{"id":90735,"date":"2020-08-05T13:42:06","date_gmt":"2020-08-05T11:42:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust"},"modified":"2020-08-05T13:42:06","modified_gmt":"2020-08-05T11:42:06","slug":"vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","title":{"rendered":"Zap\u00edname zber udalost\u00ed o spusten\u00ed podozriv\u00fdch procesov vo Windows a odha\u013eujeme hrozby pomocou Quest InTrust","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Zap\u00edname zber udalost\u00ed o spusten\u00ed podozriv\u00fdch procesov vo Windows a odha\u013eujeme hrozby pomocou Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/6377476bf0527b75b61e174ed9915c07.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJedn\u00fdm z \u010dasto sa vyskytuj\u00facich typov \u00fatokov je generovanie \u0161kodliv\u00e9ho procesu v stromovej \u0161trukt\u00fare pod celkom legit\u00edmnymi procesmi. Podozrenie m\u00f4\u017ee vzbudi\u0165 cesta k spustite\u013en\u00e9mu s\u00faboru: \u010dasto \u0161kodliv\u00fd softv\u00e9r vyu\u017e\u00edva prie\u010dinky AppData alebo Temp, \u010do nie je typick\u00e9 pre legit\u00edmne programy. Spravodlivo treba poveda\u0165, \u017ee niektor\u00e9 n\u00e1stroje automatick\u00e9ho aktualizovania sa sp\u00fa\u0161\u0165aj\u00fa v AppData, preto len kontrola miesta spustenia nesta\u010d\u00ed na ur\u010denie, \u010di je program \u0161kodliv\u00fd.<\/p>\n<p>\u010eal\u0161\u00edm faktorom legit\u00edmnosti je kryptografick\u00fd podpis: mnoh\u00e9 origin\u00e1lne programy s\u00fa podp\u00edsan\u00e9 dod\u00e1vate\u013eom. M\u00f4\u017ee sa pou\u017ei\u0165 fakt absencie podpisu ako met\u00f3da na odha\u013eovanie podozriv\u00fdch prvkov automatick\u00e9ho sp\u00fa\u0161\u0165ania. Ale op\u00e4\u0165, existuje \u0161kodliv\u00fd softv\u00e9r, ktor\u00fd vyu\u017e\u00edva ukradnut\u00fd certifik\u00e1t na vlastn\u00e9 podp\u00edsanie.<\/p>\n<p>E\u0161te je mo\u017en\u00e9 kontrolova\u0165 hodnoty kryptografick\u00fdch hashov MD5 alebo SHA256, ktor\u00e9 m\u00f4\u017eu zodpoveda\u0165 niektor\u00fdm predt\u00fdm objaven\u00fdm \u0161kodliv\u00fdm programom. M\u00f4\u017eete vykon\u00e1va\u0165 statick\u00fa anal\u00fdzu prezeran\u00edm podpisov v programe (pomocou pravidiel Yara alebo antiv\u00edrusov\u00fdch produktov). Existuje aj dynamick\u00e1 anal\u00fdza (sp\u00fa\u0161\u0165anie programu v bezpe\u010dnom prostred\u00ed a sledovanie jeho \u010dinnosti) a reverzn\u00e9 in\u017einierstvo.<\/p>\n<p>Existuje mno\u017estvo znakov \u0161kodliv\u00e9ho procesu. V tomto \u010dl\u00e1nku sa dozviete, ako zapn\u00fa\u0165 audit pr\u00edslu\u0161n\u00fdch udalost\u00ed vo Windows, a presk\u00famame znaky, na ktor\u00fdch sa zaklad\u00e1 vstavan\u00e9 pravidlo <noindex><a rel=\"nofollow\" href=\"https:\/\/gals.software\/vendors\/quest\/intrust\">InTrust<\/a><\/noindex> na identifik\u00e1ciu podozriv\u00e9ho procesu. InTrust je <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/512908\/\">CLM platforma<\/a><\/noindex> na zber, anal\u00fdzu a uchov\u00e1vanie \u0161trukt\u00farovan\u00fdch d\u00e1t, ktor\u00e1 u\u017e obsahuje stovky predkonfigurovan\u00fdch reakci\u00ed na r\u00f4zne typy \u00fatokov.