Iyini i-ASR (Attack Surface Reduction) futhi iwavikela kanjani amadivayisi akho?

Uma uqala ukuhlola ukuphepha kweWindows nakho konke okunikezwa yiMicrosoft Defender, igama elithi ASR (Attack Surface Reduction) livela kaninginingi. Futhi lokho akulona iphutha: sikhuluma ngemithetho namasu aklanyelwe ukuvimba ukuhlaselwa ngaphambi kokuba bathole ithuba lokuphuma enkundleni.

Emongweni wezinsongo eziyinkimbinkimbi kakhulu , okuhlanganisa i-ransomware, izikripthi ezifihliwe, ukwebiwa kweziqinisekiso, kanye nokuhlaselwa okungenamafayela, imithetho ye-ASR isibe yingxenye ebalulekile yokuzivikela kokuvimbela. Inkinga ukuthi ivame ukubhekwa njengento "engumlingo" futhi eyinkimbinkimbi, kanti empeleni inomqondo ocacile uma ichazwa ngokuthula.

Iyini i-ASR (Attack Surface Reduction) futhi iyiphi inkinga eyixazululayo?

Ukunciphisa Uhlaselo Lomphezulu (i-ASR ) kuyindlela ehilela ukunciphisa wonke amaphuzu umhlaseli angangena ngawo, ahambise, noma asebenzise ikhodi endaweni ethile. Esimweni esithile se-Microsoft, i-ASR isetshenziswa ngemithetho elawula ukuziphatha kwe-endpoint okuyingozi kakhulu: ukwenziwa kwesikripthi, ama-Office macros, izinqubo ezivela kuma-USB drives, ukusetshenziswa kabi kwe-WMI, njll.

Ngokwemibandela engokoqobo, imithetho ye-Microsoft Defender's Endpoint ASR iyizinqubomgomo ezithi: "izinto ezithile ezijwayelekile ze -malware ngeke zivunyelwe, noma izinhlelo zokusebenza ezisemthethweni zingase zizenze ngezinye izikhathi." Isibonelo, i-Word iqalisa i-PowerShell, iskripthi esilandiwe ku-inthanethi siqalisa i-executable, noma inqubo eyodwa ezama ukufaka ikhodi kwenye.

Umqondo oyisisekelo ukunciphisa inani lezindlela ukuhlaselwa okungazithatha ukuze kuphazamise uhlelo. Izindlela ezimbalwa ezitholakalayo zisho indawo encane yokuhlasela . Lokhu kuhambisana kahle nemodeli ye-Zero Trust: sicabanga ukuthi kuzokwenzeka ukwephulwa ngesikhathi esithile, ngakho-ke sinciphisa "i-radius yokuqhuma" yesigameko ngangokunokwenzeka.

Kubalulekile ukuhlukanisa lapha phakathi kwemibono emibili evame ukuxutshwa: ngakolunye uhlangothi, ukunciphisa indawo yokuhlasela njengesu elijwayelekile (ukususa izinsizakalo ezingadingekile, ukuvala amachweba, ukususa isofthiwe engafuneki, ukukhawulela izimvume, njll.), kanti ngakolunye uhlangothi, iMicrosoft Defender ASR Rules , okuyisethi ethile yalelo su, egxile ekuphetheni nasekuziphatheni kwesofthiwe.

Indawo yokuhlasela: ezomzimba, ezedijithali, nezomuntu

Uma sikhuluma ngobuso bokuhlasela benhlangano, sibhekisela kuzo zonke izindawo lapho umhlaseli angathola khona ukufinyelela : amadivayisi, izinhlelo zokusebenza, izinsizakalo eziku-inthanethi, ama-akhawunti abasebenzisi, ama-API, amanethiwekhi angaphakathi, amafu angaphandle, njll. Akuyona nje inkinga yobuchwepheshe; iphutha lomuntu nalo lidlala indima.

