{"id":94862,"date":"2020-09-22T19:42:18","date_gmt":"2020-09-22T17:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/sysmon-teper-mozhet-zapisyvat-soderzhimoe-bufera-obmena"},"modified":"2020-09-22T19:42:18","modified_gmt":"2020-09-22T17:42:18","slug":"sysmon-teper-mozhet-zapisyvat-soderzhimoe-bufera-obmena","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/sysmon-teper-mozhet-zapisyvat-soderzhimoe-bufera-obmena","title":{"rendered":"Sysmon poate acum s\u0103 \u00eenregistreze con\u021binutul clipboard-ului","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Despre lansarea versiunii 12 a Sysmon s-a anun\u021bat pe 17 septembrie pe <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.microsoft.com\/en-us\/sysinternals\/\">pagina Sysinternals<\/a><\/noindex>. De fapt, \u00een aceast\u0103 zi au fost lansate \u0219i noi versiuni ale Process Monitor \u0219i ProcDump. \u00cen acest articol, voi \u00eemp\u0103rt\u0103\u0219i o inova\u021bie cheie \u0219i ambivalent\u0103 a versiunii 12 a Sysmon \u2014 tipul de evenimente cu ID-ul Event 24, \u00een care este \u00eenregistrat\u0103 activitatea cu clipboard-ul.<\/p>\n<p><img decoding=\"async\" alt=\"Sysmon poate acum s\u0103 \u00eenregistreze con\u021binutul clipboard-ului\" src=\"\/wp-content\/uploads\/2020\/09\/3e9939a4f6bce70e6b2c3be9d72454c1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nInforma\u021biile din acest tip de evenimente deschid noi oportunit\u0103\u021bi de control asupra activit\u0103\u021bii suspecte (dar \u0219i noi vulnerabilit\u0103\u021bi). Astfel, ve\u021bi putea \u00een\u021belege cine, de unde \u0219i ce anume a \u00eencercat s\u0103 copieze. \u00cen continuare, voi descrie c\u00e2teva c\u00e2mpuri ale noului eveniment \u0219i c\u00e2teva cazuri de utilizare.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nEvenimentul nou con\u021bine urm\u0103toarele c\u00e2mpuri:<\/p>\n<p><b>Image:<\/b> procesul ale c\u0103rui date au fost scrise \u00een clipboard.<br \/>\n<b>Session:<\/b> sesia \u00een care s-a realizat scrierea \u00een clipboard. Aceasta poate fi system(0) <br \/>\n \u00een cazul lucrului \u00een modul interactiv sau la distan\u021b\u0103 etc.<br \/>\n<b>ClientInfo:<\/b> con\u021bine numele utilizatorului sesiunii, iar \u00een cazul unei sesiuni de la distan\u021b\u0103 \u2014 numele gazdei surs\u0103 \u0219i adresa IP, dac\u0103 aceste date sunt disponibile.<br \/>\n<b>Hashes:<\/b> define\u0219te numele fi\u0219ierului \u00een care a fost salvat textul copiat (similar cu evenimentele de tip FileDelete).<br \/>\n<b>Archived:<\/b> starea, dac\u0103 textul din clipboard a fost salvat \u00een directorul arhiv\u0103 Sysmon.<\/p>\n<p>Cele dou\u0103 c\u00e2mpuri de la final genereaz\u0103 \u00eengrijorare. Problema este c\u0103, \u00eencep\u00e2nd cu versiunea 11, Sysmon poate (\u00een func\u021bie de set\u0103ri) salva diferite date \u00een directorul s\u0103u de arhiv\u0103. De exemplu, Event ID 23 \u00eenregistreaz\u0103 evenimente legate de \u0219tergerea fi\u0219ierelor \u0219i le poate salva tot \u00een acela\u0219i director de arhiv\u0103. Numele fi\u0219ierelor create ca urmare a activit\u0103\u021bii cu clipboard-ul primesc eticheta CLIP. Fi\u0219ierele \u00een sine con\u021bin datele exacte care au fost copiate \u00een clipboard.<\/p>\n<p>                        <b class=\"spoiler_title\">A\u0219a arat\u0103 un fi\u0219ier salvat<\/b><br \/>\n                        <img decoding=\"async\" alt=\"Sysmon poate acum s\u0103 \u00eenregistreze con\u021binutul clipboard-ului\" src=\"\/wp-content\/uploads\/2020\/09\/2a3989b724a06d19bcdb8c0d35294e71.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>\nSalvarea \u00eentr-un fi\u0219ier este activat\u0103 la instalare. Se pot stabili liste albe de procese pentru care textul nu va fi salvat.<\/p>\n<p>                        <b class=\"spoiler_title\">A\u0219a arat\u0103 instalarea Sysmon cu set\u0103rile corespunz\u0103toare pentru directorul de arhiv\u0103:<\/b><br \/>\n                        <img decoding=\"async\" alt=\"Sysmon poate acum s\u0103 \u00eenregistreze con\u021binutul clipboard-ului\" src=\"\/wp-content\/uploads\/2020\/09\/804bc7475d92886bc7d591e4ccb20eb7.