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nPri spusten\u00ed programu sa na\u010d\u00edta do pam\u00e4te po\u010d\u00edta\u010da. Spustite\u013en\u00fd s\u00fabor obsahuje po\u010d\u00edta\u010dov\u00e9 in\u0161trukcie a pomocn\u00e9 kni\u017enice (napr\u00edklad *.dll). Ke\u010f je proces u\u017e spusten\u00fd, m\u00f4\u017ee vytv\u00e1ra\u0165 \u010fal\u0161ie vl\u00e1kna. Vl\u00e1kna umo\u017e\u0148uj\u00fa procesu vykon\u00e1va\u0165 r\u00f4zne sady in\u0161trukci\u00ed s\u00fa\u010dasne. Existuje mnoho sp\u00f4sobov, ako sa \u0161kodliv\u00fd k\u00f3d dostane do pam\u00e4te a spust\u00ed sa, pozrime sa na niektor\u00e9 z nich.<\/p>\n<p>Najjednoduch\u0161\u00ed sp\u00f4sob, ako spusti\u0165 \u0161kodliv\u00fd proces, je presved\u010di\u0165 pou\u017e\u00edvate\u013ea, aby ho spustil priamo (napr\u00edklad z pr\u00edlohy e-mailu), a potom pomocou k\u013e\u00fa\u010da RunOnce ho sp\u00fa\u0161\u0165a\u0165 pri ka\u017edom zapnut\u00ed po\u010d\u00edta\u010da. Sem patr\u00ed aj \"bezf\u00e1jlov\u00e9\" \u0161kodliv\u00e9 softv\u00e9r, ktor\u00e9 uchov\u00e1va skripty PowerShell v k\u013e\u00fa\u010doch registrov, ktor\u00e9 sa vykon\u00e1vaj\u00fa na z\u00e1klade sp\u00fa\u0161\u0165a\u010da. V tomto pr\u00edpade je skript PowerShell \u0161kodliv\u00fdm k\u00f3dom.<\/p>\n<p>Probl\u00e9m s explicitn\u00fdm spusten\u00edm \u0161kodliv\u00e9ho softv\u00e9ru spo\u010d\u00edva v tom, \u017ee ide o zn\u00e1my pr\u00edstup, ktor\u00fd je \u013eahko odhalite\u013en\u00fd. Niektor\u00e9 \u0161kodliv\u00e9 programy vykon\u00e1vaj\u00fa pref\u00edkan\u00e9 veci, napr\u00edklad pou\u017e\u00edvaj\u00fa in\u00fd proces na to, aby sa za\u010dali vykon\u00e1va\u0165 v pam\u00e4ti. Preto m\u00f4\u017ee proces vytvori\u0165 in\u00fd proces, ke\u010f spust\u00ed ur\u010dit\u00fa po\u010d\u00edta\u010dov\u00fa in\u0161trukciu a ur\u010d\u00ed spustite\u013en\u00fd s\u00fabor (.exe) na spustenie.<\/p>\n<p>S\u00fabor mo\u017eno zada\u0165 pomocou \u00faplnej cesty (napr\u00edklad C:Windowssystem32cmd.exe) alebo ne\u00faplnej (napr\u00edklad cmd.exe). Ak je p\u00f4vodn\u00fd proces nebezpe\u010dn\u00fd, umo\u017en\u00ed sp\u00fa\u0161\u0165anie nelegit\u00edmnych programov. \u00datok m\u00f4\u017ee vyzera\u0165 takto: proces spust\u00ed cmd.exe bez zadania \u00faplnej cesty, \u00fato\u010dn\u00edk umiestni svoj cmd.exe na tak\u00e9 miesto, aby ho proces spustil sk\u00f4r ako legit\u00edmny. Po spusten\u00ed \u0161kodlivej programy m\u00f4\u017ee t\u00e1to zase spusti\u0165 legit\u00edmny program (napr\u00edklad C:Windowssystem32cmd.exe), aby p\u00f4vodn\u00fd program pokra\u010doval v norm\u00e1lnej \u010dinnosti.<\/p>\n<p>Varianta predch\u00e1dzaj\u00faceho \u00fatoku - DLL injekcia do legit\u00edmneho procesu. Ke\u010f sa proces spust\u00ed, n\u00e1jde a na\u010d\u00edta kni\u017enice, ktor\u00e9 roz\u0161iruj\u00fa jeho funkcie. Pomocou DLL injekcie vytv\u00e1ra \u00fato\u010dn\u00edk \u0161kodliv\u00fa kni\u017enicu so rovnak\u00fdm n\u00e1zvom a API ako legit\u00edmna. Program na\u010d\u00edta \u0161kodliv\u00fa kni\u017enicu, ktor\u00e1 na opl\u00e1tku na\u010d\u00edta legit\u00edmnu a pod\u013ea potreby pre vykon\u00e1vanie oper\u00e1ci\u00ed ju vol\u00e1. \u0160kodliv\u00e1 kni\u017enica za\u010d\u00edna plni\u0165 \u00falohu proxy pre dobr\u00fa kni\u017enicu.