{"id":76039,"date":"2020-03-30T13:43:09","date_gmt":"2020-03-30T11:43:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery"},"modified":"2020-03-30T13:43:09","modified_gmt":"2020-03-30T11:43:09","slug":"kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery","title":{"rendered":"Si sistemet e analiz\u00ebs s\u00eb trafik\u00ebve zbulojn\u00eb taktikat e hackerave sipas MITRE ATT&amp;CK p\u00ebr shembullin e PT Network Attack Discovery","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/pt\/blog\/493082\/\"><img decoding=\"async\" alt=\"Si sistemet e analiz\u00ebs s\u00eb trafikut zbulojn\u00eb taktikat e haker\u00ebve sipas MITRE ATT&amp;CK p\u00ebrmes PT Network Attack Discovery\" src=\"\/wp-content\/uploads\/2020\/03\/75b6c4846867a15776529105f9657ffb.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.verizonenterprise.com\/resources\/reports\/rp_DBIR_2018_Report_execsummary_en_xg.pdf\">Sipas Verizon<\/a><\/noindex>, shumica (87%) e incidenteve t\u00eb siguris\u00eb ndodhin brenda minutash, nd\u00ebrsa p\u00ebr 68% t\u00eb kompanive, zbulimi i tyre merr muaj. Kjo konfirmohet gjithashtu nga <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ibm.com\/security\/data-breach\">studimi i Institutit Ponemon<\/a><\/noindex>, sipas t\u00eb cilit shumica e organizatave i duhen mesatarisht 206 dit\u00eb p\u00ebr t\u00eb zbuluar nj\u00eb incident. Nga p\u00ebrvoja e hetimeve tona, hakera mund t\u00eb kontrollojn\u00eb infrastruktur\u00ebn e nj\u00eb kompanie p\u00ebr vite t\u00eb t\u00ebra pa u zbuluar. K\u00ebshtu, n\u00eb nj\u00eb nga organizatat ku ekspert\u00ebt tan\u00eb zhvilluan nj\u00eb hetim mbi nj\u00eb incident t\u00eb siguris\u00eb, u zbulua se hakerat kishin kontrolluar plot\u00ebsisht gjith\u00eb infrastruktur\u00ebn e organizat\u00ebs dhe rregullisht vidhnin informacion t\u00eb r\u00ebnd\u00ebsish\u00ebm <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ptsecurity.com\/ru-ru\/research\/analytics\/operation-taskmasters-2019\/?sphrase_id=71910\">p\u00ebr tet\u00eb vjet<\/a><\/noindex>.<\/p>\n<p>Supozoni se keni nj\u00eb SIEM q\u00eb mbledh logje dhe analizoi ngjarje, dhe antiviruset jan\u00eb instaluar n\u00eb terminalet p\u00ebrfundimtare. Megjithat\u00eb, <noindex><a rel=\"nofollow\" href=\"https:\/\/safe.cnews.ru\/articles\/2019-10-15_pochemu_hakery_legko_vzlamyvayut_nasa\">nuk \u00e7do gj\u00eb mund t\u00eb zbulohet me ndihm\u00ebn e SIEM<\/a><\/noindex>, as si\u00e7 \u00ebsht\u00eb e pamundur t\u00eb implementohen sisteme EDR n\u00eb t\u00eb gjith\u00eb rrjetin, k\u00ebshtu q\u00eb nuk mund t\u00eb shp\u00ebtohet nga \"zona t\u00eb verbra\". T\u00eb p\u00ebrballuar me to ndihmojn\u00eb sistemet e analiz\u00ebs s\u00eb trafikut t\u00eb rrjetit (network traffic analysis, NTA). K\u00ebto zgjidhje zbulojn\u00eb aktivitetin e keqb\u00ebr\u00ebsve n\u00eb fazat m\u00eb t\u00eb hershme t\u00eb dep\u00ebrtimit n\u00eb rrjet, si dhe gjat\u00eb p\u00ebrpjekjeve p\u00ebr t\u00eb konsoliduar dhe zhvilluar sulm brenda rrjetit. <\/p>\n<p>NTA jan\u00eb t\u00eb dy llojeve: disa punojn\u00eb me NetFlow, t\u00eb tjerat analizojn\u00eb trafik t\u00eb pap\u00ebrpunuar. Avantazhi i sistemeve t\u00eb dyt\u00eb \u00ebsht\u00eb se ato mund t\u00eb ruajn\u00eb regjistrimet e trafikut t\u00eb pap\u00ebrpunuar. Fal\u00eb k\u00ebsaj, specialisti i siguris\u00eb mund t\u00eb kontrolloj\u00eb suksesin e nj\u00eb sulmi, t\u00eb lokalizoj\u00eb k\u00ebrc\u00ebnimin, t\u00eb kuptoj\u00eb si ndodhi sulmi dhe si t\u00eb parandaloj\u00eb t\u00eb ngjashme n\u00eb t\u00eb ardhmen.<\/p>\n<p>Ne do t\u00eb tregojm\u00eb si me ndihm\u00ebn e NTA-s\u00eb mund t\u00eb identifikoni t\u00eb gjitha taktikat e njohura t\u00eb sulmeve, t\u00eb p\u00ebrshkruara n\u00eb baz\u00ebn e njohurive <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/\">MITRE ATT&amp;CK<\/a><\/noindex>. Ne do t\u00eb flasim p\u00ebr secil\u00ebn nga 12 taktikat, do t\u00eb analizojm\u00eb teknikat q\u00eb zbulohet p\u00ebrmes trafikut dhe do t\u00eb demonstrojm\u00eb zbules\u00ebn e tyre me ndihm\u00ebn e sistemit ton\u00eb NTA. <noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>P\u00ebr baz\u00ebn e njohurive ATT&amp;CK<\/h2>\n<p>\nMITRE ATT&amp;CK \u00ebsht\u00eb nj\u00eb baz\u00eb e njohurive publike, e zhvilluar dhe mb\u00ebshtetur nga korporata MITRE bazuar n\u00eb analiz\u00ebn e APT-ve reale. Ajo p\u00ebrfaq\u00ebson nj\u00eb grup t\u00eb strukturuar t\u00eb taktikave dhe teknikave t\u00eb p\u00ebrdorura nga keqb\u00ebr\u00ebsit. Kjo lejon specialist\u00ebt e siguris\u00eb t\u00eb informacionit nga e gjith\u00eb bota t\u00eb flasin n\u00eb nj\u00eb gjuh\u00eb t\u00eb p\u00ebrbashk\u00ebt. Baza vazhdon t\u00eb zgjerohet dhe t\u00eb pasurohet me njohuri t\u00eb reja.