, atunci c\u00e2nd utilizeaz\u0103 acreditivele sistemului local sau o mo\u0219tenire suspect\u0103.<\/li>\n<li>Opera\u021biuni suspecte de copiere shadow \u2014 comportament obi\u0219nuit al ransomware-ului \u00eenainte de criptarea sistemului, acestea elimin\u0103 copierea de siguran\u021b\u0103:\n<p> \u2014 Prin vssadmin.exe;<br \/>\n \u2014 Prin WMI.<\/li>\n<li>Dump-uri de registru \u00eentregi.<\/li>\n<li>Mi\u0219carea orizontal\u0103 a codului r\u0103u inten\u021bionat prin lansarea la distan\u021b\u0103 a procesului utiliz\u00e2nd comenzi precum at.exe.<\/li>\n<li>Opera\u021biuni locale de grup suspecte \u0219i opera\u021biuni de domeniu folosind net.exe.<\/li>\n<li>Opera\u021biuni suspecte ale firewall-ului folosind netsh.exe.<\/li>\n<li>Manipul\u0103ri suspecte ale ACL.<\/li>\n<li>Folosirea BITS pentru exfiltrarea datelor.<\/li>\n<li>Manipul\u0103ri suspecte ale WMI.<\/li>\n<li>Comenzi script suspecte.<\/li>\n<li>\u00cencerc\u0103ri de a dumpa fi\u0219ierele de sistem sigure.<\/li>\n<\/ul>\n<p>\nRegula combinat\u0103 func\u021bioneaz\u0103 foarte bine pentru detectarea amenin\u021b\u0103rilor, cum ar fi RUYK, LockerGoga \u0219i alte ransomware-uri, malware \u0219i instrumente pentru criminalitate cibernetic\u0103. Regula a fost verificat\u0103 de furnizor \u00een medii opera\u021bionale pentru a minimiza alarmele false. Iar datorit\u0103 proiectului SIGMA, majoritatea acestor indicatori genereaz\u0103 un num\u0103r minim de evenimente zgomotoase.<\/p>\n<p>\u00centruc\u00e2t \u00een InTrust aceasta este o regul\u0103 de monitorizare, pute\u021bi executa un scenariu de r\u0103spuns ca reac\u021bie la o amenin\u021bare. Pute\u021bi folosi unul dintre scenariile integrate sau crea propriul dvs., iar InTrust \u00eel va distribui automat.<\/p>\n<p><img decoding=\"async\" alt=\"Activ\u0103m colectarea evenimentelor privind lansarea proceselor suspecte \u00een Windows \u0219i identific\u0103m amenin\u021b\u0103rile folosind Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/fca2722b0465152e3de8f655af07bc91.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00cen plus, se poate verifica \u00eentreaga telemetrie asociat\u0103 cu evenimentul: scripturi PowerShell, execu\u021bia proceselor, manipul\u0103ri ale sarcinilor programate, activitate administrativ\u0103 WMI \u0219i s\u0103 le folose\u0219ti pentru postmortem \u00een cazurile de incidente de securitate.<\/p>\n<p><img decoding=\"async\" alt=\"Activ\u0103m colectarea evenimentelor privind lansarea proceselor suspecte \u00een Windows \u0219i identific\u0103m amenin\u021b\u0103rile folosind Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/81ee58b297523002ee26c25bda40f5bb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00cen InTrust exist\u0103 sute de alte reguli, dintre care c\u00e2teva sunt:<\/p>\n<ul>\n<li>Detectarea atacului de downgrade PowerShell \u2014 atunci c\u00e2nd cineva folose\u0219te \u00een mod intentionat o versiune mai veche de PowerShell, deoarece \u00een versiunea anterioar\u0103 nu exista posibilitatea de auditare a evenimentelor.<\/li>\n<li>Detectarea autentific\u0103rii cu nivel \u00eenalt de privilegii \u2014 atunci c\u00e2nd conturile care sunt membre ale unui anumit grup privilegiate (de exemplu, administratorii de domeniu) se autentific\u0103 \u00een mod interactiv pe sta\u021bii de lucru din \u00eent\u00e2mplare sau din cauza incidentelor de securitate.<\/li>\n<\/ul>\n<p>\nInTrust permite implementarea celor mai bune practici de securitate sub form\u0103 de reguli presetate pentru detectare \u0219i reac\u021bie. Dac\u0103 consideri c\u0103 ceva ar trebui s\u0103 func\u021bioneze diferit, po\u021bi crea o copie a regulii \u0219i s\u0103 o configurezi a\u0219a cum este necesar. Po\u021bi trimite o cerere pentru a efectua un pilot sau pentru a ob\u021bine distribu\u021bii cu licen\u021be temporare prin intermediul <noindex><a rel=\"nofollow\" href=\"https:\/\/gals.software\/vendors\/quest\/intrust#feedback\">formularul de feedback<\/a><\/noindex> site-ului nostru.<\/p>\n<p>Aboneaz\u0103-te la <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/GalsSoftware\/\">pagina noastr\u0103 de Facebook<\/a><\/noindex>, unde post\u0103m note scurte \u0219i linkuri interesante.