<\/p>\n<p>\u010eal\u0161\u00ed sp\u00f4sob, ako umiestni\u0165 \u0161kodliv\u00fd k\u00f3d do pam\u00e4te, je vlo\u017ei\u0165 ho do nebezpe\u010dn\u00e9ho procesu, ktor\u00fd u\u017e be\u017e\u00ed. Procesy prij\u00edmaj\u00fa vstupy z r\u00f4znych zdrojov \u2013 \u010d\u00edtaj\u00fa zo siete alebo s\u00faborov. Zvy\u010dajne vykon\u00e1vaj\u00fa kontrolu, aby sa uistili o legit\u00edmnosti vstupov. No niektor\u00e9 procesy nemaj\u00fa dostato\u010dn\u00fa ochranu pri vykon\u00e1van\u00ed in\u0161trukci\u00ed. Pri takejto \u00fatoku neexistuje kni\u017enica na disku alebo spustite\u013en\u00fd s\u00fabor so \u0161kodliv\u00fdm k\u00f3dexom. V\u0161etko je ulo\u017een\u00e9 v pam\u00e4ti spolu s napadnut\u00fdm procesom.<\/p>\n<p>Teraz sa pozrieme na metodiku aktiv\u00e1cie zberu podobn\u00fdch udalost\u00ed vo Windows a na pravidlo v InTrust, ktor\u00e9 implementuje ochranu proti tak\u00fdmto hrozb\u00e1m. Najprv ho aktivujeme cez konzolu spr\u00e1vy InTrust.<\/p>\n<p><img decoding=\"async\" alt=\"Zap\u00edname zber udalost\u00ed o spusten\u00ed podozriv\u00fdch procesov vo Windows a odha\u013eujeme hrozby pomocou Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/3ffc159a9b220c56b288256b286fdd8d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPravidlo vyu\u017e\u00edva mo\u017enosti sledovania procesov v OS Windows. \u017dia\u013e, aktiv\u00e1cia zberu tak\u00fdchto udalost\u00ed nie je v\u00f4bec jasn\u00e1. Je potrebn\u00e9 zmeni\u0165 3 r\u00f4zne nastavenia skupinovej politiky:<\/p>\n<p><b>Konfigur\u00e1cia po\u010d\u00edta\u010da &gt; Politiky &gt; Nastavenia Windows &gt; Bezpe\u010dnostn\u00e9 nastavenia &gt; Miestne politiky &gt; Auditn\u00e1 politika &gt; Auditovanie sledovania procesov<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Zap\u00edname zber udalost\u00ed o spusten\u00ed podozriv\u00fdch procesov vo Windows a odha\u013eujeme hrozby pomocou Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/03abc319d24bf82dbf9c728b6b37c794.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Konfigur\u00e1cia po\u010d\u00edta\u010da &gt; Politiky &gt; Nastavenia Windows &gt; Bezpe\u010dnostn\u00e9 nastavenia &gt; Pokro\u010dil\u00e1 auditn\u00e1 konfigur\u00e1cia &gt; Auditn\u00e9 politiky &gt; Podrobn\u00fd sledovac\u00ed z\u00e1znam &gt; Auditovanie vytv\u00e1rania procesov<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Zap\u00edname zber udalost\u00ed o spusten\u00ed podozriv\u00fdch procesov vo Windows a odha\u013eujeme hrozby pomocou Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/3b017dc39789d55ae478e70e0034bd73.