<\/p>\n<p>N\u00eb baz\u00eb jan\u00eb identifikuar 12 taktika, t\u00eb cilat ndahen sipas fazave t\u00eb sulmit kibernetik: <\/p>\n<ul>\n<li>qasje e par\u00eb (initial access);<\/li>\n<li>zbatimi (execution);<\/li>\n<li>ngritja (persistence);<\/li>\n<li>shkall\u00ebzimi i privilegjeve (privilege escalation);<\/li>\n<li>parandalimi i zbulimit (defense evasion);<\/li>\n<li>qasje n\u00eb akreditiv\u00ebt (credential access);<\/li>\n<li>k\u00ebrkimi (discovery);<\/li>\n<li>l\u00ebvizja brenda perimetrit (lateral movement);<\/li>\n<li>mbledhja e t\u00eb dh\u00ebnave (collection);<\/li>\n<li>menaxhimi dhe kontrolli (command and control);<\/li>\n<li>ekzfiltrimi i t\u00eb dh\u00ebnave (exfiltration);<\/li>\n<li>ndikimi (impact).<\/li>\n<\/ul>\n<p>\nP\u00ebr \u00e7do taktik\u00eb n\u00eb baz\u00ebn e njohurive ATT&amp;CK \u00ebsht\u00eb listuar nj\u00eb grup teknikash q\u00eb ndihmojn\u00eb k\u00ebrc\u00ebnuesit n\u00eb arritjen e q\u00ebllimeve n\u00eb faz\u00ebn aktuale t\u00eb sulmit. Pasi t\u00eb nj\u00ebjt\u00ebn teknik\u00eb mund t\u00eb p\u00ebrdorin n\u00eb faza t\u00eb ndryshme, ajo mund t\u00eb p\u00ebrfshihet n\u00eb disa taktika. <\/p>\n<p>P\u00ebrshkrimi i secil\u00ebs teknik\u00eb p\u00ebrfshin:<\/p>\n<ul>\n<li>identifikuesin;<\/li>\n<li>list\u00ebn e taktikave n\u00eb t\u00eb cilat aplikohet;<\/li>\n<li>shembuj t\u00eb p\u00ebrdorimit nga grupet APT;<\/li>\n<li>masat p\u00ebr t\u00eb ulur d\u00ebmin nga aplikimi i saj;<\/li>\n<li>rekomandimet p\u00ebr zbulim. <\/li>\n<\/ul>\n<p>\nSpecialist\u00ebt e siguris\u00eb mund t\u00eb p\u00ebrdorin njohurit\u00eb nga baza p\u00ebr t\u00eb strukturuar informacionin mbi metodat aktuale t\u00eb sulmeve dhe, duke marr\u00eb parasysh k\u00ebt\u00eb, t\u00eb nd\u00ebrtojn\u00eb nj\u00eb sistem efektiv t\u00eb siguris\u00eb. Kuptimi se si veprojn\u00eb grupet APT n\u00eb realitet mund t\u00eb b\u00ebhet burim hipotezash p\u00ebr k\u00ebrkimin proaktiv t\u00eb k\u00ebrc\u00ebnimeve n\u00eb kuad\u00ebr t\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ptsecurity.com\/ru-ru\/research\/webinar\/302112\/\">threat hunting<\/a><\/noindex>. <\/p>\n<h3>Rreth Zbulimit t\u00eb Sulmeve n\u00eb Rrjetin PT<\/h3>\n<p>\nIdentifikimi i p\u00ebrdorimit t\u00eb teknikave nga matrica ATT&amp;CK do t\u00eb b\u00ebhet me an\u00eb t\u00eb sistemit <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ptsecurity.com\/ru-ru\/products\/network-attack-discovery\/?utm_source=press_release&amp;utm_medium=press_release&amp;utm_campaign=new_nad\">PT Network Attack Discovery <\/a><\/noindex>\u2014 Sistemi NTA i Teknologjive Pozitive, i cili \u00ebsht\u00eb i dedikuar p\u00ebr identifikimin e sulmeve n\u00eb perimetrin dhe brenda rrjetit. PT NAD mbulon n\u00eb m\u00ebnyr\u00eb t\u00eb ndryshme t\u00eb gjitha 12 taktikat e matrices MITRE ATT&amp;CK. Ai \u00ebsht\u00eb m\u00eb i fort\u00eb n\u00eb identifikimin e teknikave t\u00eb qasjes s\u00eb par\u00eb (initial access), l\u00ebvizjes brenda perimetrit (lateral movement) dhe menaxhimi dhe kontrollit (command and control). N\u00eb k\u00ebto, PT NAD mbulon m\u00eb shum\u00eb se gjysm\u00ebn e teknikave t\u00eb njohura, duke identifikuar p\u00ebrdorimin e tyre p\u00ebrmes treguesve direkt\u00eb ose indirekt\u00eb. <\/p>\n<p>Sistemi identifikon sulmet me p\u00ebrdorimin e teknikave ATT&amp;CK p\u00ebrmes rregullave t\u00eb zbulimit t\u00eb krijuara nga ekipi <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ptsecurity.com\/ru-ru\/products\/network-attack-discovery\/?utm_source=press_release&amp;utm_medium=press_release&amp;utm_campaign=new_nad\">Qendra e Siguris\u00eb Expert e PT<\/a><\/noindex> (PT ESC), m\u00ebsimit makineror, treguesve t\u00eb komprometimit, analitik\u00ebs s\u00eb thell\u00eb dhe analiz\u00ebs retrospektive. Analiza n\u00eb koh\u00eb reale e trafikut s\u00eb bashku me retrospektiv\u00ebn mund\u00ebson identifikimin e aktiviteteve t\u00eb d\u00ebmshme t\u00eb fshehura aktuale dhe ndjekjen e vektor\u00ebve t\u00eb zhvillimit dhe historis\u00eb s\u00eb sulmeve.