{"id":94862,"date":"2020-09-22T19:42:18","date_gmt":"2020-09-22T17:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/sysmon-teper-mozhet-zapisyvat-soderzhimoe-bufera-obmena"},"modified":"2020-09-22T19:42:18","modified_gmt":"2020-09-22T17:42:18","slug":"sysmon-teper-mozhet-zapisyvat-soderzhimoe-bufera-obmena","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/sysmon-teper-mozhet-zapisyvat-soderzhimoe-bufera-obmena","title":{"rendered":"Sysmon tani mund t\u00eb regjistroj\u00eb p\u00ebrmbajtjen e mbik\u00ebqyrjes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

P\u00ebr lansimin e versionit 12 t\u00eb Sysmon, u njoftua m\u00eb 17 Shtator n\u00eb faqen e Sysinternals<\/a><\/noindex>. N\u00eb t\u00eb v\u00ebrtet\u00eb, n\u00eb k\u00ebt\u00eb dit\u00eb dol\u00ebn gjithashtu versione t\u00eb reja t\u00eb Process Monitor dhe ProcDump. N\u00eb k\u00ebt\u00eb artikull, do t\u00eb flas p\u00ebr nj\u00eb ndryshim ky\u00e7 dhe t\u00eb diskutuesh\u00ebm n\u00eb versionin 12 t\u00eb Sysmon \u2014 tipin e ngjarjeve me ID-n\u00eb e Ngjarjes 24, n\u00eb t\u00eb cilin regjistrohet puna me clipboard-in.<\/p>\n

\"Sysmon
\n
\nInformacioni nga ky tip ngjarjeje hap mund\u00ebsi t\u00eb reja p\u00ebr kontrollin e aktiviteteve t\u00eb dyshimta (gjithashtu dhe vulnerabilitete t\u00eb reja). K\u00ebshtu, do t\u00eb jeni n\u00eb gjendje t\u00eb kuptoni kush, nga ku dhe \u00e7far\u00eb p\u00ebrpiqeshin t\u00eb kopjonin. N\u00ebn k\u00ebt\u00eb, p\u00ebrshkrimi i disa fushave t\u00eb ngjarjes s\u00eb re dhe disa raste p\u00ebrdorimi.
\n<\/a><\/noindex>
\nNgjarja e re p\u00ebrmban fushat e m\u00ebposhtme:<\/p>\n

Image:<\/b> procesi nga i cili u regjistruan t\u00eb dh\u00ebnat n\u00eb clipboard.
\nSession:<\/b> sesioni n\u00eb t\u00eb cilin u krye regjistrimi n\u00eb clipboard. Kjo mund t\u00eb jet\u00eb system(0)
\n n\u00eb pun\u00eb n\u00eb modalitetin interaktiv ose t\u00eb larg\u00ebt, etj.
\nClientInfo:<\/b> p\u00ebrmban emrin e p\u00ebrdoruesit t\u00eb sesionit, dhe n\u00eb rastin e nj\u00eb sesioni t\u00eb larg\u00ebt \u2014 emrin origjinal t\u00eb hostit dhe adres\u00ebn IP, n\u00ebse k\u00ebto t\u00eb dh\u00ebna jan\u00eb t\u00eb disponueshme.
\nHashes:<\/b> p\u00ebrcakton emrin e skedarit, n\u00eb t\u00eb cilin u ruajt teksti i kopjuar (nj\u00eblloj si punimi me ngjarjet e tipit FileDelete).
\nArchived:<\/b> statusi, n\u00ebse teksti nga clipboard-i u ruajt n\u00eb dosjen arkivore t\u00eb Sysmon.<\/p>\n

Dy fushat e fundit shkaktojn\u00eb shqet\u00ebsim. Problemi \u00ebsht\u00eb se q\u00eb nga versioni 11, Sysmon mund (me konfigurimet p\u00ebrkat\u00ebse) t\u00eb ruaj\u00eb t\u00eb dh\u00ebna t\u00eb ndryshme n\u00eb dosjen e tij arkivore. P\u00ebr shembull, ID e Ngjarjes 23 regjistron ngjarjet e fshirjes s\u00eb skedareve dhe mund t\u00eb ruaj\u00eb gjithashtu ato n\u00eb t\u00eb nj\u00ebjt\u00ebn dosje arkivore. Emrit t\u00eb skedareve t\u00eb krijuara si rezultat i pun\u00ebs me clipboard-in i shtohet etiketa CLIP. Skedar\u00ebt e vet\u00eb p\u00ebrmbajn\u00eb t\u00eb dh\u00ebna t\u00eb sakta q\u00eb u kopjuan n\u00eb clipboard.<\/p>\n

K\u00ebshtu duken skedar\u00ebt e ruajtur<\/b>
\n \"Sysmon<\/p>\n

\nRuajtja n\u00eb skedar aktivizohet gjat\u00eb instalimit. Mund t\u00eb vendosen lista t\u00eb bardha procesesh, p\u00ebr t\u00eb cilat teksti nuk do t\u00eb ruhet.<\/p>\n

K\u00ebshtu duket instalimi i Sysmon me konfigurimin p\u00ebrkat\u00ebs t\u00eb dosjes arkivore:<\/b>
\n \"Sysmon<\/p>\n

\nMendoj se \u00ebsht\u00eb e nevojshme t\u00eb p\u00ebrmendet menaxher\u00ebt e fjal\u00ebkalimeve, t\u00eb cil\u00ebt gjithashtu p\u00ebrdorin clipboard-in. Prania e Sysmon n\u00eb sistem me nj\u00eb menaxher fjal\u00ebkalimesh do t'ju lejoj\u00eb (ose nj\u00eb sulmuesit) t\u00eb kapni k\u00ebto fjal\u00ebkalime. N\u00ebse supozoni se dini se cili proces alokuan tekstin e kopjuar (dhe kjo nuk \u00ebsht\u00eb gjithmon\u00eb procesi i menaxherit t\u00eb fjal\u00ebkalimeve, por mund t\u00eb jet\u00eb ndonj\u00eb svchost), ky p\u00ebrjashtim mund t\u00eb shtohet n\u00eb list\u00ebn e bardh\u00eb dhe t\u00eb mos ruhet.<\/p>\n

Ndoshta nuk e dinit, por teksti nga sh\u00ebnimi i p\u00ebrkohsh\u00ebm kapet nga serveri i larg\u00ebt kur kaloni n\u00eb t\u00eb n\u00eb modalitetin e seanc\u00ebs RDP. N\u00ebse keni di\u00e7ka n\u00eb sh\u00ebnimin e p\u00ebrkohsh\u00ebm dhe kaloni midis seancave RDP, kjo informacion do t\u00eb udh\u00ebtoj\u00eb me ju.<\/p>\n

T\u00eb p\u00ebrmbledhim mund\u00ebsit\u00eb e Sysmon n\u00eb lidhje me sh\u00ebnimin e p\u00ebrkohsh\u00ebm.<\/p>\n

Regjistrohen:<\/p>\n