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Konfigur\u00e1cia po\u010d\u00edta\u010da &gt; Politiky &gt; Spr\u00e1vne \u0161abl\u00f3ny &gt; Syst\u00e9m &gt; Auditovanie vytv\u00e1rania procesov &gt; Zahrn\u00fa\u0165 pr\u00edkazov\u00fd riadok do udalost\u00ed vytvorenia procesu<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Zap\u00edname zber udalost\u00ed o spusten\u00ed podozriv\u00fdch procesov vo Windows a odha\u013eujeme hrozby pomocou Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/13122278bc9ab6f7f6ff982654ce6dec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPo zapnut\u00ed pravidl\u00e1 InTrust umo\u017e\u0148uj\u00fa odha\u013eovanie predt\u00fdm nezn\u00e1mych hrozieb, ktor\u00e9 vykazuj\u00fa podozriv\u00e9 spr\u00e1vanie. Napr\u00edklad, je mo\u017en\u00e9 odhali\u0165 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.bromium.com\/dridex-threat-analysis-july-2019-variant\/\">tu pop\u00edsan\u00e9<\/a><\/noindex> \u0161kodliv\u00e9 softv\u00e9rov\u00e9 vybavenie Dridex. V\u010faka projektu HP Bromium vieme, ako je tak\u00e1to hrozba vytvoren\u00e1.<\/p>\n<p><img decoding=\"async\" alt=\"Zap\u00edname zber udalost\u00ed o spusten\u00ed podozriv\u00fdch procesov vo Windows a odha\u013eujeme hrozby pomocou Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/cbc09c039a088a3b6737d2d467c6a2ac.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV re\u0165azci svojich akci\u00ed Dridex vyu\u017e\u00edva schtasks.exe na vytvorenie pl\u00e1novanej \u00falohy. Vyu\u017eitie tejto utilitky z pr\u00edkazov\u00e9ho riadku sa pova\u017euje za ve\u013emi podozriv\u00e9 spr\u00e1vanie, rovnako ako spustenie svchost.exe s parametrami, ktor\u00e9 odkazuj\u00fa na u\u017e\u00edvate\u013esk\u00e9 prie\u010dinky alebo s parametrami podobn\u00fdmi pr\u00edkazom \u201enet view\u201c alebo \u201ewhoami\u201c. Tu je \u00faryvok zodpovedaj\u00faceho <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Neo23x0\/sigma\/blob\/master\/rules\/windows\/process_creation\/win_malware_dridex.yml\">pravidla SIGMA<\/a><\/noindex>:<\/p>\n<pre><code class=\"xml\">detection:\n    selection1:\n        CommandLine: '*svchost.exe C:Users\\*Desktop\\*'\n    selection2:\n        ParentImage: '*svchost.exe*'\n        CommandLine:\n            - '*whoami.exe \/all'\n            - '*net.exe view'\n    condition: 1 of them<\/code><\/pre>\n<p>\nV InTrust je v\u0161etko podozriv\u00e9 spr\u00e1vanie zahrnut\u00e9 do jedn\u00e9ho pravidla, preto\u017ee v\u00e4\u010d\u0161ina t\u00fdchto \u010dinnost\u00ed nie je \u0161pecifick\u00e1 pre konkr\u00e9tnu hrozbu, ale sk\u00f4r s\u00fa podozriv\u00e9 v s\u00fahrne a v 99 % pr\u00edpadov sa pou\u017e\u00edvaj\u00fa na nie celkom cnosti ciele. Tento zoznam akci\u00ed zah\u0155\u0148a, ale nie je obmedzen\u00fd na:<\/p>\n<ul>\n<li>Procesy sp\u00fa\u0161\u0165an\u00e9 z nezvy\u010dajn\u00fdch miest, ako s\u00fa pou\u017e\u00edvate\u013esk\u00e9 do\u010dasn\u00e9 prie\u010dinky.<\/li>\n<li>Dobr\u00e9 zn\u00e1my syst\u00e9mov\u00fd proces s podozriv\u00fdm dedi\u010dstvom \u2014 niektor\u00e9 hrozby sa m\u00f4\u017eu pok\u00fasi\u0165 vyu\u017ei\u0165 n\u00e1zov syst\u00e9mov\u00fdch procesov, aby zostali nepozorovan\u00e9.<\/li>\n<li>Podozriv\u00e9 vykon\u00e1vanie administrat\u00edvnych n\u00e1strojov, ako s\u00fa cmd alebo PsExec, ke\u010f pou\u017e\u00edvaj\u00fa poverenia lok\u00e1lneho syst\u00e9mu alebo podozriv\u00e9 dedi\u010dstvo.