{"id":90735,"date":"2020-08-05T13:42:06","date_gmt":"2020-08-05T11:42:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust"},"modified":"2020-08-05T13:42:06","modified_gmt":"2020-08-05T11:42:06","slug":"vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","title":{"rendered":"Nisim mbledhjen e ngjarjeve p\u00ebr nisjen e proceseve t\u00eb dyshimta n\u00eb Windows dhe zbulojm\u00eb k\u00ebrc\u00ebnimet me ndihm\u00ebn e Quest InTrust","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Nisim mbledhjen e ngjarjeve p\u00ebr nisjen e proceseve t\u00eb dyshimta n\u00eb Windows dhe zbulojm\u00eb k\u00ebrc\u00ebnimet me ndihm\u00ebn e Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/6377476bf0527b75b61e174ed9915c07.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNj\u00eb nga tipet m\u00eb t\u00eb zakonshme t\u00eb sulmeve \u00ebsht\u00eb krijimi i nj\u00eb procesi keqdash\u00ebs n\u00eb nj\u00eb pem\u00eb me procese mjaft t\u00eb ligjshme. Nj\u00eb dyshim mund t\u00eb zgjoj\u00eb rruga drejt skedarit ekzekutues: shpesh her\u00eb, softveri keqdash\u00ebs p\u00ebrdor dosjet AppData ose Temp, q\u00eb nuk jan\u00eb karakteristike p\u00ebr programet legjitime. P\u00ebr t\u00eb qen\u00eb t\u00eb drejt\u00eb, \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb thuhet se disa utilitar\u00eb p\u00ebr azhurnim automatik ekzekutohen n\u00eb AppData, prandaj vet\u00ebm verifikimi i vendit t\u00eb nisjes nuk mjafton p\u00ebr t\u00eb pohuar se nj\u00eb program \u00ebsht\u00eb keqdash\u00ebs.<\/p>\n<p>Nj\u00eb faktor shtes\u00eb i legjitimitetit \u00ebsht\u00eb n\u00ebnshkrimi kriptografik: shum\u00eb programe origjinale jan\u00eb n\u00ebnshkruar nga shit\u00ebsi. Mund t\u00eb p\u00ebrdoret fakti i munges\u00ebs s\u00eb n\u00ebnshkrimit si nj\u00eb metod\u00eb p\u00ebr t\u00eb identifikuar elemente t\u00eb dyshimta n\u00eb nisje. Por s\u00ebrish, ekziston softver keqdash\u00ebs q\u00eb p\u00ebrdor nj\u00eb certifikat\u00eb t\u00eb vjedhur p\u00ebr t\u00eb n\u00ebnshkruar veten.<\/p>\n<p>Gjithashtu mund t\u00eb kontrolloni vlerat e hash-it kriptografik MD5 ose SHA256, t\u00eb cilat mund t\u00eb p\u00ebrputhen me disa programe keqdash\u00ebse t\u00eb zbuluara m\u00eb par\u00eb. Mund t\u00eb kryhet analiza statike duke shqyrtuar n\u00ebnshkrimet n\u00eb program (n\u00ebp\u00ebrmjet rregullave Yara ose produkteve anti-virus). Ka gjithashtu analiz\u00ebn dinamike (ekzekutimi i programit n\u00eb nj\u00eb ambient t\u00eb sigurt dhe monitorimi i veprimeve t\u00eb tij) dhe inxhinierin\u00eb rivendos\u00ebse.<\/p>\n<p>Ka shum\u00eb shenja t\u00eb nj\u00eb procesi keqdash\u00ebs. N\u00eb k\u00ebt\u00eb artikull do t\u00eb flasim se si t\u00eb aktivizoni auditimin e ngjarjeve p\u00ebrkat\u00ebse n\u00eb Windows, do t\u00eb shqyrtojm\u00eb shenjat mbi t\u00eb cilat mb\u00ebshtetet rregulli i integruar <noindex><a rel=\"nofollow\" href=\"https:\/\/gals.software\/vendors\/quest\/intrust\">InTrust<\/a><\/noindex> p\u00ebr identifikimin e nj\u00eb procesi t\u00eb dyshimt\u00eb. InTrust \u2014 \u00ebsht\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/512908\/\">platform\u00eb CLM<\/a><\/noindex> p\u00ebr mbledhjen, analizimin dhe ruajtjen e t\u00eb dh\u00ebnave jo-strukturuara, ku jan\u00eb tashm\u00eb qindra reagime t\u00eb paracaktuar p\u00ebr lloje t\u00eb ndryshme sulmesh.