[vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””]<\/p>\n
[\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””] <\/p>\n
\u5728\u4e0d\u65b7\u767c\u5c55\u7684\u7db2\u8def\u5b89\u5168\u9818\u57df\uff0cWindows\u5b89\u5168<\/a>\u4ecd\u7136\u662f\u79d1\u6280\u611b\u597d\u8005\u548c\u5c08\u696d\u4eba\u58eb\u95dc\u6ce8\u7684\u91cd\u9ede\u3002\u4e00\u7a2e\u7279\u5225\u96b1\u853d\u7684\u5a01\u8105\u6b63\u5728\u8208\u8d77\uff0c\u90a3\u5c31\u662f\u865b\u5047\u9a57\u8b49\u653b\u64ca\uff0c\u5b83\u53ef\u80fd\u6703\u5371\u53ca\u8a17\u7ba1\u5728\u9999\u6e2f\u4f3a\u670d\u5668\u79df\u7528<\/a>\u7b49\u5e73\u53f0\u4e0a\u7684\u7cfb\u7d71\u3002\u672c\u6587\u6df1\u5165\u63a2\u8a0e\u4e86\u9019\u4e9b\u653b\u64ca\u7684\u8907\u96dc\u6027\uff0c\u4e26\u63d0\u4f9b\u4e86\u60e1\u610f\u8edf\u9ad4\u6aa2\u6e2c\u548c\u9810\u9632<\/a>\u7684\u9ad8\u7d1a\u7b56\u7565\u3002<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””] <\/p>\n \u865b\u5047\u9a57\u8b49\u653b\u64ca\u662f\u793e\u6703\u5de5\u7a0b\u7b56\u7565\u7684\u4e00\u500b\u5b50\u96c6\uff0c\u5b83\u5229\u7528\u4eba\u985e\u5fc3\u7406\u548c\u7cfb\u7d71\u6f0f\u6d1e\u3002\u9019\u4e9b\u653b\u64ca\u5e38\u5e38\u507d\u88dd\u6210\u5408\u6cd5\u7684Windows\u5b89\u5168\u63d0\u793a\uff0c\u8a98\u9a19\u4f7f\u7528\u8005\u6d29\u9732\u654f\u611f\u8cc7\u8a0a\u6216\u6388\u4e88\u672a\u7d93\u6388\u6b0a\u7684\u5b58\u53d6\u6b0a\u9650\u3002<\/p>\n \u70ba\u4e86\u8aaa\u660e\u9019\u7a2e\u653b\u64ca\u7684\u6a5f\u5236\uff0c\u8acb\u8003\u616e\u4ee5\u4e0b\u6a21\u4eff\u60e1\u610f\u8173\u672c\u7684\u507d\u4ee3\u78bc\uff1a<\/p>\n \u9019\u500b\u7c21\u5316\u7684\u7a0b\u5f0f\u78bc\u7247\u6bb5\u6f14\u793a\u4e86\u653b\u64ca\u8005\u53ef\u80fd\u5982\u4f55\u69cb\u5efa\u4ed6\u5011\u7684\u60e1\u610f\u8edf\u9ad4\u4f86\u5275\u5efa\u4ee4\u4eba\u4fe1\u670d\u7684\u865b\u5047\u9a57\u8b49\u63d0\u793a\u3002<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””] <\/p>\n \u5c0d\u65bc\u7cbe\u901a\u6280\u8853\u7684Windows\u4f7f\u7528\u8005\u4f86\u8aaa\uff0c\u8b58\u5225\u865b\u5047\u9a57\u8b49\u5617\u8a66\u7684\u660e\u986f\u8de1\u8c61\u81f3\u95dc\u91cd\u8981\u3002\u4ee5\u4e0b\u662f\u4e00\u4e9b\u9ad8\u7d1a\u6307\u6a19\uff1a<\/p>\n \u8981\u6aa2\u6e2c\u53ef\u7591\u8655\u7406\u7a0b\u5e8f\uff0c\u60a8\u53ef\u4ee5\u4f7f\u7528PowerShell\u76e3\u63a7\u7570\u5e38\u6d3b\u52d5\uff1a<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””] <\/p>\n \u4fdd\u8b77\u60a8\u7684Windows\u7cfb\u7d71\uff0c\u7279\u5225\u662f\u7576\u9023\u63a5\u5230\u9999\u6e2f\u4f3a\u670d\u5668\u79df\u7528\u670d\u52d9\u6642\uff0c\u9700\u8981\u591a\u5c64\u6b21\u7684\u65b9\u6cd5\uff1a<\/p>\n \u4ee5\u4e0b\u662f\u555f\u7528\u53d7\u63a7\u8cc7\u6599\u593e\u5b58\u53d6\u7684PowerShell\u547d\u4ee4\uff1a<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””] <\/p>\n \u5c0d\u65bc\u90a3\u4e9b\u5728\u9999\u6e2f\u4f3a\u670d\u5668\u79df\u7528\u5e73\u53f0\u4e0a\u7ba1\u7406Windows\u7cfb\u7d71\u7684\u4eba\u4f86\u8aaa\uff0c\u63a1\u7528\u9ad8\u7d1a\u60e1\u610f\u8edf\u9ad4\u6aa2\u6e2c\u6280\u8853\u81f3\u95dc\u91cd\u8981\uff1a<\/p>\n \u4ee5\u4e0b\u662f\u4e00\u500b\u7c21\u55ae\u7684YARA\u898f\u5247\u793a\u4f8b\uff0c\u7528\u65bc\u6aa2\u6e2c\u6f5b\u5728\u7684\u865b\u5047\u9a57\u8b49\u60e1\u610f\u8edf\u9ad4\uff1a<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””] <\/p>\n \u5728\u7ba1\u7406\u9999\u6e2f\u4f3a\u670d\u5668\u79df\u7528\u5e73\u53f0\u4e0a\u7684Windows\u7cfb\u7d71\u6642\uff0c\u4fdd\u8b77\u9060\u7aef\u5b58\u53d6\u81f3\u95dc\u91cd\u8981\uff1a<\/p>\n \u8981\u8a2d\u7f6ePowerShell JIT\u5b58\u53d6\u898f\u5247\uff0c\u60a8\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0bAzure AD PowerShell\u547d\u4ee4\uff1a<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””] <\/p>\n \u901a\u904e\u6301\u7e8c\u76e3\u63a7\u4fdd\u6301\u8b66\u60d5\u5c0dWindows\u5b89\u5168\u81f3\u95dc\u91cd\u8981\u3002\u5be6\u65bd\u4e00\u500b\u5f37\u5927\u7684\u4e8b\u4ef6\u97ff\u61c9\u8a08\u5283\uff0c\u5305\u62ec\uff1a<\/p>\n \u8003\u616e\u4f7f\u7528PowerShell\u81ea\u52d5\u5316\u65e5\u8a8c\u6536\u96c6\u548c\u5206\u6790\uff1a<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=”blog-detail-section”][vc_column][vc_column_text css=””] <\/p>\n \u96a8\u8457\u865b\u5047\u9a57\u8b49\u653b\u64ca\u4e0d\u65b7\u6f14\u8b8a\uff0c\u4fdd\u6301\u5f37\u5927\u7684Windows\u5b89\u5168\u5be6\u8e10\u81f3\u95dc\u91cd\u8981\uff0c\u7279\u5225\u662f\u5c0d\u65bc\u8a17\u7ba1\u5728\u9999\u6e2f\u4f3a\u670d\u5668\u79df\u7528\u5e73\u53f0\u4e0a\u7684\u7cfb\u7d71\u3002\u901a\u904e\u5be6\u65bd\u9ad8\u7d1a\u60e1\u610f\u8edf\u9ad4\u6aa2\u6e2c\u6280\u8853\u3001\u52a0\u5f37\u7cfb\u7d71\u5b89\u5168\uff0c\u4e26\u57f9\u990a\u7db2\u8def\u5b89\u5168\u610f\u8b58\u6587\u5316\uff0c\u6280\u8853\u5c08\u696d\u4eba\u58eb\u53ef\u4ee5\u986f\u8457\u964d\u4f4e\u6210\u70ba\u9019\u4e9b\u8907\u96dc\u5a01\u8105\u53d7\u5bb3\u8005\u7684\u98a8\u96aa\u3002<\/p>\n \u8acb\u8a18\u4f4f\uff0c\u7db2\u8def\u5b89\u5168\u7684\u683c\u5c40\u5728\u4e0d\u65b7\u8b8a\u5316\u3002\u4fdd\u6301\u8cc7\u8a0a\u66f4\u65b0\uff0c\u4fdd\u6301\u7cfb\u7d71\u66f4\u65b0\uff0c\u4e26\u59cb\u7d42\u4ee5\u5065\u5eb7\u7684\u61f7\u7591\u614b\u5ea6\u5c0d\u5f85\u610f\u5916\u7684\u9a57\u8b49\u8acb\u6c42\u3002\u901a\u904e\u9019\u6a23\u505a\uff0c\u60a8\u5c07\u80fd\u5920\u5f88\u597d\u5730\u4fdd\u8b77\u60a8\u7684Windows\u74b0\u5883\u514d\u53d7\u7576\u4eca\u6578\u4f4d\u4e16\u754c\u4e2d\u5b58\u5728\u7684\u773e\u591a\u5a01\u8105\u3002<\/p>\n [\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":" [vc_row el_class=”blog-detail-section”][vc_ […]<\/p>\n\u7406\u89e3\u865b\u5047\u9a57\u8b49\u653b\u64ca\u7684\u5256\u6790<\/strong><\/h2>\n