<\/li>\n<li>Podozriv\u00e9 oper\u00e1cie tie\u0148ov\u00e9ho kop\u00edrovania \u2014 be\u017en\u00e9 spr\u00e1vanie ransomware pred \u0161ifrovan\u00edm syst\u00e9mu, zab\u00edjaj\u00fa z\u00e1lohy:\n<p> \u2014 Cez vssadmin.exe;<br \/>\n \u2014 Cez WMI.<\/li>\n<li>Registr\u00e1cia cel\u00fdch skup\u00edn registra.<\/li>\n<li>Horizont\u00e1lne \u0161\u00edrenie malv\u00e9ru pri vzdialenom spusten\u00ed procesu pomocou pr\u00edkazov, ako je at.exe.<\/li>\n<li>Podozriv\u00e9 miestne skupinov\u00e9 oper\u00e1cie a dom\u00e9nov\u00e9 oper\u00e1cie s pou\u017eit\u00edm net.exe.<\/li>\n<li>Podozriv\u00e9 oper\u00e1cie s br\u00e1nou firewall pomocou netsh.exe.<\/li>\n<li>Podozriv\u00e9 manipul\u00e1cie s ACL.<\/li>\n<li>Pou\u017eitie BITS na exfiltr\u00e1ciu d\u00e1t.<\/li>\n<li>Podozriv\u00e9 manipul\u00e1cie s WMI.<\/li>\n<li>Podozriv\u00e9 skriptov\u00e9 pr\u00edkazy.<\/li>\n<li>Pokusy o dumpovanie bezpe\u010dn\u00fdch syst\u00e9mov\u00fdch s\u00faborov.<\/li>\n<\/ul>\n<p>\nZl\u00fa\u010den\u00e9 pravidlo ve\u013emi dobre funguje na detekciu hrozieb, ako s\u00fa RUYK, LockerGoga a in\u00e9 ransomware, malv\u00e9rov a s\u00e1d n\u00e1strojov kybernetick\u00e9ho zlo\u010dinu. Pravidlo bolo overen\u00e9 dod\u00e1vate\u013eom v bojov\u00fdch prostrediach, aby sa minimalizovali falo\u0161n\u00e9 poplachy. A v\u010faka projektu SIGMA v\u00e4\u010d\u0161ina t\u00fdchto indik\u00e1torov produkuje minim\u00e1lne mno\u017estvo \u0161umov\u00fdch udalost\u00ed.<\/p>\n<p>Ke\u010f\u017ee je v InTrust toto pravidlo monitorovania, m\u00f4\u017eete vykona\u0165 reak\u010dn\u00fd skript ako reakciu na hrozbu. M\u00f4\u017eete pou\u017ei\u0165 jeden z integrovan\u00fdch skriptov alebo si vytvori\u0165 vlastn\u00fd a InTrust ho automaticky roz\u0161\u00edri.<\/p>\n<p><img decoding=\"async\" alt=\"Zap\u00edname zber udalost\u00ed o spusten\u00ed podozriv\u00fdch procesov vo Windows a odha\u013eujeme hrozby pomocou Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/fca2722b0465152e3de8f655af07bc91.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nOkrem toho je mo\u017en\u00e9 skontrolova\u0165 v\u0161etky s\u00favisiace telemetrie udalost\u00ed: skripty PowerShell, vykon\u00e1vanie procesov, manipul\u00e1ciu s napl\u00e1novan\u00fdmi \u00falohami, administrat\u00edvne aktivity WMI a vyu\u017ei\u0165 ich na postmortem anal\u00fdzy pri incidentoch bezpe\u010dnosti.<\/p>\n<p><img decoding=\"async\" alt=\"Zap\u00edname zber udalost\u00ed o spusten\u00ed podozriv\u00fdch procesov vo Windows a odha\u013eujeme hrozby pomocou Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/81ee58b297523002ee26c25bda40f5bb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV InTrust existuje mno\u017estvo \u010fal\u0161\u00edch pravidiel, medzi nimi aj:<\/p>\n<ul>\n<li>Detekcia \u00fatoku na zn\u00ed\u017eenie verzie PowerShell \u2014 ke\u010f niekto \u0161peci\u00e1lne pou\u017e\u00edva star\u0161iu verziu PowerShell, preto\u017ee v star\u0161ej verzii nebola mo\u017enos\u0165 auditova\u0165 prebiehaj\u00face akcie.