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nKur programi niset, ai ngarkohet n\u00eb memorien e kompjuterit. Skedari ekzekutues p\u00ebrmban udh\u00ebzime kompjuterike dhe librari ndihm\u00ebse (p.sh., *.dll). Kur procesi \u00ebsht\u00eb tashm\u00eb i nisur, ai mund t\u00eb krijoj\u00eb rrjedha shtes\u00eb. Rrjedhat lejojn\u00eb procesit t\u00eb ekzekutoj\u00eb grupe t\u00eb ndryshme udh\u00ebzimesh n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb. Ekzistojn\u00eb shum\u00eb m\u00ebnyra t\u00eb dep\u00ebrtimit t\u00eb kodit keqdash\u00ebs n\u00eb memorien dhe ekzekutimin e tij, le t\u00eb shqyrtojm\u00eb disa prej tyre.<\/p>\n<p>M\u00ebnyra m\u00eb e thjesht\u00eb p\u00ebr t\u00eb filluar nj\u00eb proces t\u00eb keq \u00ebsht\u00eb t\u00eb detyrosh p\u00ebrdoruesin ta filloj\u00eb at\u00eb direkt (p.sh., nga nj\u00eb shtes\u00eb e post\u00ebs elektronike), pastaj p\u00ebrmes \u00e7el\u00ebsit RunOnce ta ekzekutoj\u00eb at\u00eb n\u00eb \u00e7do her\u00eb q\u00eb ndizet kompjuteri. K\u00ebtu p\u00ebrfshihet gjithashtu softueri i keq \"pa skedar\u00eb\", i cili ruan skriptet PowerShell n\u00eb \u00e7el\u00ebsat e regjistrit, q\u00eb ekzekutohen bazuar n\u00eb nj\u00eb ngjarje. N\u00eb k\u00ebt\u00eb rast, skripta PowerShell \u00ebsht\u00eb kodi i keq.<\/p>\n<p>Problemi me ekzekutimin e qart\u00eb t\u00eb softuerit t\u00eb keq \u00ebsht\u00eb se kjo \u00ebsht\u00eb nj\u00eb qasje e njohur q\u00eb zbulohen leht\u00ebsisht. Disa programe t\u00eb d\u00ebmshme b\u00ebjn\u00eb gj\u00ebra m\u00eb t\u00eb sofistikuara, si\u00e7 \u00ebsht\u00eb p\u00ebrdorimi i nj\u00eb procesi tjet\u00ebr p\u00ebr t'u filluar t\u00eb ekzekutohet n\u00eb memorje. Si pasoj\u00eb, nj\u00eb proces mund t\u00eb krijoj\u00eb nj\u00eb proces tjet\u00ebr, duke ekzekutuar nj\u00eb instruksion t\u00eb caktuar kompjuterik dhe duke treguar skedarin ekzekutues (.exe) p\u00ebr ta filluar.<\/p>\n<p>Nj\u00eb skedar mund t\u00eb specifikohet duke p\u00ebrdorur rrug\u00ebn e plot\u00eb (p.sh., C:Windowssystem32cmd.exe) ose at\u00eb jo t\u00eb plot\u00eb (p.sh., cmd.exe). N\u00ebse procesi burimor nuk \u00ebsht\u00eb i sigurt, ai lejon ekzekutimin e programeve t\u00eb paligjshme. Sulmi mund t\u00eb duket k\u00ebshtu: procesi fillon cmd.exe pa treguar rrug\u00ebn e plot\u00eb, sulmuesi e vendos cmd.exe t\u00eb tij n\u00eb nj\u00eb vend t\u00eb till\u00eb q\u00eb procesi ta ekzekutoj\u00eb at\u00eb para skedarit legjitim. Pas fillimit t\u00eb programit t\u00eb keq, ai gjithashtu mund t\u00eb filloj\u00eb nj\u00eb program legjitim (p.sh., C:Windowssystem32cmd.exe), n\u00eb m\u00ebnyr\u00eb q\u00eb programi burimor t\u00eb vazhdoj\u00eb t\u00eb funksionoj\u00eb si\u00e7 duhet.<\/p>\n<p>Nj\u00eb variant i sulmit t\u00eb m\u00ebparsh\u00ebm \u00ebsht\u00eb injeksioni DLL n\u00eb nj\u00eb proces legjitim. Kur procesi fillohet, ai gjen dhe ngarkon bibliotekat q\u00eb zgjasin funksionalitetin e tij. Duke p\u00ebrdorur injeksionin DLL, sulmuesi krijon nj\u00eb bibliotek\u00eb t\u00eb keqe me t\u00eb nj\u00ebjtin em\u00ebr dhe API si ai legjitim. Programi ngarkon bibliotek\u00ebn e keqe, e cila, nga ana e saj, ngarkon bibliotek\u00ebn legjitime dhe, sipas nevoj\u00ebs, p\u00ebr t\u00eb kryer operacione, e thirr at\u00eb. Biblioteka e keqe fillon t\u00eb veproj\u00eb si nj\u00eb proxy p\u00ebr biblioteken e mir\u00eb.