<\/p>\n<blockquote><p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/-l\/o8\/yc\/-lo8ycywq-rl1g_v1pt9-lmnj3y.png\">K\u00ebtu<\/a><\/noindex> mapsi i plot\u00eb i PT NAD n\u00eb matric\u00ebn MITRE ATT&amp;CK. Pamja \u00ebsht\u00eb e madhe, k\u00ebshtu q\u00eb ju sugjerojm\u00eb ta shqyrtoni at\u00eb n\u00eb nj\u00eb dritare t\u00eb ve\u00e7ant\u00eb.<\/p><\/blockquote>\n<p><\/p>\n<h3>Qasje fillestare (initial access)<\/h3>\n<p><img decoding=\"async\" alt=\"Si sistemet e analiz\u00ebs s\u00eb trafikut zbulojn\u00eb taktikat e haker\u00ebve sipas MITRE ATT&amp;CK p\u00ebrmes PT Network Attack Discovery\" src=\"\/wp-content\/uploads\/2020\/03\/93cc3669c7de3b5193897d685e63a72f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTeknikat e qasjes fillestare p\u00ebrfshijn\u00eb teknika p\u00ebr t\u2019u infiltruar n\u00eb rrjetin e kompanis\u00eb. Q\u00ebllimi i sulmuesve n\u00eb k\u00ebt\u00eb faz\u00eb \u00ebsht\u00eb t\u00eb sjellin kodin e keq n\u00eb sistemin e sulmuar dhe t\u00eb sigurojn\u00eb mund\u00ebsin\u00eb e ekzekutimit t\u00eb tij n\u00eb vazhdim.<\/p>\n<p>Analiza e trafikut nga PT NAD lejon identifikimin e shtat\u00eb teknikave p\u00ebr t\u00eb arritur qasjen fillestare:<\/p>\n<h3>1. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1189\/\">T1189<\/a><\/noindex>: kompensimi nga shfletimi (drive-by compromise)<\/h3>\n<p>\nNj\u00eb teknik\u00eb ku viktima hap nj\u00eb faq\u00eb interneti, e cila p\u00ebrdoret nga sulmuesit p\u00ebr t\u00eb shfryt\u00ebzuar shfletuesin, duke marr\u00eb token\u00ebt e aksesit n\u00eb aplikacion. <\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: n\u00ebse trafiku i internetit nuk \u00ebsht\u00eb i enkriptuar, PT NAD inspekton p\u00ebrmbajtjen e p\u00ebrgjigjeve t\u00eb server\u00ebve HTTP. Eksploit\u00ebt q\u00eb lejojn\u00eb sulmuesit t\u00eb ekzekutojn\u00eb kod t\u00eb arbitruesh\u00ebm brenda shfletuesit ndodhen pik\u00ebrisht n\u00eb k\u00ebto p\u00ebrgjigje. PT NAD zbulon automatikisht k\u00ebto eksploit\u00eb p\u00ebrmes rregullave t\u00eb identifikimit. <\/p>\n<p>P\u00ebr m\u00eb tep\u00ebr, PT NAD zbulon k\u00ebrc\u00ebnimin n\u00eb hapin e m\u00ebparsh\u00ebm. Rregullat dhe indikator\u00ebt e kompromisit aktivizohen n\u00ebse p\u00ebrdoruesi viziton nj\u00eb faqe q\u00eb e ridrejton at\u00eb n\u00eb nj\u00eb faqe me lidhje eksploit\u00ebsh.<\/p>\n<h3>2. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1190\">T1190<\/a><\/noindex>: shfryt\u00ebzimi i aplikacioneve q\u00eb jan\u00eb n\u00eb dispozicion p\u00ebr publikun (exploit public-facing application)<\/h3>\n<p>\nShfryt\u00ebzimi i dob\u00ebsive n\u00eb sh\u00ebrbimet q\u00eb jan\u00eb t\u00eb aksesueshme nga interneti. <\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: kryen nj\u00eb inspektim t\u00eb thell\u00eb t\u00eb p\u00ebrmbajtjes s\u00eb paketave rrjet, duke zbuluar shenjat e aktiviteteve anormale. N\u00eb ve\u00e7anti, ka rregulla q\u00eb lejojn\u00eb t\u00eb zbulohen sulmet ndaj sistemeve kryesore p\u00ebr menaxhimin e p\u00ebrmbajtjes (content management system, CMS), nd\u00ebrfaqeve t\u00eb internetit t\u00eb pajisjeve rrjet, dhe sulmeve ndaj server\u00ebve t\u00eb post\u00ebs dhe FTP.<\/p>\n<h3>3. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1133\/\">T1133<\/a><\/noindex>: sh\u00ebrbimet e larg\u00ebta eksternale (external remote services) <\/h3>\n<p>\nP\u00ebrdorimi i sh\u00ebrbimeve t\u00eb aksesit t\u00eb larg\u00ebt nga sulmuesit p\u00ebr t\u00eb lidhur me burimet e rrjetit t\u00eb brendsh\u00ebm nga jasht\u00eb. <\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: pasi sistemi njeh protokollet jo sipas numrave t\u00eb porteve, por sipas p\u00ebrmbajtjes s\u00eb paketave, p\u00ebrdoruesit e sistemit mund t\u00eb filtrojn\u00eb trafikun n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb gjejn\u00eb t\u00eb gjitha seancat e protokollit t\u00eb aksesit t\u00eb larg\u00ebt dhe t\u00eb verifikojn\u00eb legjitimitetin e tyre. <\/p>\n<h3>4. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1193\/\">T1193<\/a><\/noindex>: bashk\u00ebngjitja e spearphishing <\/h3>\n<p>\nKjo ka t\u00eb b\u00ebj\u00eb me d\u00ebrgesat fam\u00ebkeqe t\u00eb bashk\u00ebngjitjeve phishing.<\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: automatikisht nxjerr skedar\u00ebt nga trafiku dhe i kontrollon ata sipas indikator\u00ebve t\u00eb komprometimit. Skedar\u00ebt ekzekutues n\u00eb bashk\u00ebngjitje identifikohen nga rregullat q\u00eb analizojn\u00eb p\u00ebrmbajtjen e trafikut t\u00eb post\u00ebs elektronike. N\u00eb nj\u00eb mjedis korporate, nj\u00eb bashk\u00ebngjitje e till\u00eb konsiderohet anomali. <\/p>\n<h3>5. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1192\/\">T1192<\/a><\/noindex>: lidhje spearphishing <\/h3>\n<p>\nP\u00ebrdorimi i lidhjeve phishing. Teknikat p\u00ebrfshijn\u00eb d\u00ebrgimin e nj\u00eb emaili phishing nga haker\u00ebt, me nj\u00eb lidhje t\u00eb cil\u00ebn, kur klikohet, shkarkohet nj\u00eb program keqdash\u00ebs. Zakonisht, lidhja shoq\u00ebrohet nga nj\u00eb tekst, i hartuar sipas t\u00eb gjitha rregullave t\u00eb inxhinieris\u00eb sociale. <\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: identifikon lidhjet phishing duke p\u00ebrdorur indikator\u00ebt e komprometimit. P\u00ebr shembull, n\u00eb nd\u00ebrfaqen PT NAD shohim nj\u00eb sesion, ku kishte nj\u00eb lidhje HTTP p\u00ebrmes nj\u00eb lidhjeje t\u00eb renditur n\u00eb list\u00ebn e adresave phishing (phishing-urls).<\/p>\n<p><img decoding=\"async\" alt=\"Si sistemet e analiz\u00ebs s\u00eb trafikut zbulojn\u00eb taktikat e haker\u00ebve sipas MITRE ATT&amp;CK p\u00ebrmes PT Network Attack Discovery\" src=\"\/wp-content\/uploads\/2020\/03\/f8b8f0ed7e64da6a9ceb2c3e8d3b3202.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Lidhja p\u00ebrmes nj\u00eb lidhjeje nga lista e indikator\u00ebve t\u00eb komprometimit phishing-urls<\/i><\/p>\n<h3>6. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1199\">T1199<\/a><\/noindex>: marr\u00ebdh\u00ebnie t\u00eb besuara<\/h3>\n<p>\nQasja n\u00eb rrjetin e viktim\u00ebs p\u00ebrmes pal\u00ebve t\u00eb treta me t\u00eb cilat viktima ka vendosur marr\u00ebdh\u00ebnie t\u00eb besuara. Haker\u00ebt mund t\u00eb thyejn\u00eb nj\u00eb organizat\u00eb t\u00eb besuar dhe t\u00eb lidhen p\u00ebrmes saj me rrjetin e synuar. P\u00ebr k\u00ebt\u00eb ata p\u00ebrdorin lidhje VPN ose marr\u00ebdh\u00ebnie besimi t\u00eb domain-eve, t\u00eb cilat mund t\u00eb identifikohen p\u00ebrmes analiz\u00ebs s\u00eb trafikut. <\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: analizon protokollet aplikative dhe ruan fushat e analizuar n\u00eb nj\u00eb baz\u00eb t\u00eb dh\u00ebnash, duke mund\u00ebsuar q\u00eb analisti i siguris\u00eb t\u00eb gjej\u00eb me ndihm\u00ebn e filtrave t\u00eb gjitha lidhjet VPN t\u00eb dyshimta ose lidhjet nd\u00ebr-domain.<\/p>\n<h3>7. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1078\/\">T1078<\/a><\/noindex>: llogari valide<\/h3>\n<p>\nP\u00ebrdorimi i kredencialeve standarde, lokale ose domain p\u00ebr autorizimin n\u00eb sh\u00ebrbimet e jashtme dhe t\u00eb brendshme.<\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: automatikisht nxjerr kredencialet nga protokollet HTTP, FTP, SMTP, POP3, IMAP, SMB, DCE\/RPC, SOCKS5, LDAP, Kerberos. N\u00eb p\u00ebrgjith\u00ebsi, k\u00ebto p\u00ebrfshijn\u00eb emrin e p\u00ebrdoruesit, fjal\u00ebkalimin dhe nj\u00eb shenj\u00eb t\u00eb suksesit t\u00eb autentikimit. N\u00ebse jan\u00eb p\u00ebrdorur, ato shfaqen n\u00eb kartel\u00ebn p\u00ebrkat\u00ebse t\u00eb sesionit.<\/p>\n<h2>Ekzekutimi<\/h2>\n<p><img decoding=\"async\" alt=\"Si sistemet e analiz\u00ebs s\u00eb trafikut zbulojn\u00eb taktikat e haker\u00ebve sipas MITRE ATT&amp;CK p\u00ebrmes PT Network Attack Discovery\" src=\"\/wp-content\/uploads\/2020\/03\/54cfa8b924eb5061d7cc8bc93335c735.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nTaktika e Ekzekutimit p\u00ebrfshin teknikat q\u00eb haker\u00ebt zbatojn\u00eb p\u00ebr t\u00eb ekzekutuar kodin n\u00eb sistemet e komprometuar. Ngritja e kodit keqdash\u00ebs ndihmon sulmuesit t\u00eb konsolidojn\u00eb pranin\u00eb (taktika e vazhdim\u00ebsis\u00eb) dhe t\u00eb zgjerojn\u00eb aksesin n\u00eb sistemet e larg\u00ebta brenda rrjetit, duke u l\u00ebvizur brenda perimetrave. <\/p>\n<p>PT NAD lejon identifikimin e aplikimit t\u00eb 14 teknikave nga ana e haker\u00ebve q\u00eb p\u00ebrdoren p\u00ebr ekzekutimin e kodit keqdash\u00ebs. <\/p>\n<h3>1. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1191\/\">T1191<\/a><\/noindex>: CMSTP (Microsoft Connection Manager Profile Installer)<\/h3>\n<p>\nTaktika e cila abuzuesit p\u00ebrgatisin nj\u00eb inf-file t\u00eb ve\u00e7ant\u00eb malware q\u00eb p\u00ebrdor utilitarin CMSTP.exe t\u00eb integruar n\u00eb Windows (instaluesi i profileve t\u00eb menaxherit t\u00eb lidhjeve). CMSTP.exe pranon skedarin si nj\u00eb paramet\u00ebr dhe instalon profilin e sh\u00ebrbimit p\u00ebr lidhje t\u00eb larg\u00ebt. Si rezultat, CMSTP.exe mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb ngarkuar dhe ekzekutuar biblioteka t\u00eb lidhura dinamikisht (*.dll) ose skritpe (*.sct) nga servera t\u00eb larg\u00ebt. <\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: zbulon automatikisht n\u00eb trafikun HTTP transmetimin e inf-file-ve t\u00eb llojit t\u00eb ve\u00e7ant\u00eb. P\u00ebrve\u00e7 k\u00ebsaj, ai zbulon transmetimin p\u00ebrmes protokollit HTTP t\u00eb skritpeve t\u00eb d\u00ebmshme dhe bibliotekave t\u00eb lidhura dinamikisht nga nj\u00eb server i larg\u00ebt. <\/p>\n<h3>2. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1059\">T1059<\/a><\/noindex>: nd\u00ebrfaqe e komand\u00ebs <\/h3>\n<p>\nNd\u00ebrveprimi me nd\u00ebrfaqen e komand\u00ebs. Me nd\u00ebrfaqen e komand\u00ebs mund t\u00eb nd\u00ebrveproni lokal ose n\u00eb distanc\u00eb, p\u00ebr shembull p\u00ebrmes utilitareve t\u00eb qasjes n\u00eb distanc\u00eb.<\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: zbulon automatikisht pranin\u00eb e shell-eve p\u00ebrmes p\u00ebrgjigjeve n\u00eb komandat e ndryshme t\u00eb utilitar\u00ebve t\u00eb komand\u00ebs, si ping, ifconfig.<\/p>\n<h3>3. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1175\/\">T1175<\/a><\/noindex>: modeli i objektit t\u00eb komponent\u00ebve dhe DCOM-i distribuar <\/h3>\n<p>\nP\u00ebrdorimi i teknologjive COM ose DCOM p\u00ebr t\u00eb ekzekutuar kodin n\u00eb sisteme lokale ose t\u00eb larg\u00ebta gjat\u00eb p\u00ebrparimit n\u00eb rrjet.<\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: zbulon thirrjet e dyshimta DCOM q\u00eb abuzuesit zakonisht p\u00ebrdorin p\u00ebr t\u00eb ekzekutuar programe. <\/p>\n<h3>4. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1203\/\">T1203<\/a><\/noindex>: shfryt\u00ebzim p\u00ebr ekzekutimin e klient\u00ebve <\/h3>\n<p>\nShfryt\u00ebzimi i dob\u00ebsive p\u00ebr ekzekutimin e kodit t\u00eb rastit n\u00eb stacionin e pun\u00ebs. Eskploit\u00ebt m\u00eb t\u00eb dobish\u00ebm p\u00ebr sulmuesit jan\u00eb ata q\u00eb lejojn\u00eb ekzekutimin e kodit n\u00eb sistemin e larg\u00ebt, pasi me ndihm\u00ebn e tyre abuzuesit mund t\u00eb ken\u00eb qasje n\u00eb at\u00eb sistem. Kjo teknik\u00eb mund t\u00eb realizohet me metodat e m\u00ebposhtme: shp\u00ebrndarja e post\u00ebs s\u00eb d\u00ebmshme, nj\u00eb faqe interneti me eskploit\u00eb p\u00ebr shfletuesit dhe shfryt\u00ebzimi n\u00eb distanc\u00eb i dob\u00ebsive t\u00eb aplikacioneve. <\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: gjat\u00eb analizimit t\u00eb trafikut t\u00eb post\u00ebs, PT NAD e kontrollon at\u00eb p\u00ebr pranin\u00eb e skedar\u00ebve executable n\u00eb bashk\u00ebngjitur. Ai automatikisht nxjerr dokumentet Office nga email-et q\u00eb mund t\u00eb ken\u00eb eskploit\u00eb. P\u00ebrpjekjet p\u00ebr t\u00eb shfryt\u00ebzuar dob\u00ebsit\u00eb jan\u00eb t\u00eb dukshme n\u00eb trafik, t\u00eb cilat PT NAD i identifikon automatikisht.<\/p>\n<h3>5. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1170\">T1170<\/a><\/noindex>: mshta<\/h3>\n<p>\nP\u00ebrdorimi i utilitarit mshta.exe, i cili ekzekuton aplikacione Microsoft HTML (HTA) me zgjerimin .hta. Duke qen\u00eb se mshta p\u00ebrpunon skedar\u00ebt duke anashkaluar cil\u00ebsimet e siguris\u00eb s\u00eb shfletuesit, sulmuesit mund t\u00eb p\u00ebrdorin mshta.exe p\u00ebr t\u00eb ekzekutuar skedar\u00eb t\u00eb d\u00ebmsh\u00ebm HTA, JavaScript ose VBScript. <\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: skedar\u00ebt .hta p\u00ebr ekzekutim p\u00ebrmes mshta d\u00ebrgohen edhe n\u00ebp\u00ebr rrjet \u2014 kjo mund t\u00eb shihet n\u00eb trafikun e rrjetit. PT NAD identifikon automatikisht d\u00ebrgimin e k\u00ebtyre skedar\u00ebve t\u00eb d\u00ebmsh\u00ebm. Ai kap skedar\u00ebt, dhe informacioni n\u00eb lidhje me ta mund t\u00eb shikohet n\u00eb kartel\u00ebn e seanc\u00ebs.