{"id":76039,"date":"2020-03-30T13:43:09","date_gmt":"2020-03-30T11:43:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery"},"modified":"2020-03-30T13:43:09","modified_gmt":"2020-03-30T11:43:09","slug":"kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery","title":{"rendered":"Ako syst\u00e9my anal\u00fdzy dopravy odha\u013euj\u00fa taktiky hackerov pod\u013ea MITRE ATT&amp;CK na pr\u00edklade PT Network Attack Discovery","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/pt\/blog\/493082\/\"><img decoding=\"async\" alt=\"Ako syst\u00e9my anal\u00fdzy trafficu odha\u013euj\u00fa taktiky hackerov pod\u013ea MITRE ATT&amp;CK na pr\u00edklade PT Network Attack Discovery\" src=\"\/wp-content\/uploads\/2020\/03\/75b6c4846867a15776529105f9657ffb.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.verizonenterprise.com\/resources\/reports\/rp_DBIR_2018_Report_execsummary_en_xg.pdf\">Pod\u013ea spolo\u010dnosti Verizon<\/a><\/noindex>, v\u00e4\u010d\u0161ina (87%) incidentov v oblasti kybernetickej bezpe\u010dnosti sa udeje v priebehu nieko\u013ek\u00fdch min\u00fat, zatia\u013e \u010do 68% spolo\u010dnost\u00ed si na ich odhalenie vy\u017eaduje mesiace. To potvrdzuje aj <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ibm.com\/security\/data-breach\">\u0161t\u00fadia Ponemon Institute<\/a><\/noindex>, pod\u013ea ktorej v\u00e4\u010d\u0161ina organiz\u00e1ci\u00ed potrebuje v priemere 206 dn\u00ed na odhalenie incidentu. Na z\u00e1klade na\u0161ich vy\u0161etrovan\u00ed m\u00f4\u017eu hackeri kontrolova\u0165 infra\u0161trukt\u00faru spolo\u010dnosti roky a nikdy by\u0165 neodhalen\u00ed. V jednej z organiz\u00e1ci\u00ed, kde na\u0161i odborn\u00edci vykon\u00e1vali vy\u0161etrovanie incidentu kybernetickej bezpe\u010dnosti, sa zistilo, \u017ee hackeri mali \u00fapln\u00fa kontrolu nad celou infra\u0161trukt\u00farou organiz\u00e1cie a pravidelne ukradli d\u00f4le\u017eit\u00e9 inform\u00e1cie <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ptsecurity.com\/ru-ru\/research\/analytics\/operation-taskmasters-2019\/?sphrase_id=71910\">po\u010das \u00f4smich rokov<\/a><\/noindex>.<\/p>\n<p>Predpokladajme, \u017ee u\u017e m\u00e1te funguj\u00face SIEM, ktor\u00e9 zbiera protokoly a analyzuje udalosti, a na koncov\u00fdch bodoch s\u00fa nain\u0161talovan\u00e9 antiv\u00edrusov\u00e9 programy. Napriek tomu <noindex><a rel=\"nofollow\" href=\"https:\/\/safe.cnews.ru\/articles\/2019-10-15_pochemu_hakery_legko_vzlamyvayut_nasa\">nie v\u0161etko sa d\u00e1 odhali\u0165 pomocou SIEM<\/a><\/noindex>, rovnako ako nie je mo\u017en\u00e9 nain\u0161talova\u0165 syst\u00e9my EDR na cel\u00fa sie\u0165, a preto sa \"slep\u00fdm\" z\u00f3nam ned\u00e1 vyhn\u00fa\u0165. S t\u00fdmito probl\u00e9mami pom\u00e1haj\u00fa syst\u00e9my anal\u00fdzy sie\u0165ovej prev\u00e1dzky (network traffic analysis, NTA). Tieto rie\u0161enia odha\u013euj\u00fa aktivitu \u00fato\u010dn\u00edkov v najskor\u0161\u00edch f\u00e1zach prenikania do siete, ako aj po\u010das pokusov o etablovanie a rozvoj \u00fatoku vn\u00fatri siete. <\/p>\n<p>NTA s\u00fa dvoch typov: niektor\u00e9 pracuj\u00fa s NetFlow, in\u00e9 analyzuj\u00fa surov\u00fa prev\u00e1dzku. V\u00fdhodou druh\u00fdch syst\u00e9mov je, \u017ee dok\u00e1\u017eu uchov\u00e1va\u0165 z\u00e1znamy surovej prev\u00e1dzky. V\u010faka tomu m\u00f4\u017ee odborn\u00edk na kybernetick\u00fa bezpe\u010dnos\u0165 skontrolova\u0165 \u00faspe\u0161nos\u0165 \u00fatoku, lokalizova\u0165 hrozbu, pochopi\u0165, ako k \u00fatoku do\u0161lo a ako predch\u00e1dza\u0165 podobn\u00fdm \u00fatokom v bud\u00facnosti.