<\/p>\n<p>Nj\u00eb tjet\u00ebr m\u00ebnyr\u00eb p\u00ebr t\u00eb vendosur kode keqdash\u00ebse n\u00eb memorie \u00ebsht\u00eb t\u00eb injektohet n\u00eb nj\u00eb proces t\u00eb pasigurt q\u00eb \u00ebsht\u00eb tashm\u00eb n\u00eb ekzekutim. Proceset marrin t\u00eb dh\u00ebna nga burime t\u00eb ndryshme - lexojn\u00eb nga rrjeti ose skedar\u00ebt. Zakonisht, ato kryejn\u00eb kontroll p\u00ebr t\u00eb siguruar legjitimitetin e t\u00eb dh\u00ebnave t\u00eb hyrjes. Por disa procese nuk kan\u00eb mbrojtjen e duhur kur ekzekutojn\u00eb instruksionet. N\u00eb nj\u00eb sulm t\u00eb till\u00eb, nuk ka nj\u00eb bibliotek\u00eb n\u00eb disk apo nj\u00eb skedar ekzekutiv me kode keqdash\u00ebse. T\u00eb gjitha ruhen n\u00eb memorie s\u00eb bashku me procesin e shfryt\u00ebzuar.<\/p>\n<p>Tani le t\u00eb kuptojm\u00eb metodologjin\u00eb e aktivizimit t\u00eb mbledhjes s\u00eb ngjarjeve t\u00eb tilla n\u00eb Windows dhe me rregullin n\u00eb InTrust, i cili implementon mbrojtjen nga k\u00ebto k\u00ebrc\u00ebnime. Fillimisht, e aktivizojm\u00eb at\u00eb p\u00ebrmes konsol\u00ebs s\u00eb menaxhimit InTrust.<\/p>\n<p><img decoding=\"async\" alt=\"Nisim mbledhjen e ngjarjeve p\u00ebr nisjen e proceseve t\u00eb dyshimta n\u00eb Windows dhe zbulojm\u00eb k\u00ebrc\u00ebnimet me ndihm\u00ebn e Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/3ffc159a9b220c56b288256b286fdd8d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nRregulli p\u00ebrdor mund\u00ebsit\u00eb e ndjekjes s\u00eb proceseve n\u00eb sistemin operativ Windows. Fatkeq\u00ebsisht, aktivizimi i mbledhjes s\u00eb k\u00ebtyre ngjarjeve nuk \u00ebsht\u00eb aspak i qart\u00eb. Duhet t\u00eb ndryshoni 3 cil\u00ebsime t\u00eb ndryshme t\u00eb politik\u00ebs s\u00eb grupit:<\/p>\n<p><b>Konfigurimi i Kompjuterit &gt; Politikat &gt; Cil\u00ebsimet e Windows &gt; Cil\u00ebsimet e Siguris\u00eb &gt; Politikat Lokale &gt; Politika e Auditimit &gt; Auditimi i ndjekjes s\u00eb proceseve<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Nisim mbledhjen e ngjarjeve p\u00ebr nisjen e proceseve t\u00eb dyshimta n\u00eb Windows dhe zbulojm\u00eb k\u00ebrc\u00ebnimet me ndihm\u00ebn e Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/03abc319d24bf82dbf9c728b6b37c794.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Konfigurimi i Kompjuterit &gt; Politikat &gt; Cil\u00ebsimet e Windows &gt; Cil\u00ebsimet e Siguris\u00eb &gt; Konfigurimi i Avancuar t\u00eb Politikes s\u00eb Auditimit &gt; Politikat e Auditimit &gt; Ndjekja e Detajuar &gt; Auditimi i krijimit t\u00eb proceseve<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Nisim mbledhjen e ngjarjeve p\u00ebr nisjen e proceseve t\u00eb dyshimta n\u00eb Windows dhe zbulojm\u00eb k\u00ebrc\u00ebnimet me ndihm\u00ebn e Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/3b017dc39789d55ae478e70e0034bd73.