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>\nAici, cred c\u0103 merit\u0103 s\u0103 ne amintim de managerii de parole, care folosesc de asemenea clipboard-ul. Prezen\u021ba Sysmon \u00een sistemul cu un manager de parole v\u0103 va permite (sau va permite unui atacator) s\u0103 capteze aceste parole. Dac\u0103 presupunem c\u0103 \u0219ti\u021bi ce proces aloc\u0103 textul copiat (iar acest lucru nu este \u00eentotdeauna procesul managerului de parole, ci poate fi un svchost oarecare), aceast\u0103 excep\u021bie poate fi ad\u0103ugat\u0103 \u00een lista alb\u0103 \u0219i nu va fi salvat\u0103.<\/p>\n<p>Poate c\u0103 nu \u0219tia\u021bi, dar textul din clipboard este capturat de serverul de la distan\u021b\u0103 atunci c\u00e2nd comuta\u021bi la el \u00een modul de sesiune RDP. Dac\u0103 ave\u021bi ceva \u00een clipboard \u0219i comuta\u021bi \u00eentre sesiunile RDP, aceste informa\u021bii vor c\u0103l\u0103tori cu dumneavoastr\u0103.<\/p>\n<p>S\u0103 facem un rezumat al capabilit\u0103\u021bilor Sysmon \u00een ceea ce prive\u0219te clipboard-ul.<\/p>\n<p>Se \u00eenregistreaz\u0103:<\/p>\n<ul>\n<li>Copierea textului lipit prin RDP \u0219i local;<\/li>\n<li>Capturarea datelor din clipboard de c\u0103tre diverse utilitare\/procese;<\/li>\n<li>Copierea\/lipirea textului de la\/spre o ma\u0219in\u0103 virtual\u0103 local\u0103, chiar dac\u0103 acest text nu a fost lipit \u00eenc\u0103.<\/li>\n<\/ul>\n<p>\nNu se \u00eenregistreaz\u0103:<\/p>\n<ul>\n<li>Copierea\/lipirea fi\u0219ierelor de la\/spre o ma\u0219in\u0103 virtual\u0103 local\u0103;<\/li>\n<li>Copierea\/lipirea fi\u0219ierelor prin RDP.<\/li>\n<li>Un malware care captureaz\u0103 clipboard-ul dumneavoastr\u0103 scrie doar \u00een clipboard.<\/li>\n<\/ul>\n<p>\nDe\u0219i are ambiguit\u0103\u021bi, acest tip de evenimente va permite restabilirea algoritmului de ac\u021biune al atacatorului \u0219i va ajuta la identificarea datelor anterior inaccesibile pentru a forma post-mortem-uri dup\u0103 atacuri. Dac\u0103 \u00eenregistrarea con\u021binutului \u00een clipboard este totu\u0219i activat\u0103, este crucial s\u0103 se \u00eenregistreze fiecare acces la directorul arhiv\u0103 \u0219i s\u0103 se identifice poten\u021bialele amenin\u021b\u0103ri (ini\u021biate nu de sysmon.exe).<\/p>\n<p>Pentru \u00eenregistrarea, analiza \u0219i reac\u021bia la evenimentele men\u021bionate mai sus, poate fi utilizat instrumentul <noindex><a rel=\"nofollow\" href=\"https:\/\/gals.software\/vendors\/quest\/intrust\">InTrust<\/a><\/noindex>, care combin\u0103 toate cele trei abord\u0103ri \u0219i, \u00een plus, este un depozit centralizat eficient pentru toate datele brute colectate. Putem s\u0103-i configur\u0103m integrarea cu sistemele SIEM populare pentru a minimiza costurile de licen\u021biere prin transferul proces\u0103rii \u0219i stoc\u0103rii datelor brute \u00een InTrust.<\/p>\n<p>Pentru a afla mai multe despre InTrust, citi\u021bi articolele noastre anterioare sau <noindex><a rel=\"nofollow\" href=\"https:\/\/gals.software\/vendors\/quest\/intrust#feedback\">l\u0103sa\u021bi un mesaj \u00een formularul de feedback<\/a><\/noindex>.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/512908\/\">Cum s\u0103 reduce\u021bi costurile de de\u021binere a sistemului SIEM \u0219i de ce este necesar Managementul Centralizat al Jurnalelor (CLM)<\/a><\/noindex> <\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/513714\/\">Activ\u0103m colectarea evenimentelor privind lansarea proceselor suspecte \u00een Windows \u0219i identific\u0103m amenin\u021b\u0103rile folosind Quest InTrust<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/513208\/\">Cum poate InTrust s\u0103 ajute la reducerea frecven\u021bei tentativelor de autentificare nereu\u0219ite prin RDP<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/474574\/\">Identific\u0103m atacul unui ransomware, ob\u021binem acces la controlerul de domeniu \u0219i \u00eencerc\u0103m s\u0103 facem fa\u021b\u0103 acestor atacuri<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447522\/\">Ce informa\u021bii utile pot fi extrase din jurnalele unei sta\u021bii de lucru bazate pe Windows<\/a><\/noindex> (articol popular)<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447512\/\">\u0218i