<\/p>\n<p>Uk\u00e1\u017eeme, ako pomocou NTA mo\u017eno pod\u013ea priamych alebo nepriamych znakov odhali\u0165 v\u0161etky zn\u00e1m\u00e9 taktiky \u00fatokov pop\u00edsan\u00e9 v datab\u00e1ze znalost\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/\">MITRE ATT&amp;CK<\/a><\/noindex>. Rozpr\u00e1vame o ka\u017edej z 12 takt\u00edk, presk\u00famame techniky, ktor\u00e9 s\u00fa detekovate\u013en\u00e9 pod\u013ea prev\u00e1dzky, a predvedieme ich odhalenie pomocou n\u00e1\u0161ho NTA syst\u00e9mu. <noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>O datab\u00e1ze znalost\u00ed ATT&amp;CK<\/h2>\n<p>\nMITRE ATT&amp;CK je verejn\u00e1 datab\u00e1za znalost\u00ed, vyvinut\u00e1 a spravovan\u00e1 spolo\u010dnos\u0165ou MITRE na z\u00e1klade anal\u00fdzy re\u00e1lnych APT. Predstavuje \u0161trukt\u00farovan\u00fd s\u00fabor takt\u00edk a techn\u00edk, ktor\u00e9 pou\u017e\u00edvaj\u00fa \u00fato\u010dn\u00edci. To umo\u017e\u0148uje odborn\u00edkom na informa\u010dn\u00fa bezpe\u010dnos\u0165 z cel\u00e9ho sveta komunikova\u0165 v jednom jazyku. Datab\u00e1za sa neust\u00e1le roz\u0161iruje a dop\u013a\u0148a nov\u00fdmi vedomos\u0165ami.<\/p>\n<p>V datab\u00e1ze sa vy\u010dle\u0148uje 12 takt\u00edk, ktor\u00e9 s\u00fa rozdelen\u00e9 pod\u013ea f\u00e1z kybernetick\u00e9ho \u00fatoku: <\/p>\n<ul>\n<li>po\u010diato\u010dn\u00fd pr\u00edstup (initial access);<\/li>\n<li>vykon\u00e1vanie (execution);<\/li>\n<li>zotrv\u00e1vanie (persistence);<\/li>\n<li>zv\u00fd\u0161enie opr\u00e1vnen\u00ed (privilege escalation);<\/li>\n<li>predch\u00e1dzanie odhaleniu (defense evasion);<\/li>\n<li>pr\u00edstup k povereniam (credential access);<\/li>\n<li>prieskum (discovery);<\/li>\n<li>presun v r\u00e1mci perimetra (lateral movement);<\/li>\n<li>zhroma\u017e\u010fovanie \u00fadajov (collection);<\/li>\n<li>riadenie a kontrola (command and control);<\/li>\n<li>exfiltr\u00e1cia \u00fadajov (exfiltration);<\/li>\n<li>dopad (impact).<\/li>\n<\/ul>\n<p>\nPre ka\u017ed\u00fa taktiku v datab\u00e1ze ATT&amp;CK je uveden\u00fd zoznam techn\u00edk, ktor\u00e9 pom\u00e1haj\u00fa \u00fato\u010dn\u00edkom dosiahnu\u0165 cie\u013e v aktu\u00e1lnej f\u00e1ze \u00fatoku. Ke\u010f\u017ee t\u00e1 ist\u00e1 technika m\u00f4\u017ee by\u0165 pou\u017eit\u00e1 v r\u00f4znych f\u00e1zach, m\u00f4\u017ee sa vz\u0165ahova\u0165 na viacero takt\u00edk. <\/p>\n<p>Popis ka\u017edej techniky obsahuje:<\/p>\n<ul>\n<li>identifik\u00e1tor;<\/li>\n<li>zoznam takt\u00edk, v ktor\u00fdch je pou\u017e\u00edvan\u00e1;<\/li>\n<li>pr\u00edklady pou\u017eitia APT skupinami;<\/li>\n<li>opatrenia na zn\u00ed\u017eenie \u0161k\u00f4d z jej pou\u017eitia;<\/li>\n<li>odpor\u00fa\u010dania na detekciu. <\/li>\n<\/ul>\n<p>\nIB odborn\u00edci m\u00f4\u017eu vyu\u017ei\u0165 znalosti z datab\u00e1zy na \u0161trukt\u00farovanie inform\u00e1ci\u00ed o aktu\u00e1lnych metod\u00e1ch \u00fatokov a na tejto b\u00e1ze vybudova\u0165 efekt\u00edvny bezpe\u010dnostn\u00fd syst\u00e9m. Porozumenie, ako skuto\u010dn\u00e9 APT skupiny funguj\u00fa, m\u00f4\u017ee tie\u017e sl\u00fa\u017ei\u0165 ako zdroj hypot\u00e9z pre proakt\u00edvne vyh\u013ead\u00e1vanie hrozieb v r\u00e1mci <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ptsecurity.com\/ru-ru\/research\/webinar\/302112\/\">threat hunting<\/a><\/noindex>. <\/p>\n<h3>O PT Network Attack Discovery<\/h3>\n<p>\nIdentifikujeme pou\u017eitie techn\u00edk z matice ATT&amp;CK pomocou syst\u00e9mu <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ptsecurity.com\/ru-ru\/products\/network-attack-discovery\/?utm_source=press_release&amp;utm_medium=press_release&amp;utm_campaign=new_nad\">PT Network Attack Discovery <\/a><\/noindex>\u2014 NTA syst\u00e9m Positive Technologies, ur\u010den\u00fd na odha\u013eovanie \u00fatokov na perimetri a vo vn\u00fatri siete. PT NAD pokr\u00fdva v r\u00f4znej miere v\u0161etk\u00fdch 12 takt\u00edk matice MITRE ATT&amp;CK. Najsilnej\u0161\u00ed je v odha\u013eovan\u00ed techn\u00edk po\u010diato\u010dn\u00e9ho pr\u00edstupu (initial access), presunu v r\u00e1mci perimetra (lateral movement) a riadenia a kontroly (command and control). V tomto pokr\u00fdva PT NAD viac ako polovicu zn\u00e1mych techn\u00edk, pri\u010dom ich odha\u013euje na z\u00e1klade priameho alebo nepriameho znaku. <\/p>\n<p>Syst\u00e9m identifikuje \u00fatoky s pou\u017eit\u00edm techn\u00edk ATT&amp;CK pomocou detek\u010dn\u00fdch pravidiel vytvoren\u00fdch t\u00edmom <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ptsecurity.com\/ru-ru\/products\/network-attack-discovery\/?utm_source=press_release&amp;utm_medium=press_release&amp;utm_campaign=new_nad\">PT Expert Security Center<\/a><\/noindex> (PT ESC), strojov\u00e9ho u\u010denia, indik\u00e1torov kompromit\u00e1cie, h\u013abkovej analytiky a retrospekt\u00edvnej anal\u00fdzy. Analyzovanie prev\u00e1dzky v re\u00e1lnom \u010dase spolu s retrospekt\u00edvou umo\u017e\u0148uje identifikova\u0165 aktu\u00e1lnu skryt\u00fa \u0161kodliv\u00fa \u010dinnos\u0165 a sledova\u0165 v\u00fdvojov\u00e9 vektory a chronol\u00f3giu \u00fatokov.