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Konfigurimi i Kompjuterit &gt; Politikat &gt; Shablonat Administrativ\u00eb &gt; Sistemi &gt; Auditimi i Krijimit t\u00eb Proceseve &gt; P\u00ebrfshij komand\u00ebn n\u00eb ngjarjet e krijimit t\u00eb proceseve<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Nisim mbledhjen e ngjarjeve p\u00ebr nisjen e proceseve t\u00eb dyshimta n\u00eb Windows dhe zbulojm\u00eb k\u00ebrc\u00ebnimet me ndihm\u00ebn e Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/13122278bc9ab6f7f6ff982654ce6dec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPas aktivizimit, rregullat InTrust lejojn\u00eb identifikimin e k\u00ebrc\u00ebnimeve t\u00eb panjohura m\u00eb par\u00eb, t\u00eb cilat demonstrojn\u00eb sjellje t\u00eb dyshimt\u00eb. P\u00ebr shembull, mund t\u00eb identifikohet <noindex><a rel=\"nofollow\" href=\"https:\/\/www.bromium.com\/dridex-threat-analysis-july-2019-variant\/\">e p\u00ebrshkruar k\u00ebtu<\/a><\/noindex> programi keqdash\u00ebs Dridex. Fal\u00eb projektit HP Bromium, dihet se si funksionon nj\u00eb k\u00ebrc\u00ebnim i till\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"Nisim mbledhjen e ngjarjeve p\u00ebr nisjen e proceseve t\u00eb dyshimta n\u00eb Windows dhe zbulojm\u00eb k\u00ebrc\u00ebnimet me ndihm\u00ebn e Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/cbc09c039a088a3b6737d2d467c6a2ac.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb zinxhirin e veprimeve t\u00eb tij, Dridex p\u00ebrdor schtasks.exe p\u00ebr t\u00eb krijuar nj\u00eb detyr\u00eb t\u00eb planifikuar. P\u00ebrdorimi i k\u00ebsaj utilitareje nga linja e komand\u00ebs konsiderohet si nj\u00eb sjellje shum\u00eb e dyshimt\u00eb, ashtu si\u00e7 duket fillimi i svchost.exe me parametra q\u00eb tregojn\u00eb p\u00ebr dosjet e p\u00ebrdoruesit ose me parametra q\u00eb p\u00ebrputhen me komandat 'net view' ose 'whoami'. Ja nj\u00eb fragment p\u00ebrkat\u00ebs i <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Neo23x0\/sigma\/blob\/master\/rules\/windows\/process_creation\/win_malware_dridex.yml\">rregullit SIGMA<\/a><\/noindex>:<\/p>\n<pre><code class=\"xml\">detection:\n    selection1:\n        CommandLine: '*svchost.exe C:Users\\*Desktop\\*'\n    selection2:\n        ParentImage: '*svchost.exe*'\n        CommandLine:\n            - '*whoami.exe \/all'\n            - '*net.exe view'\n    condition: 1 nga ata<\/code><\/pre>\n<p>\nN\u00eb InTrust, t\u00eb gjitha sjelljet e dyshimta p\u00ebrfshihen n\u00eb nj\u00eb rregull, sepse shumica e k\u00ebtyre veprimeve nuk jan\u00eb m\u00eb specifike p\u00ebr nj\u00eb k\u00ebrc\u00ebnim t\u00eb caktuar, por p\u00ebrkundrazi jan\u00eb dyshuese si nj\u00eb kompleks dhe n\u00eb 99% t\u00eb rasteve p\u00ebrdoren p\u00ebr q\u00ebllime q\u00eb nuk jan\u00eb t\u00eb k\u00ebndshme. Ky list\u00eb veprimesh p\u00ebrfshin, por nuk kufizohet n\u00eb:<\/p>\n<ul>\n<li>Procese q\u00eb ekzekutohen nga vende jo t\u00eb zakonshme si\u00e7 jan\u00eb dosjet e p\u00ebrkohshme t\u00eb p\u00ebrdoruesve.<\/li>\n<li>Nj\u00eb proces i njohur sistematik me trash\u00ebgimi dyshuese \u2014 disa k\u00ebrc\u00ebnime mund t\u00eb p\u00ebrpiqen t\u00eb p\u00ebrdorin emrin e proceseve sistematike p\u00ebr t\u00eb mbetur t\u00eb paduksh\u00ebm.<\/li>\n<li>Ekzekutime dyshuese t\u00eb mjeteve administrative, si cmd ose PsExec, kur p\u00ebrdorin kredencialet e sistemit lokal ose trash\u00ebgimi dyshuese.