cine a f\u0103cut asta? Automatiz\u0103m auditul securit\u0103\u021bii informa\u021biei<\/a><\/noindex><br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/520042\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e \u0440\u0435\u043b\u0438\u0437\u0435 12 \u0432\u0435\u0440\u0441\u0438\u0438 Sysmon \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 17 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0435 Sysinternals. \u041d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435 \u0432 \u044d\u0442\u043e\u0442 \u0434\u0435\u043d\u044c \u0432\u044b\u0448\u043b\u0438 \u0442\u0430\u043a\u0436\u0435 \u043d\u043e\u0432\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Process Monitor \u0438 ProcDump. \u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u044f \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0443 \u043e \u043a\u043b\u044e\u0447\u0435\u0432\u043e\u043c \u0438 \u043d\u0435\u043e\u0434\u043d\u043e\u0437\u043d\u0430\u0447\u043d\u043e\u043c \u043d\u043e\u0432\u043e\u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0438 12 \u0432\u0435\u0440\u0441\u0438\u0438 Sysmon \u2014 \u0442\u0438\u043f\u0435 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u0441 Event ID 24, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043b\u043e\u0433\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0440\u0430\u0431\u043e\u0442\u0430 \u0441 \u0431\u0443\u0444\u0435\u0440\u043e\u043c \u043e\u0431\u043c\u0435\u043d\u0430. \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u0438\u0437 \u044d\u0442\u043e\u0433\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94863,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94862","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e \u0440\u0435\u043b\u0438\u0437\u0435 12 \u0432\u0435\u0440\u0441\u0438\u0438 Sysmon \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 17 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0435 Sysinternals.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/sysmon-teper-mozhet-zapisyvat-soderzhimoe-bufera-obmena\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Sysmon \u0442\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e \u0440\u0435\u043b\u0438\u0437\u0435 12 \u0432\u0435\u0440\u0441\u0438\u0438 Sysmon \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 17 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0435 Sysinternals.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/sysmon-teper-mozhet-zapisyvat-soderzhimoe-bufera-obmena\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-22T17:42:18+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-22T17:42:18+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sysmon poate acum s\u0103 \u00eenregistreze con\u021binutul clipboard-ului | ProHoster","description":"Despre lansarea versiunii 12 a Sysmon s-a raportat pe 17 septembrie pe pagina Sysinternals.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/sysmon-teper-mozhet-zapisyvat-soderzhimoe-bufera-obmena","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Sysmon \u0442\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 | ProHoster","og:description":"\u041e \u0440\u0435\u043b\u0438\u0437\u0435 12 \u0432\u0435\u0440\u0441\u0438\u0438 Sysmon \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 17 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0435 Sysinternals.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/sysmon-teper-mozhet-zapisyvat-soderzhimoe-bufera-obmena","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-22T17:42:18+00:00","article:modified_time":"2020-09-22T17:42:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94862","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:16:37","updated":"2022-10-03 07:40:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/94862","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=94862"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/94862\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/94863"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=94862"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=94862"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=94862"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}