<\/p>\n<h3>6. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1086\">T1086<\/a><\/noindex>: PowerShell <\/h3>\n<p>\nP\u00ebrdorimi i PowerShell p\u00ebr t\u00eb k\u00ebrkuar informacion dhe p\u00ebr t\u00eb ekzekutuar kod t\u00eb d\u00ebmsh\u00ebm. <\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: kur PowerShell p\u00ebrdoret nga sulmuesit n\u00eb distanc\u00eb, PT NAD e zbulon k\u00ebt\u00eb p\u00ebrmes rregullave. Ai zbulon fjal\u00ebt ky\u00e7e t\u00eb gjuh\u00ebs PowerShell, t\u00eb cilat shpesh p\u00ebrdoren n\u00eb skenar\u00eb t\u00eb d\u00ebmsh\u00ebm, dhe d\u00ebrgimin e skenar\u00ebve PowerShell p\u00ebrmes protokollit SMB.<\/p>\n<p>7. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1053\">T1053<\/a><\/noindex>: detyra e planifikuar<br \/>\nP\u00ebrdorimi i planifikuesit t\u00eb detyrave Windows dhe utilitar\u00ebve t\u00eb tjer\u00eb p\u00ebr t\u00eb nisur automatikisht programe ose skenar\u00eb n\u00eb nj\u00eb koh\u00eb t\u00eb caktuar. <\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: sulmuesit krijojn\u00eb ndonj\u00ebher\u00eb k\u00ebto detyra nga distanca, k\u00ebshtu q\u00eb k\u00ebto seanca shihen n\u00eb trafik. PT NAD identifikon automatikisht operacionet suspensuese t\u00eb krijimit dhe ndryshimit t\u00eb detyrave duke p\u00ebrdorur nd\u00ebrfaqet RPC t\u00eb ATSVC dhe ITaskSchedulerService.<\/p>\n<h3>8. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1064\">T1064<\/a><\/noindex>: skriptimi <\/h3>\n<p>\nEkzekutimi i skripteve p\u00ebr automatizimin e veprimeve t\u00eb ndryshme t\u00eb sulmuesve. <\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: identifikon faktet e d\u00ebrgimin t\u00eb skripteve n\u00eb rrjet, q\u00eb do t\u00eb thot\u00eb edhe para se ato t\u00eb ekzekutohen. Ai zbulon p\u00ebrmbajtjen e skripteve n\u00eb trafik dhe detekton d\u00ebrgimin n\u00eb rrjet t\u00eb skedar\u00ebve me zgjerime q\u00eb p\u00ebrkojn\u00eb me gjuh\u00eb t\u00eb njohura skriptuese.<\/p>\n<h3>9. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1035\">T1035<\/a><\/noindex>: ekzekutimi i sh\u00ebrbimit<\/h3>\n<p>\nNisja e nj\u00eb skedari ekzekutiv, komandave t\u00eb nd\u00ebrfaqes s\u00eb komand\u00ebs ose nj\u00eb skripti duke u angazhuar me sh\u00ebrbimet Windows, p\u00ebr shembull me menaxherin e kontrollit t\u00eb sh\u00ebrbimeve (Service Control Manager, SCM). <\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: inspekton trafikun SMB dhe detekton aksesin n\u00eb SCM p\u00ebrmes rregullave mbi krijimin, ndryshimin dhe nisjen e sh\u00ebrbimeve. <\/p>\n<p>Teknika e nisjes s\u00eb sh\u00ebrbimeve mund t\u00eb realizohet p\u00ebrmes nj\u00eb utilitari p\u00ebr ekzekutimin e komandave nga distanca PSExec. PT NAD analizon protokollin SMB dhe detekton p\u00ebrdorimin e PSExec, kur ajo p\u00ebrdor skedarin PSEXESVC.exe ose emrin standard t\u00eb sh\u00ebrbimit PSEXECSVC p\u00ebr t\u00eb ekzekutuar kodin n\u00eb makin\u00ebn e larg\u00ebt. P\u00ebrdoruesi duhet t\u00eb verifikoj\u00eb list\u00ebn e komandave t\u00eb ekzekutuara dhe legjitimitetin e ekzekutimit t\u00eb komandave nga distanca nga nodi. <\/p>\n<blockquote><p>N\u00eb kartel\u00ebn e sulmit n\u00eb PT NAD shfaqen t\u00eb dh\u00ebnat mbi taktikat dhe teknikat e p\u00ebrdorura sipas matric\u00ebs ATT&amp;CK, duke i mund\u00ebsuar p\u00ebrdoruesit t\u00eb kuptoj\u00eb n\u00eb cil\u00ebn faz\u00eb t\u00eb sulmit ndodhen sulmuesit, cilat jan\u00eb objektivat e tyre dhe cilat masa kompensuese duhet t\u00eb merren. <\/p><\/blockquote>\n<p>\n<img decoding=\"async\" alt=\"Si sistemet e analiz\u00ebs s\u00eb trafikut zbulojn\u00eb taktikat e haker\u00ebve sipas MITRE ATT&amp;CK p\u00ebrmes PT Network Attack Discovery\" src=\"\/wp-content\/uploads\/2020\/03\/cef63cd458947bf4b4a7735a44362f30.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Aktivizimi i rregullit p\u00ebr p\u00ebrdorimin e mjetit PSExec, q\u00eb mund t\u00eb tregoj\u00eb nj\u00eb p\u00ebrpjekje p\u00ebr t\u00eb ekzekutuar komanda n\u00eb nj\u00eb makin\u00eb t\u00eb larg\u00ebt.