<\/p>\n<blockquote><p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/-l\/o8\/yc\/-lo8ycywq-rl1g_v1pt9-lmnj3y.png\">Tu<\/a><\/noindex> \u00fapln\u00e9 mapovanie PT NAD na maticu MITRE ATT&amp;CK. Obraz je ve\u013ek\u00fd, tak\u017ee v\u00e1m ho pon\u00fakame na presk\u00famanie v samostatnom okne.<\/p><\/blockquote>\n<p><\/p>\n<h3>Po\u010diato\u010dn\u00fd pr\u00edstup (initial access)<\/h3>\n<p><img decoding=\"async\" alt=\"Ako syst\u00e9my anal\u00fdzy trafficu odha\u013euj\u00fa taktiky hackerov pod\u013ea MITRE ATT&amp;CK na pr\u00edklade PT Network Attack Discovery\" src=\"\/wp-content\/uploads\/2020\/03\/93cc3669c7de3b5193897d685e63a72f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTaktika z\u00edskania prvotn\u00e9ho pr\u00edstupu zah\u0155\u0148a techniky na prenikanie do siete spolo\u010dnosti. Cie\u013e \u00fato\u010dn\u00edkov v tejto f\u00e1ze je doru\u010di\u0165 do napadnutej syst\u00e9mu \u0161kodliv\u00fd k\u00f3d a zabezpe\u010di\u0165 mo\u017enos\u0165 jeho \u010fal\u0161ieho vykonania.<\/p>\n<p>Anal\u00fdza prev\u00e1dzky s PT NAD umo\u017e\u0148uje identifikova\u0165 sedem techn\u00edk z\u00edskania prvotn\u00e9ho pr\u00edstupu:<\/p>\n<h3>1. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1189\/\">T1189<\/a><\/noindex>: kompromit\u00e1cia cez web<\/h3>\n<p>\nTechnika, pri ktorej obet otvor\u00ed webov\u00fa str\u00e1nku, ktor\u00fa \u00fato\u010dn\u00edci pou\u017e\u00edvaj\u00fa na vyu\u017eitie webov\u00e9ho prehliada\u010da a z\u00edskanie pr\u00edstupov\u00fdch tokenov k aplik\u00e1cii. <\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: ak je webov\u00fd prenos ne\u0161ifrovan\u00fd, PT NAD sk\u00fama obsah odpoved\u00ed HTTP serverov. Pr\u00e1ve v t\u00fdchto odpovediach s\u00fa exploity, ktor\u00e9 umo\u017e\u0148uj\u00fa \u00fato\u010dn\u00edkom vykona\u0165 \u013eubovo\u013en\u00fd k\u00f3d v r\u00e1mci prehliada\u010da. PT NAD automaticky identifikuje tak\u00e9 exploity pomocou detek\u010dn\u00fdch pravidiel. <\/p>\n<p>Okrem toho PT NAD odha\u013euje hrozbu v predch\u00e1dzaj\u00facom kroku. Pravidl\u00e1 a indik\u00e1tory kompromit\u00e1cie sa sp\u00fa\u0161\u0165aj\u00fa, ak pou\u017e\u00edvate\u013e nav\u0161t\u00edvil str\u00e1nku, ktor\u00e1 ho preposlala na str\u00e1nku so sadou exploitov.<\/p>\n<h3>2. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1190\">T1190<\/a><\/noindex>: exploit verejne pr\u00edstupnej aplik\u00e1cie<\/h3>\n<p>\nVyu\u017eitie zranite\u013enost\u00ed v slu\u017eb\u00e1ch, ktor\u00e9 s\u00fa pr\u00edstupn\u00e9 z internetu. <\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: vykon\u00e1va hlbok\u00fa kontrolu obsahu sie\u0165ov\u00fdch paketov, odha\u013euj\u00fac v \u0148om znaky anom\u00e1lnej aktivity. V \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, existuj\u00fa pravidl\u00e1, ktor\u00e9 umo\u017e\u0148uj\u00fa odha\u013eova\u0165 \u00fatoky na hlavn\u00e9 syst\u00e9my spr\u00e1vy obsahu (CMS), webov\u00e9 rozhrania sie\u0165ov\u00fdch zariaden\u00ed, \u00fatoky na po\u0161tov\u00e9 a FTP servery.<\/p>\n<h3>3. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1133\/\">T1133<\/a><\/noindex>: extern\u00e9 vzdialen\u00e9 slu\u017eby <\/h3>\n<p>\nVyu\u017e\u00edvanie \u00fato\u010dn\u00edkmi slu\u017eieb vzdialen\u00e9ho pr\u00edstupu na pripojenie k prostriedkom vn\u00fatornej siete z vonku. <\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: preto\u017ee syst\u00e9m rozpozn\u00e1va protokoly nie pod\u013ea \u010d\u00edsel portov, ale pod\u013ea obsahu paketov, pou\u017e\u00edvatelia syst\u00e9mu m\u00f4\u017eu filtrova\u0165 prev\u00e1dzku tak, aby na\u0161li v\u0161etky session protokolov vzdialen\u00e9ho pr\u00edstupu a skontrolovali ich legitimitu. <\/p>\n<h3>4. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1193\/\">T1193<\/a><\/noindex>: phishingov\u00fd pr\u00edloha <\/h3>\n<p>\nIde o presl\u00e1ven\u00e9 zasielanie phishingov\u00fdch pr\u00edloh.