{"id":94862,"date":"2020-09-22T19:42:18","date_gmt":"2020-09-22T17:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/sysmon-teper-mozhet-zapisyvat-soderzhimoe-bufera-obmena"},"modified":"2020-09-22T19:42:18","modified_gmt":"2020-09-22T17:42:18","slug":"sysmon-teper-mozhet-zapisyvat-soderzhimoe-bufera-obmena","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/sysmon-teper-mozhet-zapisyvat-soderzhimoe-bufera-obmena","title":{"rendered":"Sysmon tani mund t\u00eb regjistroj\u00eb p\u00ebrmbajtjen e clipboard-it","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

P\u00ebr lansimin e versionit 12 t\u00eb Sysmon u njoftua m\u00eb 17 Shtator n\u00eb faqen e Sysinternals<\/a><\/noindex>. N\u00eb t\u00eb v\u00ebrtet\u00eb n\u00eb k\u00ebt\u00eb dit\u00eb lan\u00e7uam gjithashtu versione t\u00eb reja t\u00eb Process Monitor dhe ProcDump. N\u00eb k\u00ebt\u00eb artikull do t\u00eb flas p\u00ebr nj\u00eb ndryshim ky\u00e7 dhe t\u00eb nd\u00ebrlikuar n\u00eb versionin 12 t\u00eb Sysmon \u2014 llojin e ngjarjeve me Event ID 24, n\u00eb t\u00eb cilin regjistrohet aktiviteti me t\u00eb dh\u00ebnat e kopjuara n\u00eb mbush\u00ebsin e sistemit.<\/p>\n

\"Sysmon
\n
\nInformacioni nga ky lloj ngjarjeje hap mund\u00ebsi t\u00eb reja p\u00ebr kontrollin e aktiviteteve t\u00eb dyshimta (si dhe dob\u00ebsi t\u00eb reja). K\u00ebshtu, do t\u00eb mund t\u00eb kuptoni se kush, nga ku dhe \u00e7far\u00eb po p\u00ebrpiqeshin t\u00eb kopjonin. N\u00eb vazhdim do t\u00eb p\u00ebrshkruaj disa fusha t\u00eb ngjarjes s\u00eb re dhe disa raste p\u00ebrdorimi.
\n<\/a><\/noindex>
\nNgjarja e re p\u00ebrmban fushat e m\u00ebposhtme:<\/p>\n

Imazhi:<\/b> procesi nga i cili jan\u00eb regjistruar t\u00eb dh\u00ebnat n\u00eb mbush\u00ebs.
\nSeanca:<\/b> seanca n\u00eb t\u00eb cil\u00ebn \u00ebsht\u00eb realizuar regjistrimi n\u00eb mbush\u00ebs. Kjo mund t\u00eb jet\u00eb system(0)
\n n\u00eb m\u00ebnyr\u00ebn interaktive ose t\u00eb larg\u00ebt etj.
\nInformacioni i Klientit:<\/b> p\u00ebrmban emrin e p\u00ebrdoruesit t\u00eb seanc\u00ebs, dhe n\u00eb rastin e nj\u00eb seance t\u00eb larg\u00ebt \u2014 emrin origjinal t\u00eb host-it dhe adres\u00ebn IP, n\u00ebse k\u00ebto t\u00eb dh\u00ebna jan\u00eb t\u00eb disponueshme.
\nHash-et:<\/b> p\u00ebrcakton emrin e skedarit n\u00eb t\u00eb cilin jan\u00eb ruajtur tekstet e kopjuara (n\u00eb m\u00ebnyr\u00eb t\u00eb ngjashme me ngjarjet e llojit FileDelete).
\nArkivuar:<\/b> statusi, n\u00ebse teksti nga mbush\u00ebsi \u00ebsht\u00eb ruajtur n\u00eb dosjen arkivore t\u00eb Sysmon.<\/p>\n

Dy fushat e fundit shkaktojn\u00eb shqet\u00ebsim. \u00cbsht\u00eb e v\u00ebrtet\u00eb se q\u00eb nga versioni 11, Sysmon mund (n\u00eb p\u00ebrputhje me konfigurimet e caktuara) t\u00eb ruaj\u00eb t\u00eb dh\u00ebna t\u00eb ndryshme n\u00eb dosjen e tij arkivore. P\u00ebr shembull, Event ID 23 regjistron ngjarje t\u00eb fshirjes s\u00eb skedar\u00ebve dhe mund t'i ruaj\u00eb gjithashtu n\u00eb t\u00eb nj\u00ebjt\u00ebn dosje arkivore. Emrit t\u00eb skedar\u00ebve q\u00eb krijohen si rezultat i pun\u00ebs me mbush\u00ebsin i shtohet etiketa CLIP. Skedar\u00ebt p\u00ebrmbajn\u00eb t\u00eb dh\u00ebna t\u00eb sakta q\u00eb jan\u00eb kopjuar n\u00eb mbush\u00ebs.<\/p>\n

Sikur duket skedari i ruajtur<\/b>
\n \"Sysmon<\/p>\n

\nRuajtja n\u00eb skedar aktivizohet gjat\u00eb instalimit. Mund t\u00eb krijoni lista t\u00eb bardha t\u00eb proceseve, p\u00ebr t\u00eb cilat tekstet nuk do t\u00eb ruhen.<\/p>\n

Si duket instalimi i Sysmon me konfigurimin e duhur t\u00eb dosjes arkivore:<\/b>
\n \"Sysmon<\/p>\n

\nK\u00ebtu, mendoj se duhet p\u00ebrmendur menaxher\u00ebt e fjal\u00ebkalimeve, t\u00eb cil\u00ebt gjithashtu p\u00ebrdorin mbush\u00ebsin. Prania e Sysmon n\u00eb sistem me nj\u00eb menaxher fjal\u00ebkalimesh ju mund\u00ebson (ose nj\u00eb sulmuesi) t\u00eb kap\u00eb k\u00ebto fjal\u00ebkalime. N\u00ebse supozoni se e dini se cili proces alokojn\u00eb tekstin e kopjuar (dhe kjo nuk \u00ebsht\u00eb gjithmon\u00eb procesi i menaxherit t\u00eb fjal\u00ebkalimeve, por mund t\u00eb jet\u00eb ndonj\u00eb svchost), ky p\u00ebrjashtim mund t\u00eb shtohet n\u00eb list\u00ebn e bardh\u00eb dhe t\u00eb mos ruhet.<\/p>\n

Kush e di, por teksti nga mbush\u00ebsi kapet nga serveri i larg\u00ebt kur kaloni n\u00eb t\u00eb n\u00eb m\u00ebnyr\u00ebn e seanc\u00ebs RDP. N\u00ebse keni di\u00e7ka n\u00eb mbush\u00ebs dhe kaloni midis seancave RDP, kjo informacion do t\u00eb udh\u00ebtoj\u00eb me ju.<\/p>\n

Le t\u00eb p\u00ebrmbledhim mund\u00ebsit\u00eb e Sysmon n\u00eb lidhje me mbush\u00ebsin.<\/p>\n

Regjistrohen:<\/p>\n