<\/i><\/p>\n<h3>10. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1072\/\">T1072<\/a><\/noindex>: software i pal\u00ebs s\u00eb tret\u00eb<\/h3>\n<p>\nNj\u00eb teknik\u00eb ku sulmuesit fitojn\u00eb akses n\u00eb softuerin p\u00ebr administrim t\u00eb larg\u00ebt ose n\u00eb sistemin e shp\u00ebrndarjes s\u00eb softuer\u00ebve dhe me ndihm\u00ebn e tij ekzekutojn\u00eb kode t\u00eb d\u00ebmshme. Shembuj t\u00eb till\u00eb softueri jan\u00eb: SCCM, VNC, TeamViewer, HBSS, Altiris. <br \/>\nPik\u00eb s\u00eb pari, kjo teknik\u00eb \u00ebsht\u00eb ve\u00e7an\u00ebrisht e r\u00ebnd\u00ebsishme n\u00eb lidhje me kalimin masiv n\u00eb pun\u00ebn e larg\u00ebt dhe, si pasoj\u00eb, lidhjen e shum\u00eb pajisjeve personale t\u00eb pa mbrojtura p\u00ebrmes kanaleve t\u00eb dyshimta t\u00eb aksesit t\u00eb larg\u00ebt.<\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: automatikisht identifikon n\u00eb rrjet funksionimin e till\u00eb t\u00eb softuerit. Shembujt e aktivizimeve ndodhin n\u00eb rastin e lidhjeve p\u00ebrmes protokollit VNC dhe aktivitetit t\u00eb trojanit EvilVNC, i cili fshehurazi vendos nj\u00eb server VNC n\u00eb kompjuterin e viktim\u00ebs dhe e aktivizon automatikisht. Gjithashtu, PT NAD identifikon automatikisht protokollin TeamViewer, \u00e7ka ndihmon analistin me ndihm\u00ebn e filtrit p\u00ebr t\u00eb gjetur t\u00eb gjitha k\u00ebto sesione dhe t\u00eb kontrolloj\u00eb legjitimitetin e tyre.<\/p>\n<h3>11. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1204\/\">T1204<\/a><\/noindex>: ekzekutimi nga p\u00ebrdoruesi<\/h3>\n<p>\nNj\u00eb teknik\u00eb ku p\u00ebrdoruesi ekzekuton skedar\u00eb q\u00eb mund t\u00eb \u00e7ojn\u00eb n\u00eb ekzekutimin e kodit. Kjo mund t\u00eb ndodh\u00eb, p\u00ebr shembull, n\u00ebse ai hap nj\u00eb skedar ekzekutues ose ekzekuton nj\u00eb dokument zyre me makro.<\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: identificon k\u00ebta skedar\u00eb q\u00eb n\u00eb faz\u00ebn e transmetimit, para ekzekutimit t\u00eb tyre. Informacioni mbi to mund t\u00eb studiohet n\u00eb kartel\u00ebn e seancave, n\u00eb t\u00eb cilat ato jan\u00eb transmetuar.<\/p>\n<h3>12. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1047\">T1047<\/a><\/noindex>: Windows Management Instrumentation<\/h3>\n<p>\nP\u00ebrdorimi i mjetit WMI, i cili ofron mund\u00ebsin\u00eb p\u00ebr akses lokal dhe t\u00eb larg\u00ebt n\u00eb komponent\u00ebt sistemor\u00eb t\u00eb Windows. Me ndihm\u00ebn e WMI, sulmuesit mund t\u00eb nd\u00ebrveprojn\u00eb me sisteme lokale dhe t\u00eb larg\u00ebta dhe t\u00eb ekzekutojn\u00eb shum\u00eb detyra, si p\u00ebr shembull t\u00eb mbledhin informacion p\u00ebr q\u00ebllime inteligjence dhe t\u00eb ekzekutojn\u00eb procese n\u00ebp\u00ebrmjet l\u00ebvizjes horizontale.<\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: pasi nd\u00ebrveprimet me sistemet e larg\u00ebta p\u00ebrmes WMI jan\u00eb t\u00eb dukshme n\u00eb trafik, PT NAD automatikisht identifikon k\u00ebrkesat rrjet p\u00ebr t\u00eb vendosur sesione WMI dhe kontrollon trafikun p\u00ebr shenja t\u00eb transmetimit t\u00eb skenar\u00ebve q\u00eb p\u00ebrdorin WMI.<\/p>\n<h3>13. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1028\">T1028<\/a><\/noindex>: Menaxhimi i Larg\u00ebt t\u00eb Windows <\/h3>\n<p>\nP\u00ebrdorimi i sh\u00ebrbimit dhe protokollit Windows, i cili i lejon p\u00ebrdoruesit t\u00eb nd\u00ebrveproj\u00eb me sisteme t\u00eb larg\u00ebta. <\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: sheh lidhjet rrjet\u00ebsore t\u00eb vendosura p\u00ebrmes Windows Remote Management. Sesionet e tilla detektohen automatikisht nga rregullat. <\/p>\n<h3>14. <noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/techniques\/T1220\/\">T1220<\/a><\/noindex>: p\u00ebrpunimi i skripteve XSL (Extensible Stylesheet Language)<\/h3>\n<p>\nGjuha e shenjtura XSL p\u00ebrdoret p\u00ebr t\u00eb p\u00ebrshkruar p\u00ebrpunimin dhe visualizimin e t\u00eb dh\u00ebnave n\u00eb skedar\u00ebt XML. P\u00ebr t\u00eb mb\u00ebshtetur operacione komplekse, standarti XSL p\u00ebrfshin mb\u00ebshtetje p\u00ebr skripte t\u00eb integruara n\u00eb gjuh\u00eb t\u00eb ndryshme. K\u00ebto gjuh\u00eb lejojn\u00eb ekzekutimin e kodit t\u00eb rast\u00ebsish\u00ebm, \u00e7ka \u00e7on n\u00eb anashkalimin e politikave t\u00eb siguris\u00eb q\u00eb bazohen n\u00eb lista t\u00eb bardha. <\/p>\n<p><b>\u00c7far\u00eb b\u00ebn PT NAD<\/b>: identifikon faktet e transferimit t\u00eb k\u00ebtyre skedar\u00ebve p\u00ebrmes rrjetit, pra, ende para se ato t\u00eb fillonin. Ai automatikisht zbulohet faktin e transferimit t\u00eb skedar\u00ebve XSL dhe skedar\u00ebve me shenjat e abnormal XSL.