{"id":90735,"date":"2020-08-05T13:42:06","date_gmt":"2020-08-05T11:42:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust"},"modified":"2020-08-05T13:42:06","modified_gmt":"2020-08-05T11:42:06","slug":"vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","title":{"rendered":"Ne fillojm\u00eb mbledhjen e ngjarjeve p\u00ebr nisjen e proceseve t\u00eb dyshimta n\u00eb Windows dhe zbulojm\u00eb k\u00ebrc\u00ebnimet me ndihm\u00ebn e Quest InTrust","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Ne
\n
\nNj\u00eb nga llojet m\u00eb t\u00eb zakonshme t\u00eb sulmeve \u00ebsht\u00eb krijimi i nj\u00eb procesi keqdash\u00ebs n\u00eb nj\u00eb pem\u00eb n\u00ebn procese q\u00eb duken t\u00eb zakonshme. Nj\u00eb dyshim mund t\u00eb ngjall\u00eb rruga drejt skedarit ekzekutues: shpesh, softueri keqdash\u00ebs p\u00ebrdor dosjet AppData ose Temp, q\u00eb nuk jan\u00eb karakteristike p\u00ebr programet e ligjshme. \u00cbsht\u00eb e drejt\u00eb t\u00eb thuhet se disa utilitar\u00eb t\u00eb p\u00ebrdit\u00ebsimit automatike ekzekutohen n\u00eb AppData, prandaj vet\u00ebm kontrollet p\u00ebr vendin e nisjes nuk jan\u00eb t\u00eb mjaftueshme p\u00ebr t\u00eb deklaruar se nj\u00eb program \u00ebsht\u00eb keqdash\u00ebs.<\/p>\n

Nj\u00eb faktor tjet\u00ebr p\u00ebr legitimimin \u00ebsht\u00eb n\u00ebnshkrimi kriptografik: shum\u00eb programe origjinale jan\u00eb n\u00ebnshkruar nga furnizuesi. Mund t\u00eb p\u00ebrdoret fakti i munges\u00ebs s\u00eb n\u00ebnshkrimit si nj\u00eb metod\u00eb p\u00ebr identifikimin e elementeve t\u00eb dyshimta t\u00eb autoload. Por, p\u00ebrs\u00ebri, ka softuer keqdash\u00ebs q\u00eb p\u00ebrdor nj\u00eb certifikat\u00eb t\u00eb vjedhur p\u00ebr t\u00eb n\u00ebnshkruar veten e tij.<\/p>\n

Gjithashtu, mund t\u00eb kontrolloni vler\u00ebn e hash-ave kriptografik\u00eb MD5 ose SHA256, t\u00eb cilat mund t\u00eb p\u00ebrputhen me disa programe keqdash\u00ebse t\u00eb zbuluara m\u00eb par\u00eb. Mund t\u00eb kryeni nj\u00eb analiz\u00eb statike duke kontrolluar n\u00ebnshkrimet n\u00eb program (me rregulla Yara ose produkte antivirus). Gjithashtu ka analiz\u00eb dinamike (ekzekutimi i programit n\u00eb nj\u00eb mjedis t\u00eb sigurt dhe ndjekja e veprimeve t\u00eb tij) dhe inxhiniering t\u00eb prapambetur.<\/p>\n