<\/li>\n<li>Operacione dyshuese t\u00eb kopjimit t\u00eb hijeve \u2014 nj\u00eb sjellje e zakonshme e viruseve t\u00eb k\u00ebrkesave para se t\u00eb enkriptojn\u00eb sistemin, ato shkat\u00ebrrojn\u00eb kopjet rezerv\u00eb:\n<p> \u2014 N\u00ebp\u00ebrmjet vssadmin.exe;<br \/>\n \u2014 N\u00ebp\u00ebrmjet WMI.<\/li>\n<li>P\u00ebrgjith\u00ebsime t\u00eb regjistrit t\u00eb grupeve t\u00eb t\u00ebr\u00eb t\u00eb regjistrit.<\/li>\n<li>Shkarkimi horizontal i kodit t\u00eb d\u00ebmsh\u00ebm kur procesi ekzekutohet n\u00eb distanc\u00eb duke p\u00ebrdorur komanda si at.exe.<\/li>\n<li>Operacione dyshuese lokale t\u00eb grupeve dhe operacione t\u00eb domain-it duke p\u00ebrdorur net.exe.<\/li>\n<li>Operacione dyshuese t\u00eb firewall-it duke p\u00ebrdorur netsh.exe.<\/li>\n<li>Manipulime dyshuese t\u00eb ACL.<\/li>\n<li>P\u00ebrdorimi i BITS p\u00ebr eksfiltrimin e t\u00eb dh\u00ebnave.<\/li>\n<li>Manipulime dyshuese t\u00eb WMI.<\/li>\n<li>Komanda skenari dyshuese.<\/li>\n<li>P\u00ebrpjekje p\u00ebr t\u00eb nxjerr\u00eb skedar\u00ebt e sigurt t\u00eb sistemit.<\/li>\n<\/ul>\n<p>\nRregulli i bashkuar funksionon shum\u00eb mir\u00eb p\u00ebr t\u00eb zbuluar k\u00ebrc\u00ebnime si RUYK, LockerGoga dhe viruse t\u00eb tjera t\u00eb k\u00ebrkesave, malware dhe grupe veglash p\u00ebr krimin e kibernetik. Rregulli \u00ebsht\u00eb verifikuar nga shit\u00ebsi n\u00eb mjedise luftarake p\u00ebr t\u00eb minimizuar gjenerimin e alarm\u00ebve t\u00eb rrem\u00eb. Dhe fal\u00eb projektit SIGMA, shumica e k\u00ebtyre treguesve prodhojn\u00eb nj\u00eb sasi minimale ngjarjesh t\u00eb zhurmshme.<\/p>\n<p>Duke qen\u00eb se ky \u00ebsht\u00eb nj\u00eb rregull monitorimi n\u00eb InTrust, ju mund t\u00eb ekzekutoni nj\u00eb skenar reagimi si p\u00ebrgjigje ndaj k\u00ebrc\u00ebnimit. Mund t\u00eb p\u00ebrdorni nj\u00eb nga skenaret e nd\u00ebrtuara ose t\u00eb krijoni nj\u00eb tuajin, dhe InTrust automatikisht do ta shp\u00ebrndaj\u00eb at\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"Nisim mbledhjen e ngjarjeve p\u00ebr nisjen e proceseve t\u00eb dyshimta n\u00eb Windows dhe zbulojm\u00eb k\u00ebrc\u00ebnimet me ndihm\u00ebn e Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/fca2722b0465152e3de8f655af07bc91.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr m\u00eb tep\u00ebr, mund t\u00eb kontrolloni t\u00eb gjitha telemetrit\u00eb e lidhura me ngjarjen: skriptet PowerShell, ekzekutimin e proceseve, manipulimet me detyrat e programuar, aktivitetin administrativ WMI dhe t'i p\u00ebrdorni ato p\u00ebr pasmorte n\u00eb rastet e incidenteve t\u00eb siguris\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"Nisim mbledhjen e ngjarjeve p\u00ebr nisjen e proceseve t\u00eb dyshimta n\u00eb Windows dhe zbulojm\u00eb k\u00ebrc\u00ebnimet me ndihm\u00ebn e Quest InTrust\" src=\"\/wp-content\/uploads\/2020\/08\/81ee58b297523002ee26c25bda40f5bb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb InTrust ka qindra rregulla t\u00eb tjera, disa prej tyre jan\u00eb:<\/p>\n<ul>\n<li>Identifikimi i sulmit p\u00ebr uljen e versionit t\u00eb PowerShell \u2014 kur dikush ve\u00e7an\u00ebrisht p\u00ebrdor nj\u00eb version t\u00eb vjet\u00ebr t\u00eb PowerShell, pasi n\u00eb versionin m\u00eb t\u00eb vjet\u00ebr nuk kishte mund\u00ebsi p\u00ebr audimin e asaj q\u00eb po ndodhte.