<\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: automaticky extrahuje s\u00fabory z prev\u00e1dzky a overuje ich pod\u013ea indik\u00e1torov kompromit\u00e1cie. Spustite\u013en\u00e9 s\u00fabory v pr\u00edloh\u00e1ch s\u00fa identifikovan\u00e9 pravidlami, ktor\u00e9 analyzuj\u00fa obsah po\u0161tovej prev\u00e1dzky. V korpor\u00e1tnom prostred\u00ed sa tak\u00e1to pr\u00edloha pova\u017euje za anom\u00e1lnu. <\/p>\n<h3>5. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1192\/\">T1192<\/a><\/noindex>: phishingov\u00fd odkaz <\/h3>\n<p>\nPou\u017eitie phishingov\u00fdch odkazov. Technika spo\u010d\u00edva v zasielan\u00ed phishingov\u00e9ho e-mailu so zl\u00fdmi odkazmi, na ktor\u00e9 kliknut\u00edm sa stiahne \u0161kodliv\u00fd program. Zvy\u010dajne je odkaz sprev\u00e1dzan\u00fd textom, ktor\u00fd je zostaven\u00fd pod\u013ea v\u0161etk\u00fdch pravidiel soci\u00e1lneho in\u017einierstva. <\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: odha\u013euje phishingov\u00e9 odkazy pomocou indik\u00e1torov kompromit\u00e1cie. Napr\u00edklad v rozhran\u00ed PT NAD vid\u00edme rel\u00e1ciu, v ktorej bolo HTTP pripojenie na odkaz, ktor\u00fd bol zaraden\u00fd do zoznamu phishingov\u00fdch adries (phishing-urls).<\/p>\n<p><img decoding=\"async\" alt=\"Ako syst\u00e9my anal\u00fdzy trafficu odha\u013euj\u00fa taktiky hackerov pod\u013ea MITRE ATT&amp;CK na pr\u00edklade PT Network Attack Discovery\" src=\"\/wp-content\/uploads\/2020\/03\/f8b8f0ed7e64da6a9ceb2c3e8d3b3202.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Pripojenie na odkaz zo zoznamu indik\u00e1torov kompromit\u00e1cie phishing-urls<\/i><\/p>\n<h3>6. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1199\">T1199<\/a><\/noindex>: d\u00f4veryhodn\u00fd vz\u0165ah<\/h3>\n<p>\nPr\u00edstup do siete obete prostredn\u00edctvom tret\u00edch str\u00e1n, s ktor\u00fdmi m\u00e1 obe\u0165 vytvoren\u00e9 d\u00f4veryhodn\u00e9 vz\u0165ahy. \u00dato\u010dn\u00edci m\u00f4\u017eu hackn\u00fa\u0165 d\u00f4veryhodn\u00fa organiz\u00e1ciu a pripoji\u0165 sa cez \u0148u k cie\u013eovej sieti. Na to pou\u017e\u00edvaj\u00fa VPN pripojenia alebo vz\u0165ahy d\u00f4very dom\u00e9n, \u010do je mo\u017en\u00e9 odhali\u0165 pomocou anal\u00fdzy prev\u00e1dzky. <\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: rozober\u00e1 aplika\u010dn\u00e9 protokoly a uklad\u00e1 rozobrat\u00e9 polia do datab\u00e1zy, v\u010faka \u010domu m\u00f4\u017ee analytik IKT pomocou filtrov n\u00e1js\u0165 v datab\u00e1ze v\u0161etky podozriv\u00e9 VPN pripojenia alebo medzi-dom\u00e9nov\u00e9 pripojenia.<\/p>\n<h3>7. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1078\/\">T1078<\/a><\/noindex>: platn\u00e9 \u00fa\u010dty<\/h3>\n<p>\nPou\u017eitie \u0161tandardn\u00fdch, lok\u00e1lnych alebo dom\u00e9nov\u00fdch prihlasovac\u00edch \u00fadajov na autoriz\u00e1ciu na extern\u00fdch a intern\u00fdch slu\u017eb\u00e1ch.<\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: automaticky extrahuje prihlasovacie \u00fadaje z protokolov HTTP, FTP, SMTP, POP3, IMAP, SMB, DCE\/RPC, SOCKS5, LDAP, Kerberos. V\u0161eobecne ide o prihl\u00e1senie, heslo a znak \u00faspe\u0161nosti autentifik\u00e1cie. Ak boli pou\u017eit\u00e9, zobrazuj\u00fa sa v pr\u00edslu\u0161nej karte rel\u00e1cie.<\/p>\n<h2>Vykonanie (execution)<\/h2>\n<p><img decoding=\"async\" alt=\"Ako syst\u00e9my anal\u00fdzy trafficu odha\u013euj\u00fa taktiky hackerov pod\u013ea MITRE ATT&amp;CK na pr\u00edklade PT Network Attack Discovery\" src=\"\/wp-content\/uploads\/2020\/03\/54cfa8b924eb5061d7cc8bc93335c735.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nDo taktiky Vykonanie patr\u00ed technika, ktor\u00fa \u00fato\u010dn\u00edci pou\u017e\u00edvaj\u00fa na vykon\u00e1vanie k\u00f3du v skompromitovan\u00fdch syst\u00e9moch. Spustenie \u0161kodliv\u00e9ho k\u00f3du pom\u00e1ha \u00fato\u010dn\u00edkom udr\u017ea\u0165 si pr\u00edtomnos\u0165 (taktika persistence) a roz\u0161\u00edri\u0165 pr\u00edstup k vzdialen\u00fdm syst\u00e9mom v sieti, pohybuj\u00fac sa vo vn\u00fatri perimetra. <\/p>\n<p>PT NAD umo\u017e\u0148uje odhali\u0165 pou\u017eitie 14 techn\u00edk \u00fato\u010dn\u00edkmi, ktor\u00e9 sa pou\u017e\u00edvaj\u00fa na vykon\u00e1vanie \u0161kodliv\u00e9ho k\u00f3du. <\/p>\n<h3>1. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1191\/\">T1191<\/a><\/noindex>: CMSTP (Microsoft Connection Manager Profile Installer)<\/h3>\n<p>\nTaktika, pri ktorej \u00fato\u010dn\u00edci pripravuj\u00fa \u0161peci\u00e1lny \u0161kodliv\u00fd in\u0161tala\u010dn\u00fd INF s\u00fabor pre integrovan\u00fd n\u00e1stroj CMSTP.exe vo Windows (in\u0161tal\u00e1tor profilov spr\u00e1vcu pripojen\u00ed). CMSTP.exe prij\u00edma s\u00fabor ako parameter a in\u0161taluje profil slu\u017eby pre vzdialen\u00e9 pripojenie. V d\u00f4sledku toho m\u00f4\u017ee by\u0165 CMSTP.exe vyu\u017eit\u00fd na na\u010d\u00edtanie a vykon\u00e1vanie dynamicky pripojen\u00fdch kni\u017en\u00edc (*.dll) alebo skriptov (*.sct) zo vzdialen\u00fdch serverov. <\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: automaticky zis\u0165uje v HTTP prenosoch prenos INF s\u00faborov \u0161peci\u00e1lneho typu. Okrem toho zis\u0165uje prenos \u0161kodliv\u00fdch skriptov a dynamicky pripojen\u00fdch kni\u017en\u00edc cez protokol HTTP zo vzdialen\u00e9ho servera. <\/p>\n<h3>2. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1059\">T1059<\/a><\/noindex>: rozhranie pr\u00edkazov\u00e9ho riadku <\/h3>\n<p>\nInterakcia s rozhran\u00edm pr\u00edkazov\u00e9ho riadku. S rozhran\u00edm pr\u00edkazov\u00e9ho riadku je mo\u017en\u00e9 interagova\u0165 lok\u00e1lne alebo vzdialene, napr\u00edklad pomocou n\u00e1strojov na vzdialen\u00fd pr\u00edstup.<\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: automaticky detekuje pr\u00edtomnos\u0165 shell-ov na odpovediach na pr\u00edkazy sp\u00fa\u0161\u0165ania r\u00f4znych n\u00e1strojov pr\u00edkazov\u00e9ho riadku, ako s\u00fa ping, ifconfig.<\/p>\n<h3>3. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1175\/\">T1175<\/a><\/noindex>: komponentov\u00fd objektov\u00fd model a distribuovan\u00e9 COM <\/h3>\n<p>\nPou\u017e\u00edvanie technol\u00f3gie COM alebo DCOM na vykon\u00e1vanie k\u00f3du na lok\u00e1lnych alebo vzdialen\u00fdch syst\u00e9moch pri pohybe v sieti.<\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: detekuje podozriv\u00e9 DCOM volania, ktor\u00e9 \u00fato\u010dn\u00edci zvy\u010dajne pou\u017e\u00edvaj\u00fa na sp\u00fa\u0161\u0165anie programov. <\/p>\n<h3>4. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1203\/\">T1203<\/a><\/noindex>: zneu\u017e\u00edvanie na vykon\u00e1vanie na klientovi <\/h3>\n<p>\nZneu\u017e\u00edvanie zranite\u013enost\u00ed na vykon\u00e1vanie \u013eubovo\u013en\u00e9ho k\u00f3du na pracovnej stanici. Naju\u017eito\u010dnej\u0161ie exploit-y pre \u00fato\u010dn\u00edkov s\u00fa tie, ktor\u00e9 umo\u017e\u0148uj\u00fa vykon\u00e1va\u0165 k\u00f3d na vzdialenom syst\u00e9me, preto\u017ee s ich pomocou m\u00f4\u017eu \u00fato\u010dn\u00edci z\u00edska\u0165 pr\u00edstup k takejto s\u00fastave. Technika m\u00f4\u017ee by\u0165 realizovan\u00e1 nasleduj\u00facimi met\u00f3dami: \u0161kodliv\u00e1 po\u0161tov\u00e1 distrib\u00facia, webov\u00e1 str\u00e1nka s exploitmi pre prehliada\u010de a vzdialen\u00e9 zneu\u017e\u00edvanie zranite\u013enost\u00ed aplik\u00e1ci\u00ed. <\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: po\u010das anal\u00fdzy po\u0161tovej prem\u00e1vky PT NAD kontroluje, \u010di s\u00fa v pr\u00edloh\u00e1ch vykonate\u013en\u00e9 s\u00fabory. Automaticky extrahuje kancel\u00e1rske dokumenty z e-mailov, v ktor\u00fdch m\u00f4\u017eu by\u0165 exploity. Pokusy o zneu\u017e\u00edvanie zranite\u013enost\u00ed s\u00fa vidite\u013en\u00e9 v prem\u00e1vke, \u010do PT NAD deteguje automaticky.<\/p>\n<h3>5. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1170\">T1170<\/a><\/noindex>: mshta<\/h3>\n<p>\nPou\u017eitie n\u00e1stroja mshta.exe, ktor\u00fd vykon\u00e1va aplik\u00e1cie Microsoft HTML (HTA) s pr\u00edponou .hta. Ke\u010f\u017ee mshta spracov\u00e1va s\u00fabory obch\u00e1dzaj\u00fac nastavenia zabezpe\u010denia prehliada\u010da, \u00fato\u010dn\u00edci m\u00f4\u017eu vyu\u017ei\u0165 mshta.exe na vykon\u00e1vanie \u0161kodliv\u00fdch s\u00faborov HTA, JavaScript alebo VBScript. <\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: s\u00fabory .hta na vykon\u00e1vanie cez mshta sa pren\u00e1\u0161aj\u00fa aj cez sie\u0165 \u2014 to je vidite\u013en\u00e9 v prenosoch. PT NAD automaticky identifikuje prenos tak\u00fdchto \u0161kodliv\u00fdch s\u00faborov. Zaznamen\u00e1va s\u00fabory a inform\u00e1cie o nich s\u00fa dostupn\u00e9 v karte rel\u00e1cie.<\/p>\n<h3>6. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1086\">T1086<\/a><\/noindex>: PowerShell <\/h3>\n<p>\nPou\u017eitie PowerShellu na vyh\u013ead\u00e1vanie inform\u00e1ci\u00ed a vykon\u00e1vanie \u0161kodliv\u00e9ho k\u00f3du. <\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: ke\u010f sa PowerShell pou\u017e\u00edva \u00fato\u010dn\u00edkmi na dia\u013eku, PT NAD to detekuje pomocou pravidiel. Zist\u00ed k\u013e\u00fa\u010dov\u00e9 slov\u00e1 jazyka PowerShell, ktor\u00e9 s\u00fa naj\u010dastej\u0161ie pou\u017e\u00edvan\u00e9 v \u0161kodliv\u00fdch skriptoch, a prenos PowerShell skriptov cez protokol SMB.<\/p>\n<p>7. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1053\">T1053<\/a><\/noindex>: pl\u00e1novan\u00e1 \u00faloha<br \/>\nPou\u017eitie pl\u00e1nova\u010da \u00faloh Windows a in\u00fdch n\u00e1strojov na automatick\u00e9 sp\u00fa\u0161\u0165anie programov alebo skriptov v ur\u010ditom \u010dase. <\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: \u00fato\u010dn\u00edci vytv\u00e1raj\u00fa tak\u00e9to \u00falohy zvy\u010dajne na dia\u013eku, \u010do znamen\u00e1, \u017ee tak\u00e9to rel\u00e1cie s\u00fa vidite\u013en\u00e9 v prenosoch. PT NAD automaticky identifikuje podozriv\u00e9 oper\u00e1cie pri vytv\u00e1ran\u00ed a zmene \u00faloh pou\u017e\u00edvan\u00edm RPC rozhran\u00ed ATSVC a ITaskSchedulerService.<\/p>\n<h3>8. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1064\">T1064<\/a><\/noindex>: skriptovanie <\/h3>\n<p>\nVykon\u00e1vanie skriptov na automatiz\u00e1ciu r\u00f4znych akci\u00ed \u00fato\u010dn\u00edkov. <\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: identifikuje skuto\u010dnosti prenosu skriptov cez sie\u0165, teda e\u0161te pred ich spusten\u00edm. Zist\u00ed obsah skriptov v surov\u00fdch prenosoch a detekuje pren\u00e1\u0161anie s\u00faborov so pr\u00edponami, ktor\u00e9 zodpovedaj\u00fa popul\u00e1rnym skriptovac\u00edm jazykom.<\/p>\n<h3>9. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1035\">T1035<\/a><\/noindex>: vykon\u00e1vanie slu\u017eieb<\/h3>\n<p>\nSpustenie spustite\u013en\u00e9ho s\u00faboru, pr\u00edkazov rozhrania pr\u00edkazov\u00e9ho riadku alebo skriptu pomocou interakcie so slu\u017ebami Windows, napr\u00edklad pomocou spr\u00e1vcu slu\u017eieb (Service Control Manager, SCM). <\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: kontroluje SMB prenosy a identifikuje pr\u00edstup k SCM pod\u013ea pravidiel na vytv\u00e1ranie, zmenu a sp\u00fa\u0161\u0165anie slu\u017eieb. <\/p>\n<p>Technika spustenia slu\u017eieb m\u00f4\u017ee by\u0165 implementovan\u00e1 pomocou n\u00e1stroja na vzdialen\u00e9 vykon\u00e1vanie pr\u00edkazov PSExec. PT NAD analyzuje protokol SMB a deteguje pou\u017eitie PSExec, ke\u010f pou\u017e\u00edva s\u00fabor PSEXESVC.exe alebo \u0161tandardn\u00fd n\u00e1zov slu\u017eby PSEXECSVC na vykonanie k\u00f3du na vzdialenom po\u010d\u00edta\u010di. Pou\u017e\u00edvate\u013e by mal skontrolova\u0165 zoznam vykonan\u00fdch pr\u00edkazov a legit\u00edmnos\u0165 vzdialen\u00e9ho vykon\u00e1vania pr\u00edkazov z uzla. <\/p>\n<blockquote><p>Na karte \u00fatoku v PT NAD s\u00fa zobrazen\u00e9 \u00fadaje o pou\u017eit\u00fdch taktik\u00e1ch a technik\u00e1ch pod\u013ea matice ATT&amp;CK, aby pou\u017e\u00edvate\u013e mohol pochopi\u0165, v ktorej f\u00e1ze \u00fatoku sa nach\u00e1dzaj\u00fa \u00fato\u010dn\u00edci, ak\u00e9 ciele sleduj\u00fa a ak\u00e9 protiopatrenia prija\u0165. <\/p><\/blockquote>\n<p>\n<img decoding=\"async\" alt=\"Ako syst\u00e9my anal\u00fdzy trafficu odha\u013euj\u00fa taktiky hackerov pod\u013ea MITRE ATT&amp;CK na pr\u00edklade PT Network Attack Discovery\" src=\"\/wp-content\/uploads\/2020\/03\/cef63cd458947bf4b4a7735a44362f30.