Ka shum\u00eb shenja t\u00eb nj\u00eb procesi keqdash\u00ebs. N\u00eb k\u00ebt\u00eb artikull do t\u00eb flasim se si t\u00eb aktivizoni auditimin e ngjarjeve p\u00ebrkat\u00ebse n\u00eb Windows, dhe do t\u00eb shqyrtojm\u00eb shenjat mbi t\u00eb cilat mb\u00ebshtetet rregulli i integruar InTrust<\/a><\/noindex> p\u00ebr identifikimin e nj\u00eb procesi t\u00eb dyshimt\u00eb. InTrust \u00ebsht\u00eb platform\u00eb CLM<\/a><\/noindex> p\u00ebr mbledhjen, analysimin dhe ruajtjen e t\u00eb dh\u00ebnave t\u00eb strukturuara, e cila ka tashm\u00eb qindra reagime t\u00eb paracaktuar p\u00ebr lloje t\u00eb ndryshme sulmesh.
\n<\/a><\/noindex>
\nKur programi ekzekutohet, ai ngarkohet n\u00eb memorien e kompjuterit. Skedari ekzekutues p\u00ebrmban udh\u00ebzime kompjuterike dhe biblioteka ndihm\u00ebse (p.sh., *.dll). Kur procesi \u00ebsht\u00eb tashm\u00eb i nisur, ai mund t\u00eb krijoj\u00eb rrjedha t\u00eb tjera. Rrjedhat lejojn\u00eb procesin t\u00eb ekzekutoj\u00eb grupe t\u00eb ndryshme udh\u00ebzimesh n\u00eb m\u00ebnyr\u00eb simultane. Ka shum\u00eb m\u00ebnyra p\u00ebr t\u00eb infiltruar kodin e keqdash\u00ebs n\u00eb memorie dhe p\u00ebr ta b\u00ebr\u00eb at\u00eb t\u00eb ekzekutohet, le t\u00eb shqyrtojm\u00eb disa prej tyre.<\/p>\n

M\u00ebnyra m\u00eb e thjesht\u00eb p\u00ebr t\u00eb nisur nj\u00eb proces keqdash\u00ebs \u00ebsht\u00eb t\u00eb b\u00ebsh q\u00eb p\u00ebrdoruesi ta nis\u00eb at\u00eb drejtp\u00ebrdrejt (p.sh., nga nj\u00eb bashk\u00ebngjitje e post\u00ebs elektronike), pastaj duke p\u00ebrdorur \u00e7el\u00ebsin RunOnce ta nisin at\u00eb \u00e7do her\u00eb kur kompjuteri ndizet. Kjo gjithashtu p\u00ebrfshin softuerin keqdash\u00ebs \"pa skedar\u00eb\", i cili ruan skenar\u00eb PowerShell n\u00eb ky\u00e7et e regjistrit q\u00eb ekzekutohen mbi baz\u00ebn e nj\u00eb trigger-i. N\u00eb k\u00ebt\u00eb rast, skenari PowerShell \u00ebsht\u00eb kodi keqdash\u00ebs.<\/p>\n

Problemi me ekzekutimin e qart\u00eb t\u00eb softuerit keqdash\u00ebs \u00ebsht\u00eb se ky \u00ebsht\u00eb nj\u00eb qasje e njohur, e cila zbulon leht\u00ebsisht. Disa programe keqdash\u00ebse p\u00ebrdorin metoda m\u00eb t\u00eb sofistikuara, p\u00ebr shembull, p\u00ebrdorin nj\u00eb proces tjet\u00ebr p\u00ebr t\u00eb filluar t\u00eb ekzekutohen n\u00eb memorien. K\u00ebshtu, nj\u00eb proces mund t\u00eb krijoj\u00eb nj\u00eb proces tjet\u00ebr duke nisur nj\u00eb udh\u00ebzim kompjuterik dhe duke treguar skedarin ekzekutues (.exe) p\u00ebr tu nisur.<\/p>\n