<\/li>\n<li>Identifikimi i login-it me privilegje t\u00eb larta \u2014 kur llogarit\u00eb q\u00eb jan\u00eb an\u00ebtar\u00eb t\u00eb nj\u00eb grupi t\u00eb caktuar me privilegje (p\u00ebr shembull, administrator\u00ebt e domain-it), p\u00ebr shkak t\u00eb incidenteve t\u00eb siguris\u00eb, hyjn\u00eb n\u00eb sistem n\u00eb m\u00ebnyr\u00eb interaktive n\u00eb stacionet e pun\u00ebs.<\/li>\n<\/ul>\n<p>\nInTrust ju lejon t\u00eb p\u00ebrdorni praktikat m\u00eb t\u00eb mira t\u00eb siguris\u00eb n\u00eb form\u00ebn e rregullave t\u00eb paracaktuara p\u00ebr identifikimin dhe reagimin. N\u00ebse mendoni se di\u00e7ka duhet t\u00eb funksionoj\u00eb ndryshe \u2014 mund t\u00eb b\u00ebni nj\u00eb kopje t\u00eb rregullit dhe ta p\u00ebrshtatni si\u00e7 duhet. Mund t\u00eb d\u00ebrgoni nj\u00eb k\u00ebrkes\u00eb p\u00ebr nj\u00eb prov\u00eb ose p\u00ebr t\u00eb marr\u00eb shp\u00ebrndarje me licenca p\u00ebrkoh\u00ebsisht p\u00ebrmes <noindex><a rel=\"nofollow\" href=\"https:\/\/gals.software\/vendors\/quest\/intrust#feedback\">formularit t\u00eb kontaktit<\/a><\/noindex> n\u00eb faqen ton\u00eb.<\/p>\n<p>Abonohuni n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/GalsSoftware\/\">faqes n\u00eb Facebook<\/a><\/noindex>, ku publikojm\u00eb sh\u00ebnime t\u00eb shkurtra dhe lidhje interesante.<\/p>\n<p><b>Lexoni artikujt tan\u00eb t\u00eb tjer\u00eb mbi tem\u00ebn e siguris\u00eb s\u00eb informacionit:<\/b><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/513208\/\">Si mund t\u00eb ndihmoj\u00eb InTrust n\u00eb uljen e numrit t\u00eb p\u00ebrpjekjeve t\u00eb pasuksesshme t\u00eb autorizimit p\u00ebrmes RDP<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/474574\/\">Identifikimi i sulmit nga virusi-kripto, marrja e aksesit n\u00eb kontrolluesin e domenit dhe p\u00ebrpjekja p\u00ebr t'u kund\u00ebrv\u00ebn\u00eb k\u00ebtyre sulmeve<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447522\/\">\u00c7far\u00eb informacioni t\u00eb dobish\u00ebm mund t\u00eb nxjerrim nga log\u00ebt e stacionit t\u00eb pun\u00ebs n\u00eb sistemin operativ Windows<\/a><\/noindex> (artikulli popullor)<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/464333\/\">Ndjekja e ciklit t\u00eb jet\u00ebs s\u00eb p\u00ebrdoruesve pa kap\u00ebse dhe izoloz\u00eb<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447512\/\">Kush e b\u00ebri k\u00ebt\u00eb? Automatizimi i auditimit t\u00eb siguris\u00eb s\u00eb informacionit<\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/512908\/\">Si t\u00eb ulet kostoja e pron\u00ebsis\u00eb s\u00eb sistemit SIEM dhe p\u00ebrse \u00ebsht\u00eb e nevojshme Menaxhimi Qendror i Log\u00ebve (CLM)<\/a><\/noindex><br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/513714\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u0434\u043d\u0430 \u0438\u0437 \u0447\u0430\u0441\u0442\u043e \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0449\u0438\u0445\u0441\u044f \u0442\u0438\u043f\u043e\u0432 \u0430\u0442\u0430\u043a \u2014 \u043f\u043e\u0440\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u0437\u043b\u043e\u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0432 \u0434\u0435\u0440\u0435\u0432\u0435 \u043f\u043e\u0434 \u0432\u043f\u043e\u043b\u043d\u0435 \u0441\u0435\u0431\u0435 \u0434\u043e\u0431\u0440\u043e\u043f\u043e\u0440\u044f\u0434\u043e\u0447\u043d\u044b\u043c\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c\u0438. \u041f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0435 \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043f\u0443\u0442\u044c \u043a \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u043c\u0443 \u0444\u0430\u0439\u043b\u0443: \u0447\u0430\u0441\u0442\u0435\u043d\u044c\u043a\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043f\u0430\u043f\u043a\u0438 AppData \u0438\u043b\u0438 Temp, \u0430 \u044d\u0442\u043e \u043d\u0435\u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u043e \u0434\u043b\u044f \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c. \u0421\u043f\u0440\u0430\u0432\u0435\u0434\u043b\u0438\u0432\u043e\u0441\u0442\u0438 \u0440\u0430\u0434\u0438, \u0441\u0442\u043e\u0438\u0442 \u0441\u043a\u0430\u0437\u0430\u0442\u044c, \u0447\u0442\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u044e\u0442\u0441\u044f \u0432 AppData, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043e\u0434\u043d\u043e\u0439 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043c\u0435\u0441\u0442\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":90736,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-90735","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u0441\u0431\u043e\u0440 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0432 Windows \u0438 \u0432\u044b\u044f\u0432\u043b\u044f\u0435\u043c \u0443\u0433\u0440\u043e\u0437\u044b \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Quest InTrust | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-05T11:42:06+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-05T11:42:06+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Aktivizoni mbledhjen e ngjarjeve p\u00ebr nisjen e proceseve t\u00eb dyshimta n\u00eb Windows dhe identifikoni k\u00ebrc\u00ebnimet duke p\u00ebrdorur Quest InTrust | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u043a\u043b\u044e\u0447\u0430\u0435\u043c \u0441\u0431\u043e\u0440 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0432 Windows \u0438 \u0432\u044b\u044f\u0432\u043b\u044f\u0435\u043c \u0443\u0433\u0440\u043e\u0437\u044b \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Quest InTrust | ProHoster","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/vklyuchaem-sbor-sobytij-o-zapuske-podozritelnyh-proczessov-v-windows-i-vyyavlyaem-ugrozy-pri-pomoshhi-quest-intrust","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-05T11:42:06+00:00","article:modified_time":"2020-08-05T11:42:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90735","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:43:42","updated":"2022-09-29 04:49:36","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/90735","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=90735"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/90735\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/90736"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=90735"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=90735"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=90735"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}