function fakeverificationPopup() {\r\n createWindow(\"Windows Security Verification\")\r\n displayLogo(\"windows_logo.png\")\r\n inputField = createInput(\"Enter your credentials\")\r\n submitButton = createButton(\"Verify\")\r\n\r\n submitButton.onClick = function() {\r\n credentials = inputField.getValue()\r\n sendToAttacker(credentials)\r\n displayMessage(\"Verification successful\")\r\n closeWindow()\r\n }\r\n}\r\n\r\n\/\/ Trigger on system events\r\naddEventListener(\"systemStartup\", fakeverificationPopup)\r\naddEventListener(\"networkChange\", fakeverificationPopup)\r\n<\/code><\/pre>\n\u8b58\u5225\u9a57\u8b49\u8acb\u6c42\u4e2d\u7684\u7d05\u65d7\u4fe1\u865f<\/strong><\/h2>\n
\n
# PowerShell script to monitor for suspicious processes\r\n$suspiciousProcesses = @(\"fakeverify.exe\", \"winlogon_update.exe\")\r\nwhile ($true) {\r\n $processes = Get-Process | Where-Object {$suspiciousProcesses -contains $_.Name}\r\n if ($processes) {\r\n Write-Host \"Warning: Suspicious process detected!\"\r\n $processes | Format-Table Name, Id, Path -AutoSize\r\n }\r\n Start-Sleep -Seconds 5\r\n}\r\n<\/code><\/pre>\n\u52a0\u5f37\u60a8\u7684Windows\u7cfb\u7d71\u4ee5\u9632\u653b\u64ca<\/strong><\/h2>\n
\n
Set-MpPreference -EnableControlledFolderAccess Enabled\r\n<\/code><\/pre>\n\u9ad8\u7d1a\u60e1\u610f\u8edf\u9ad4\u6aa2\u6e2c\u6280\u8853<\/strong><\/h2>\n
\n
rule Fake_Verification_Malware {\r\n strings:\r\n $fake_prompt = \"Windows Security Verification\" wide ascii\r\n $suspicious_func = \"sendToAttacker\" wide ascii\r\n condition:\r\n uint16(0) == 0x5A4D and\r\n $fake_prompt and\r\n $suspicious_func\r\n}\r\n<\/code><\/pre>\n\u4fdd\u8b77\u9999\u6e2f\u4f3a\u670d\u5668\u79df\u7528\u74b0\u5883\u7684\u9060\u7aef\u5b58\u53d6<\/strong><\/h2>\n
\n
New-AzureADMSPrivilegedAccessReviewDefinition `\r\n -Scope 'Tenant' `\r\n -ReviewerType 'Self' `\r\n -StartDateTime (Get-Date) `\r\n -DurationInDays 7 `\r\n -ReviewerType 'Self' `\r\n -RecurrenceType 'Weekly' `\r\n -RoleDefinitionId 'roleDefinitionId' `\r\n -IsApprovalRequired $true `\r\n -IsAccessRecommendationEnabled $true `\r\n -IsPrivileged $true\r\n<\/code><\/pre>\n\u6301\u7e8c\u76e3\u63a7\u548c\u4e8b\u4ef6\u97ff\u61c9<\/strong><\/h2>\n
\n
# PowerShell script for log analysis\r\n$logPath = \"C:\\Windows\\System32\\winevt\\Logs\\Security.evtx\"\r\n$criticalEvents = Get-WinEvent -FilterHashtable @{\r\n LogName='Security'\r\n Id=4624,4625,4688\r\n} -MaxEvents 1000\r\n\r\n$criticalEvents | Where-Object {$_.Message -match \"suspicious\"} | \r\n Select-Object TimeCreated, Id, Message | \r\n Export-Csv -Path \"C:\\SecurityAlerts.csv\" -NoTypeInformation\r\n<\/code><\/pre>\n\u7d50\u8ad6\uff1a\u4fdd\u6301\u9818\u5148<\/strong><\/h2>\n