Nj\u00eb skedar mund t\u00eb tregohet duke p\u00ebrdorur rrug\u00ebn e plot\u00eb (p.sh., C:Windowssystem32cmd.exe) ose me rrug\u00ebn e pjesshme (p.sh., cmd.exe). N\u00ebse procesi origjin\u00eb nuk \u00ebsht\u00eb i sigurt, ai do t\u00eb lejoj\u00eb ekzekutimin e programeve t\u00eb paligjshme. Nj\u00eb sulm mund t\u00eb duket k\u00ebshtu: procesi nis cmd.exe pa treguar rrug\u00ebn e plot\u00eb, dhe sulmuesi vendos cmd.exe t\u00eb tij n\u00eb nj\u00eb vend, n\u00eb m\u00ebnyr\u00eb q\u00eb procesi ta nis\u00eb at\u00eb p\u00ebrpara se t\u00eb ekzekutoj\u00eb t\u00eb ligjishtin. Pas ekzekutimit t\u00eb programit keqdash\u00ebs, ai mund t'i jap\u00eb sinjal nj\u00eb programi legjitim (p.sh., C:Windowssystem32cmd.exe), n\u00eb m\u00ebnyr\u00eb q\u00eb programi origjin\u00eb t\u00eb vazhdoj\u00eb t\u00eb funksionoj\u00eb si\u00e7 duhet.<\/p>\n

Nj\u00eb variant i sulmit t\u00eb m\u00ebparsh\u00ebm \u00ebsht\u00eb injeksioni DLL n\u00eb nj\u00eb proces legjitim. Kur procesi nis, ai gjen dhe ngarkon biblioteka q\u00eb rrisin funksionalitetin e tij. Duke p\u00ebrdorur injeksionin DLL, sulmuesi krijon nj\u00eb bibliotek\u00eb keqdash\u00ebse me t\u00eb nj\u00ebjtin em\u00ebr dhe API si dhe ai legjitim. Programi ngarkon bibliotek\u00ebn keqdash\u00ebse, e cila, nga ana e saj, ngarkon bibliotek\u00ebn legjitime, dhe, sipas nevoj\u00ebs, p\u00ebr t\u00eb kryer operacione, e th\u00ebrret at\u00eb. Biblioteka keqdash\u00ebse fillon t\u00eb kryej\u00eb rolin e nj\u00eb proxy p\u00ebr bibliotek\u00ebn e mir\u00eb.<\/p>\n

Nj\u00eb m\u00ebnyr\u00eb tjet\u00ebr p\u00ebr t\u00eb futur kodin keqdash\u00ebs n\u00eb memorie \u00ebsht\u00eb ta futni at\u00eb n\u00eb nj\u00eb proces t\u00eb pamjaftuesh\u00ebm, i cili \u00ebsht\u00eb tashm\u00eb n\u00eb funksionim. Proceset marrin t\u00eb dh\u00ebna nga burime t\u00eb ndryshme \u2014 lexojn\u00eb nga rrjeti ose skedar\u00ebt. Zakonisht, ato kryejn\u00eb kontroll p\u00ebr t\u00eb siguruar legjitimitetin e t\u00eb dh\u00ebnave t\u00eb pranuara. Por disa procese nuk kan\u00eb mbrojtje t\u00eb mjaftueshme kur ekzekutojn\u00eb udh\u00ebzimet. N\u00eb k\u00ebt\u00eb sulm nuk ka bibliotek\u00eb n\u00eb disk ose skedar ekzekutues me kodin keqdash\u00ebs. Gjith\u00e7ka ruhet n\u00eb memorie p\u00ebrkrah procesit q\u00eb shfryt\u00ebzohet.<\/p>\n

Tani do ta themi metodologjin\u00eb e p\u00ebrfshirjes s\u00eb mbledhjes s\u00eb ngjarjeve t\u00eb tilla n\u00eb Windows dhe rregullin n\u00eb InTrust, i cili realizon mbrojtjen nga k\u00ebto k\u00ebrc\u00ebnime. Fillimisht, aktivizojm\u00eb at\u00eb p\u00ebrmes konzol\u00ebs menaxhuese InTrust.<\/p>\n

\"Ne
\n
\nRregulli p\u00ebrdor mund\u00ebsit\u00eb e ndjekjes s\u00eb proceseve n\u00eb sistemin operativ Windows. Fatkeq\u00ebsisht, aktivizimi i mbledhjes s\u00eb k\u00ebtyre ngjarjeve nuk \u00ebsht\u00eb shum\u00eb i qart\u00eb. Duhet t\u00eb ndryshoni 3 cil\u00ebsime t\u00eb ndryshme n\u00eb politik\u00ebn e grupit:<\/p>\n