<\/li>\n<li>Detekcia prihl\u00e1senia s vysok\u00fdmi privil\u00e9giami \u2014 ke\u010f \u00fa\u010dty, ktor\u00e9 s\u00fa \u010dlenmi ur\u010ditej privil\u00e9giovanej skupiny (napr\u00edklad dom\u00e9nov\u00fdch administr\u00e1torov), n\u00e1hodne alebo v d\u00f4sledku bezpe\u010dnostn\u00fdch incidentov interakt\u00edvne vst\u00fapia do syst\u00e9mu na pracovn\u00fdch staniciach.<\/li>\n<\/ul>\n<p>\nInTrust umo\u017e\u0148uje vyu\u017e\u00edva\u0165 najlep\u0161ie bezpe\u010dnostn\u00e9 praktiky v podobe prednastaven\u00fdch pravidiel detekcie a reakcie. A ak si mysl\u00edte, \u017ee by nie\u010do malo fungova\u0165 inak - je mo\u017en\u00e9 si vytvori\u0165 k\u00f3piu pravidla a nastavi\u0165 ho pod\u013ea potreby. \u017diados\u0165 o realiz\u00e1ciu pilotn\u00e9ho projektu alebo z\u00edskanie distribu\u010dn\u00fdch bal\u00edkov s do\u010dasn\u00fdmi licenciami je mo\u017en\u00e9 zasla\u0165 prostredn\u00edctvom <noindex><a rel=\"nofollow\" href=\"https:\/\/gals.software\/vendors\/quest\/intrust#feedback\">kontaktn\u00fd formul\u00e1r<\/a><\/noindex> na na\u0161ej webovej str\u00e1nke.<\/p>\n<p>Prihl\u00e1ste sa na na\u0161u <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/GalsSoftware\/\">str\u00e1nky na Facebooku<\/a><\/noindex>, kde uverej\u0148ujeme stru\u010dn\u00e9 pozn\u00e1mky a zauj\u00edmav\u00e9 odkazy.<\/p>\n<p><b>Pre\u010d\u00edtajte si \u010fal\u0161ie na\u0161e \u010dl\u00e1nky na t\u00e9mu informa\u010dn\u00e1 bezpe\u010dnos\u0165:<\/b><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/513208\/\">Ako m\u00f4\u017ee InTrust pom\u00f4c\u0165 zn\u00ed\u017ei\u0165 frekvenciu ne\u00faspe\u0161n\u00fdch pokusov o autoriz\u00e1ciu cez RDP<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/474574\/\">Identifikujeme \u00fatok ransomware, z\u00edskavame pr\u00edstup k dom\u00e9nov\u00e9mu kontrol\u00f3ru a sna\u017e\u00edme sa odola\u0165 t\u00fdmto \u00fatokom.<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447522\/\">\u010co u\u017eito\u010dn\u00e9 m\u00f4\u017eeme vy\u0165a\u017ei\u0165 z logov pracovnej stanice na b\u00e1ze OS Windows.<\/a><\/noindex> (popul\u00e1rny \u010dl\u00e1nok)<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/464333\/\">Sledovanie \u017eivotn\u00e9ho cyklu pou\u017e\u00edvate\u013eov bez klie\u0161\u0165ov a izola\u010dnej p\u00e1sky.<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447512\/\">A kto to urobil? Automatizujeme audit informa\u010dnej bezpe\u010dnosti.<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/512908\/\">Ako zn\u00ed\u017ei\u0165 n\u00e1klady na vlastn\u00edctvo SIEM syst\u00e9mu a na \u010do je potrebn\u00fd Central Log Management (CLM).<\/a><\/noindex><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/513714\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u0434\u043d\u0430 \u0438\u0437 \u0447\u0430\u0441\u0442\u043e \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0449\u0438\u0445\u0441\u044f \u0442\u0438\u043f\u043e\u0432 \u0430\u0442\u0430\u043a \u2014 \u043f\u043e\u0440\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u0437\u043b\u043e\u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0432 \u0434\u0435\u0440\u0435\u0432\u0435 \u043f\u043e\u0434 \u0432\u043f\u043e\u043b\u043d\u0435 \u0441\u0435\u0431\u0435 \u0434\u043e\u0431\u0440\u043e\u043f\u043e\u0440\u044f\u0434\u043e\u0447\u043d\u044b\u043c\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c\u0438. \u041f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0435 \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0443\u0442\u044c \u043a \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u043c\u0443 \u0444\u0430\u0439\u043b\u0443: \u0447\u0430\u0441\u0442\u0435\u043d\u044c\u043a\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043f\u0430\u043f\u043a\u0438 AppData \u0438\u043b\u0438 Temp, \u0430 \u044d\u0442\u043e \u043d\u0435\u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u043e \u0434\u043b\u044f \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c. \u0421\u043f\u0440\u0430\u0432\u0435\u0434\u043b\u0438\u0432\u043e\u0441\u0442\u0438 \u0440\u0430\u0434\u0438, \u0441\u0442\u043e\u0438\u0442 \u0441\u043a\u0430\u0437\u0430\u0442\u044c, \u0447\u0442\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u044e\u0442\u0441\u044f \u0432 AppData, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043e\u0434\u043d\u043e\u0439 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043c\u0435\u0441\u0442\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":90736,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-90735","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u0441\u0431\u043e\u0440 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0432 Windows \u0438 \u0432\u044b\u044f\u0432\u043b\u044f\u0435\u043c \u0443\u0433\u0440\u043e\u0437\u044b \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Quest InTrust | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-05T11:42:06+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-05T11:42:06+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zah\u0155\u0148ame zber udalost\u00ed o spusten\u00ed podozriv\u00fdch procesov v syst\u00e9me Windows a odha\u013eujeme hrozby pomocou Quest InTrust | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u0441\u0431\u043e\u0440 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0432 Windows \u0438 \u0432\u044b\u044f\u0432\u043b\u044f\u0435\u043c \u0443\u0433\u0440\u043e\u0437\u044b \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Quest InTrust | ProHoster","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-05T11:42:06+00:00","article:modified_time":"2020-08-05T11:42:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90735","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:43:42","updated":"2022-09-29 04:49:36","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/90735","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=90735"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/90735\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/90736"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=90735"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=90735"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=90735"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}