Embusweni wedijithali, sithola amawebhusayithi, amaseva, izizindalwazi , ama-endpoints, izinsizakalo zamafu, kanye nezinhlelo zokusebenza zebhizinisi . Yonke insizakalo engalungiselelwanga kahle, yonke imbobo evulekile ngokungadingekile, yonke isoftware engakalungiswa ingaba yindawo yokungena yokuxhashazwa. Yingakho izinkampani eziningi zithembele kumathuluzi e-EASM (External Attack Surface Management) azenzakalela ukutholakala kwezimpahla eziveziwe kanye nobuthakathaka.

Ebusweni obubonakalayo , amaseva asendaweni, izindawo zokusebenza, amadivayisi enethiwekhi, kanye namatheminali kuyasetshenziswa . Lapha, ingozi incishiswa ngezilawuli zokufinyelela ezibonakalayo, amakhamera, amakhadi, izingidi, ama-rack avaliwe, kanye nehadiwe eqinile . Uma noma ubani engangena esikhungweni sedatha ngedrayivu ye-USB, akunandaba ukuthi inqubomgomo yakho yokuphepha inhle kangakanani.

Isici sesithathu yindawo yokuhlasela ehlotshaniswa nobunjiniyela bezenhlalo kanye nesici somuntu . Lokhu kufaka phakathi ama-imeyili obugebengu bokweba imininingwane ebucayi, izingcingo zokuzithethelela, amawebhusayithi okunisela, noma amaphutha alula abasebenzi aholela ekulandeni okuqukethwe okunonya. Ngakho-ke, ukunciphisa indawo yokuhlasela kuhilela nokuqeqeshwa nokuqwashisa, hhayi ubuchwepheshe kuphela.

I-ASR njengensika yokuphepha kokuvimbela kanye ne-Zero Trust

Kumodeli ye-Zero Trust, sicabanga ukuthi inethiwekhi isivele isengozini noma izoba , futhi umgomo wethu ukuvimbela umhlaseli ukuthi angakhuphuki kalula amalungelo. Imithetho ye-ASR ifanelana kahle lapha ngoba ibeka izithiyo ngokumelene nama-vector okuhlasela asetshenziswa kakhulu, ikakhulukazi ekugcineni.

Imithetho ye-ASR isebenzisa isimiso selungelo elincane ekuziphatheni : akukhona nje ukuthi yiziphi izimvume i-akhawunti enazo, kodwa ukuthi yiziphi izenzo uhlelo lokusebenza oluthile olungazifeza. Isibonelo, i-Office isengahlela amadokhumenti ngaphandle kwenkinga, kodwa ayisakwazi ukuqalisa izinqubo zezingane noma ukudala ama-executable kudiski ngokukhululeka.

Lolu hlobo lokulawula ukuziphatha lunamandla kakhulu ngokumelene nezinsongo ze-polymorphic kanye nokuhlaselwa okungenamafayela . Ngisho noma i-malware ishintsha njalo isiginesha noma i-hash yayo, iningi lisadinga ukwenza izinto ezifanayo: ukwenza izikripthi, ukufaka ikhodi ezinqubweni, ukuphatha i-LSASS, ukusebenzisa kabi i-WMI, ukubhala abashayeli abasengozini, njll. I-ASR igxila ngqo kula maphethini.

Ngaphezu kwalokho, imithetho ingasetshenziswa ngezindlela ezahlukene: ukuvimba, ukuhlola, noma ukuxwayisa . Lokhu kuvumela ukwamukelwa kancane kancane, kuqala ngokubheka umthelela wayo (imodi yokuhlola), bese kwaziswa umsebenzisi (isexwayiso), bese ekugcineni uyivimba ngokuphelele uma ukukhishwa sekulungisiwe.

Okudingekayo kanye nezinhlelo zokusebenza ezihambisanayo

Ukuze uthole okuningi emithethweni ye-ASR ku-Microsoft Defender, kubalulekile ukuba nesisekelo esiqinile. Empeleni, udinga i-Microsoft Defender Antivirus ukuthi ibe yi-antivirus yakho eyinhloko , isebenza kwimodi esebenzayo, hhayi engasebenzi, enokuvikelwa kwesikhathi sangempela okuvuliwe.