Konfigurimi i Kompjuterit > Politikat > Cil\u00ebsimet e Windows > Cil\u00ebsimet e Siguris\u00eb > Politikat Vendore > Politika e Auditimit > Auditimi i ndjekjes s\u00eb proceseve<\/b><\/p>\n

\"Ne
\n
\nKonfigurimi i Kompjuterit > Politikat > Cil\u00ebsimet e Windows > Cil\u00ebsimet e Siguris\u00eb > Konfigurimi i Avancuar t\u00eb Politikes s\u00eb Auditimit > Politikat e Auditimit > Ndjekje e Detajuar > Auditimi i krijimit t\u00eb proceseve<\/b><\/p>\n

\"Ne
\n
\nKonfigurimi i Kompjuterit > Politikat > Shabllonat Administrativ > Sistemi > Krijimi i Auditit t\u00eb Proceseve > P\u00ebrfshij linj\u00ebn e komand\u00ebs n\u00eb ngjarjet e krijimit t\u00eb proceseve<\/b><\/p>\n

\"Ne
\n
\nPas aktivizimit, rregullat InTrust lejojn\u00eb zbulimin e k\u00ebrc\u00ebnimeve t\u00eb panjohura m\u00eb par\u00eb, t\u00eb cilat tregojn\u00eb sjellje t\u00eb dyshimta. P\u00ebr shembull, mund t\u00eb identifikoni \u00e7far\u00eb \u00ebsht\u00eb p\u00ebrshkruar k\u00ebtu<\/a><\/noindex> programin malicioz Dridex. Fal\u00eb projektit HP Bromium, dihet se si \u00ebsht\u00eb strukturuar nj\u00eb k\u00ebrc\u00ebnim i till\u00eb.<\/p>\n

\"Ne
\n
\nN\u00eb zinxhirin e veprimeve t\u00eb tij, Dridex p\u00ebrdor schtasks.exe p\u00ebr t\u00eb krijuar nj\u00eb detyr\u00eb t\u00eb planifikuar. P\u00ebrdorimi i k\u00ebsaj utilitare nga linja e komand\u00ebs konsiderohet sjellje shum\u00eb e dyshimt\u00eb, ashtu si\u00e7 duket edhe ekzekutimi i svchost.exe me parameter q\u00eb tregojn\u00eb p\u00ebr dosjet e p\u00ebrdoruesit ose me parametra q\u00eb ngjajn\u00eb me komandat \u00abnet view\u00bb ose \u00abwhoami\u00bb. K\u00ebtu \u00ebsht\u00eb nj\u00eb fragment i p\u00ebrkatsh\u00ebm rregulli SIGMA<\/a><\/noindex>:<\/p>\n

detektimi:\n    seleksioni1:\n        CommandLine: '*svchost.exe C:Users\\*Desktop\\*'\n    seleksioni2:\n        ParentImage: '*svchost.exe*'\n        CommandLine:\n            - '*whoami.exe \/all'\n            - '*net.exe view'\n    kushti: 1 prej tyre<\/code><\/pre>\n
\nN\u00eb InTrust, \u00e7do sjellje e dyshimt\u00eb \u00ebsht\u00eb p\u00ebrfshir\u00eb n\u00eb nj\u00eb rregull, sepse shumica e k\u00ebtyre veprimeve nuk jan\u00eb specifike p\u00ebr ndonj\u00eb k\u00ebrc\u00ebnim t\u00eb ve\u00e7ant\u00eb, por p\u00ebrkundrazi jan\u00eb t\u00eb dyshimta n\u00eb kompleks dhe n\u00eb 99% t\u00eb rasteve p\u00ebrdoren p\u00ebr q\u00ebllime jo shum\u00eb t\u00eb ndershme. Ky list\u00eb veprimesh p\u00ebrfshin, por nuk kufizohet n\u00eb:<\/p>\n