<\/p>\n<p>N\u00eb materialet n\u00eb vijim, do t\u00eb shqyrtojm\u00eb se si sistemi NTA PT Network Attack Discovery gjen taktika dhe teknika t\u00eb tjera t\u00eb haker\u00ebve sipas MITRE ATT&amp;CK. Q\u00ebndroni t\u00eb informuar!<\/p>\n<p><b>Autoret<\/b>: <\/p>\n<ul>\n<li>Anton Kutev, specialist n\u00eb qendr\u00ebn e ekspertiz\u00ebs s\u00eb siguris\u00eb (PT Expert Security Center) Positive Technologies<\/li>\n<li>Natalia Kazankova, marketer produkti Positive Technologies<\/li>\n<\/ul>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/pt\/blog\/493082\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e Verizon, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e (87%) \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432 \u0418\u0411 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u044f\u0442 \u0437\u0430 \u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0435 \u043c\u0438\u043d\u0443\u0442\u044b, \u0430 \u043d\u0430 \u0438\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0443 68% \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0443\u0445\u043e\u0434\u044f\u0442 \u043c\u0435\u0441\u044f\u0446\u044b. \u042d\u0442\u043e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435\u043c Ponemon Institute, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u0443 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0443\u0445\u043e\u0434\u0438\u0442 \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u043c 206 \u0434\u043d\u0435\u0439 \u043d\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430. \u041f\u043e \u043e\u043f\u044b\u0442\u0443 \u043d\u0430\u0448\u0438\u0445 \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439, \u0445\u0430\u043a\u0435\u0440\u044b \u043c\u043e\u0433\u0443\u0442 \u0433\u043e\u0434\u0430\u043c\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0438 \u043d\u0435 \u0431\u044b\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c\u0438. \u0422\u0430\u043a, \u0432 \u043e\u0434\u043d\u043e\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":76040,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-76039","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e MITRE ATT&amp;CK \u043d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 PT Network Attack Discovery | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-03-30T11:43:09+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-30T11:43:09+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Si sistemet e analiz\u00ebs s\u00eb trafikut zbulojn\u00eb taktikat e haker\u00ebve sipas MITRE ATT&amp;CK p\u00ebrmes PT Network Attack Discovery | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043f\u043e MITRE ATT&amp;CK \u043d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 PT Network Attack Discovery | ProHoster","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-sistemy-analiza-trafika-obnaruzhivayut-taktiki-hakerov-po-mitre-attck-na-primere-pt-network-attack-discovery","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-30T11:43:09+00:00","article:modified_time":"2020-03-30T11:43:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"76039","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:44:27","updated":"2022-09-27 21:17:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/76039","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=76039"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/76039\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/76040"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=76039"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=76039"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=76039"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}