🥇Jinsi InTrust inavyoweza kusaidia kupunguza hitilafu za kuingia kwenye RDP

Mtu yeyote ambaye amejaribu kuendesha mashine pepe katika wingu anajua vyema kwamba mlango wa kawaida wa RDP, ukiachwa wazi, karibu mara moja utashambuliwa na mawimbi ya mashambulizi ya nguvu kali kutoka kwa anwani mbalimbali za IP kote ulimwenguni.

Katika makala haya nitakuonyesha jinsi ya Kuaminiana Unaweza kuanzisha jibu otomatiki kwa uvunjaji wa nenosiri kwa kuongeza sheria mpya kwenye ngome. InTrust ni Jukwaa la CLM kwa kukusanya, kuchanganua na kuhifadhi data ambayo haijaundwa, ambayo tayari ina mamia ya majibu yaliyobainishwa awali kwa aina mbalimbali za mashambulizi.

Katika Quest InTrust, unaweza kusanidi vitendo vya majibu wakati sheria inapoanzishwa. InTrust hupokea ujumbe kutoka kwa mkusanyaji wa kumbukumbu kuhusu jaribio lisilofanikiwa la uidhinishaji kwenye kituo cha kazi au seva. Ili kusanidi kuongezwa kwa anwani mpya za IP kwenye ngome, unahitaji kunakili sheria iliyopo maalum ya kugundua uidhinishaji mwingi ulioshindwa na kuifungua kwa ajili ya kuhariri:

Matukio katika majarida Windows tumia kinachoitwa InsertionString. Tazama mechi za tukio Kitambulisho 4625 (hii ni kuingia bila mafanikio kwenye mfumo) na utaona kwamba sehemu tunazopenda zimehifadhiwa katika InsertionString14 (Jina la Kituo cha Kazi) na InsertionString20 (Anwani ya Mtandao Chanzo). Wakati wa kushambulia kutoka kwa Mtandao, sehemu yenye Jina la Kituo cha Kazi kuna uwezekano mkubwa kuwa tupu, kwa hivyo ni muhimu kubadilisha thamani kutoka kwa Anwani ya Mtandao Chanzo mahali hapa.

Hivi ndivyo maandishi ya tukio 4625 yanavyoonekana.

An account failed to log on.
Subject:
	Security ID:		S-1-5-21-1135140816-2109348461-2107143693-500
	Account Name:		ALebovsky
	Account Domain:		LOGISTICS
	Logon ID:		0x2a88a
Logon Type:			2
Account For Which Logon Failed:
	Security ID:		S-1-0-0
	Account Name:		Paul
	Account Domain:		LOGISTICS
Failure Information:
	Failure Reason:		Account locked out.
	Status:			0xc0000234
	Sub Status:		0x0
Process Information:
	Caller Process ID:	0x3f8
	Caller Process Name:	C:WindowsSystem32svchost.exe
Network Information:
	Workstation Name:	DCC1
	Source Network Address:	::1
	Source Port:		0
Detailed Authentication Information:
	Logon Process:		seclogo
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Zaidi ya hayo, hebu tuongeze thamani ya Anwani ya Mtandao Chanzo kwenye maandishi ya tukio.

Kisha unahitaji kuongeza hati ambayo itazuia anwani ya IP kwenye ngome WindowsHapa chini kuna mfano unaoweza kutumika kwa hili.

Hati ya Usanidi wa Ngome ya Moto

param(
         [Parameter(Mandatory = $true)]
         [ValidateNotNullOrEmpty()]   
         [string]
         $SourceAddress
)

$SourceAddress = $SourceAddress.Trim()
$ErrorActionPreference = 'Stop'
$ruleName = 'Quest-InTrust-Block-Failed-Logons'
$ruleDisplayName = 'Quest InTrust: Blocks IP addresses from failed logons'

function Get-BlockedIps {
    (Get-NetFirewallRule -Name $ruleName -ErrorAction SilentlyContinue | get-netfirewalladdressfilter).RemoteAddress
}

$blockedIps = Get-BlockedIps
$allIps = [array]$SourceAddress + [array]$blockedIps | Select-Object -Unique | Sort-Object

if (Get-NetFirewallRule -Name $ruleName -ErrorAction SilentlyContinue) {
    Set-NetFirewallRule -Name $ruleName -RemoteAddress $allIps
} else {
    New-NetFirewallRule -Name $ruleName -DisplayName $ruleDisplayName -Direction Inbound -Action Block -RemoteAddress $allIps
}

Sasa unaweza kubadilisha jina la sheria na maelezo yake ili kuepuka mkanganyiko baadaye.

Sasa unahitaji kuongeza hati hii kama jibu la sheria, wezesha sheria, na uhakikishe kwamba sheria inayolingana imewezeshwa katika sera ya ufuatiliaji wa wakati halisi. Wakala lazima awashwe ili kuendesha hati ya majibu, na kigezo sahihi lazima kibainishwe.