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Uplatnenie pravidla o pou\u017eit\u00ed n\u00e1stroja PSExec, \u010do m\u00f4\u017ee nazna\u010dova\u0165 pokus o vykonanie pr\u00edkazov na vzdialenom po\u010d\u00edta\u010di.<\/i><\/p>\n<h3>10. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1072\/\">T1072<\/a><\/noindex>: tretie strany<\/h3>\n<p>\nTechnika, pri ktorej sa \u00fato\u010dn\u00edci dost\u00e1vaj\u00fa k softv\u00e9ru na vzdialen\u00e9 spravovanie alebo podnikovej distribu\u010dnej syst\u00e9me softv\u00e9ru a s pomocou neho sp\u00fa\u0161\u0165aj\u00fa \u0161kodliv\u00fd k\u00f3d. Pr\u00edklady tak\u00e9ho softv\u00e9ru: SCCM, VNC, TeamViewer, HBSS, Altiris. <br \/>\nMimochodom, t\u00e1to technika je obzvl\u00e1\u0161\u0165 relevantn\u00e1 kv\u00f4li masov\u00e9mu prechodu na pr\u00e1cu na dia\u013eku a, ako n\u00e1sledok, pripojeniu mnoh\u00fdch dom\u00e1cich nezabezpe\u010den\u00fdch zariaden\u00ed cez pochybn\u00e9 kan\u00e1ly vzdialen\u00e9ho pr\u00edstupu.<\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: automaticky zist\u00ed v sieti fungovanie tak\u00e9ho softv\u00e9ru. Napr\u00edklad pravidl\u00e1 reaguj\u00fa na pripojenia cez protokol VNC a aktivitu tr\u00f3jskeho ko\u0148a EvilVNC, ktor\u00fd potichu in\u0161taluje VNC server na hostite\u013eovi obete a automaticky ho sp\u00fa\u0161\u0165a. Taktie\u017e PT NAD automaticky rozpozn\u00e1va protokol TeamViewer, \u010do pom\u00e1ha analytikovi n\u00e1js\u0165 v\u0161etky tak\u00e9to rel\u00e1cie pomocou filtra a overi\u0165 ich legit\u00edmnos\u0165.<\/p>\n<h3>11. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1204\/\">T1204<\/a><\/noindex>: vykonanie pou\u017e\u00edvate\u013eom<\/h3>\n<p>\nTechnika, pri ktorej pou\u017e\u00edvate\u013e sp\u00fa\u0161\u0165a s\u00fabory, ktor\u00e9 m\u00f4\u017eu vies\u0165 k vykonaniu k\u00f3du. M\u00f4\u017ee to by\u0165 napr\u00edklad, ak otvor\u00ed spustite\u013en\u00fd s\u00fabor alebo spust\u00ed kancel\u00e1rsky dokument s makrom.<\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: vid\u00ed tak\u00e9to s\u00fabory u\u017e v \u0161t\u00e1diu prenosu, pred ich spusten\u00edm. Inform\u00e1cie o nich je mo\u017en\u00e9 presk\u00fama\u0165 na karte rel\u00e1ci\u00ed, v ktor\u00fdch boli pren\u00e1\u0161an\u00e9.<\/p>\n<h3>12. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1047\">T1047<\/a><\/noindex>: Windows Management Instrumentation<\/h3>\n<p>\nPou\u017eitie n\u00e1stroja WMI, ktor\u00fd zabezpe\u010duje mo\u017enos\u0165 lok\u00e1lneho a vzdialen\u00e9ho pr\u00edstupu k syst\u00e9mov\u00fdm komponentom syst\u00e9mu Windows. Pomocou WMI m\u00f4\u017eu \u00fato\u010dn\u00edci interagova\u0165 s lok\u00e1lnymi a vzdialen\u00fdmi syst\u00e9mami a vykon\u00e1va\u0165 mno\u017estvo \u00faloh, napr\u00edklad zhroma\u017e\u010fova\u0165 inform\u00e1cie na \u00fa\u010dely prieskumu a vzdialene sp\u00fa\u0161\u0165a\u0165 procesy po\u010das horizont\u00e1lneho pohybu.<\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: ke\u010f\u017ee interakcie so vzdialen\u00fdmi syst\u00e9mami cez WMI s\u00fa vidite\u013en\u00e9 v prev\u00e1dzke, PT NAD automaticky deteguje sie\u0165ov\u00e9 po\u017eiadavky na vytvorenie WMI rel\u00e1ci\u00ed a kontroluje prev\u00e1dzku na pr\u00edtomnos\u0165 pren\u00e1\u0161an\u00fdch skriptov, ktor\u00e9 pou\u017e\u00edvaj\u00fa WMI.<\/p>\n<h3>13. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1028\">T1028<\/a><\/noindex>: Windows Remote Management <\/h3>\n<p>\nPou\u017eitie slu\u017eby a protokolu Windows, ktor\u00fd umo\u017e\u0148uje pou\u017e\u00edvate\u013eovi interagova\u0165 s vzdialen\u00fdmi syst\u00e9mami. <\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: vid\u00ed sie\u0165ov\u00e9 pripojenia vytvoren\u00e9 pomocou Windows Remote Management. Tak\u00e9to rel\u00e1cie sa automaticky detekuj\u00fa pravidlami. <\/p>\n<h3>14. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1220\/\">T1220<\/a><\/noindex>: spracovanie skriptov XSL (Extensible Stylesheet Language)<\/h3>\n<p>\nJazyk \u0161t\u00fdlov XSL sa pou\u017e\u00edva na popis spracovania a vizualiz\u00e1cie \u00fadajov v XML s\u00faboroch. Na podporu zlo\u017eit\u00fdch oper\u00e1ci\u00ed \u0161tandard XSL zah\u0155\u0148a podporu vlo\u017een\u00fdch skriptov v r\u00f4znych jazykoch. Tieto jazyky umo\u017e\u0148uj\u00fa vykon\u00e1va\u0165 \u013eubovo\u013en\u00fd k\u00f3d, \u010do vedie k obch\u00e1dzaniu polit\u00edk zabezpe\u010denia zalo\u017een\u00fdch na bielych zoznamoch. <\/p>\n<p><b>\u010co rob\u00ed PT NAD<\/b>: odha\u013euje skuto\u010dnosti o prenose tak\u00fdchto s\u00faborov po sieti, to znamen\u00e1 e\u0161te pred ich spusten\u00edm. Automaticky zist\u00ed prenos po sieti XSL s\u00faborov a s\u00faborov s anom\u00e1lnou XSL \u0161trukt\u00farou.<\/p>\n<p>V nasleduj\u00facich materi\u00e1loch sa pozrieme na to, ako syst\u00e9m NTA PT Network Attack Discovery nach\u00e1dza \u010fal\u0161ie taktiky a techniky \u00fato\u010dn\u00edkov pod\u013ea MITRE ATT&amp;CK. Sledujte n\u00e1s!<\/p>\n<p><b>Autori<\/b>: <\/p>\n<ul>\n<li>Anton Kute pov, odborn\u00edk z expertnej skupiny bezpe\u010dnosti (PT Expert Security Center) Positive Technologies<\/li>\n<li>Natalia Kazankova, produktov\u00fd marketingov\u00fd \u0161pecialista Positive Technologies<\/li>\n<\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/pt\/blog\/493082\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e Verizon, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e (87%) \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432 \u0418\u0411 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u044f\u0442 \u0437\u0430 \u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0435 \u043c\u0438\u043d\u0443\u0442\u044b, \u0430 \u043d\u0430 \u0438\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0443 68% \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0443\u0445\u043e\u0434\u044f\u0442 \u043c\u0435\u0441\u044f\u0446\u044b. \u042d\u0442\u043e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435\u043c Ponemon Institute, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u0443 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0443\u0445\u043e\u0434\u0438\u0442 \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u043c 206 \u0434\u043d\u0435\u0439 \u043d\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430. \u041f\u043e \u043e\u043f\u044b\u0442\u0443 \u043d\u0430\u0448\u0438\u0445 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439, \u0445\u0430\u043a\u0435\u0440\u044b \u043c\u043e\u0433\u0443\u0442 \u0433\u043e\u0434\u0430\u043c\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438 \u043d\u0435 \u0431\u044b\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c\u0438. \u0422\u0430\u043a, \u0432 \u043e\u0434\u043d\u043e\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":76040,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-76039","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e MITRE ATT&amp;CK \u043d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 PT Network Attack Discovery | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-03-30T11:43:09+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-30T11:43:09+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ako syst\u00e9my anal\u00fdzy trafficu odha\u013euj\u00fa taktiky hackerov pod\u013ea MITRE ATT&amp;CK na pr\u00edklade PT Network Attack Discovery | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e MITRE ATT&amp;CK \u043d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 PT Network Attack Discovery | ProHoster","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-30T11:43:09+00:00","article:modified_time":"2020-03-30T11:43:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"76039","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:44:27","updated":"2022-09-27 21:17:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/76039","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=76039"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/76039\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/76040"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=76039"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=76039"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=76039"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}