<\/p>\n<p><b>Cite\u0219te alte articole de-ale noastre pe tema securit\u0103\u021bii informa\u021biilor:<\/b><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/513208\/\">Cum poate InTrust s\u0103 ajute la reducerea frecven\u021bei tentativelor de autentificare nereu\u0219ite prin RDP<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/474574\/\">Identific\u0103m atacul unui ransomware, ob\u021binem acces la controlerul de domeniu \u0219i \u00eencerc\u0103m s\u0103 facem fa\u021b\u0103 acestor atacuri<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447522\/\">Ce informa\u021bii utile pot fi extrase din jurnalele unei sta\u021bii de lucru bazate pe Windows<\/a><\/noindex> (articol popular)<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/464333\/\">Monitorizarea ciclului de via\u021b\u0103 al utilizatorilor f\u0103r\u0103 cle\u0219te \u0219i band\u0103 adeziv\u0103<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447512\/\">\u0218i cine a f\u0103cut asta? Automatiz\u0103m auditul securit\u0103\u021bii informa\u021biei<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/512908\/\">Cum s\u0103 reduce\u021bi costurile de de\u021binere a sistemului SIEM \u0219i de ce este necesar Managementul Centralizat al Jurnalelor (CLM)<\/a><\/noindex><br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/513714\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u0434\u043d\u0430 \u0438\u0437 \u0447\u0430\u0441\u0442\u043e \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0449\u0438\u0445\u0441\u044f \u0442\u0438\u043f\u043e\u0432 \u0430\u0442\u0430\u043a \u2014 \u043f\u043e\u0440\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u0437\u043b\u043e\u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0432 \u0434\u0435\u0440\u0435\u0432\u0435 \u043f\u043e\u0434 \u0432\u043f\u043e\u043b\u043d\u0435 \u0441\u0435\u0431\u0435 \u0434\u043e\u0431\u0440\u043e\u043f\u043e\u0440\u044f\u0434\u043e\u0447\u043d\u044b\u043c\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c\u0438. \u041f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0435 \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0443\u0442\u044c \u043a \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u043c\u0443 \u0444\u0430\u0439\u043b\u0443: \u0447\u0430\u0441\u0442\u0435\u043d\u044c\u043a\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043f\u0430\u043f\u043a\u0438 AppData \u0438\u043b\u0438 Temp, \u0430 \u044d\u0442\u043e \u043d\u0435\u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u043e \u0434\u043b\u044f \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c. \u0421\u043f\u0440\u0430\u0432\u0435\u0434\u043b\u0438\u0432\u043e\u0441\u0442\u0438 \u0440\u0430\u0434\u0438, \u0441\u0442\u043e\u0438\u0442 \u0441\u043a\u0430\u0437\u0430\u0442\u044c, \u0447\u0442\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u044e\u0442\u0441\u044f \u0432 AppData, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043e\u0434\u043d\u043e\u0439 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043c\u0435\u0441\u0442\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":90736,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-90735","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u0441\u0431\u043e\u0440 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0432 Windows \u0438 \u0432\u044b\u044f\u0432\u043b\u044f\u0435\u043c \u0443\u0433\u0440\u043e\u0437\u044b \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Quest InTrust | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-05T11:42:06+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-05T11:42:06+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Activ\u0103m colectarea evenimentelor legate de lansarea proceselor suspecte \u00een Windows \u0219i identific\u0103m amenin\u021b\u0103rile cu ajutorul Quest InTrust | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u0441\u0431\u043e\u0440 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0432 Windows \u0438 \u0432\u044b\u044f\u0432\u043b\u044f\u0435\u043c \u0443\u0433\u0440\u043e\u0437\u044b \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Quest InTrust | ProHoster","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-05T11:42:06+00:00","article:modified_time":"2020-08-05T11:42:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90735","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:43:42","updated":"2022-09-29 04:49:36","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/90735","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=90735"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/90735\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/90736"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=90735"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=90735"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=90735"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}