Imithetho eminingi, ikakhulukazi leyo ethuthuke kakhulu, idinga ukuvikelwa okusebenzayo okulethwe ngamafu kanye nokuxhumeka kumasevisi efu le-Microsoft. Lokhu kuyisihluthulelo sezici ezithembele edumeleni, ekusabalaleni, noma ekuguqukeni kwesimo efwini, njengomthetho "wokusebenza okungahlangabezani nokusabalala, ubudala, noma izindinganiso zohlu ezithembekile" noma umthetho "wokuvikelwa kwe-ransomware okuthuthukisiwe."

Nakuba imithetho ye-ASR ingadingi ilayisensi ye -Microsoft 365 E5 kuphela, ukuba nelayisensi ye-E5 noma elinganayo kunconywa kakhulu uma ufuna amakhono okuphatha athuthukisiwe, ukuqapha, ukuhlaziya, ukubika, kanye nokusebenza komsebenzi ahlanganiswe ku-Microsoft Defender for Endpoint kanye ne-portal ye-Microsoft Defender XDR.

Uma usebenza namalayisense afana ne-Windows Professional noma i-Microsoft 365 E3 ngaphandle kwalezo zici ezithuthukisiwe, usengasebenzisa i-ASR, kodwa kuzodingeka uthembele kakhulu ku- Event Viewer, amalogi e-Microsoft Defender Antivirus, kanye nezixazululo zakho zokuqapha nokubika (ukudlulisa imicimbi, i-SIEM, njll.). Kuzo zonke izimo, kubalulekile ukubuyekeza uhlu lwezinhlelo zokusebenza ezisekelwayo , njengoba imithetho ehlukene inezidingo ezincane ze-Windows 10/11 kanye nezinguqulo zeseva.

Izindlela zokubusa ze-ASR kanye nokuhlola kwangaphambili

Umthetho ngamunye we-ASR ungahlelwa ezimweni ezine: akulungiselelwanga/kukhutshaziwe, ukuvimba, ukuhlola, noma isixwayiso . Lezi zimo zimelelwa futhi ngamakhodi ezinombolo (0, 1, 2, kanye no-6 ngokulandelana) asetshenziswa ku-GPO, MDM, Intune, kanye ne-PowerShell.

Imodi yokuvimba isebenzisa umthetho futhi imisa ngokuqondile ukuziphatha okusolisayo. Imodi yokuhlola ibhala phansi izehlakalo ebezizovinjelwa kodwa ivumela isenzo ukuthi siqhubeke, okukuvumela ukuthi uhlole umthelela ezinhlelweni zokusebenza zebhizinisi ngaphambi kokuqinisa ukuphepha.

Imodi yesixwayiso uhlobo lwendawo ephakathi nendawo: umthetho usebenza njengebhulokhi, kodwa umsebenzisi ubona ibhokisi lengxoxo elibonisa ukuthi okuqukethwe kuvinjiwe futhi unikezwa inketho yokukuvula okwesikhashana amahora angama-24 . Ngemva kwaleso sikhathi, iphethini efanayo izovinjelwa futhi ngaphandle kokuthi umsebenzisi ayivumele futhi.

Imodi yesixwayiso isekelwa kuphela kusukela ku -Windows 10 inguqulo 1809 (RS5) kuya phambili . Ezinguqulweni zangaphambilini, uma uhlela umthetho kwimodi yesixwayiso, empeleni uzosebenza njengomthetho wokuvimba. Ngaphezu kwalokho, eminye imithetho ethile ayisekeli imodi yesixwayiso uma ihlelwe nge-Intune (yize isekela nge-Group Policy).

Ngaphambi kokusebenzisa ukuvimba, kunconywa kakhulu ukusebenzisa imodi yokuhlola nokusebenzisa i- Microsoft Defender Vulnerability Management , lapho ungabona khona umthelela olindelekile womthetho ngamunye (iphesenti lamadivayisi athintekile, umthelela ongaba khona kubasebenzisi, njll.). Ngokusekelwe kudatha yokuhlola, unganquma ukuthi yimiphi imithetho ozoyisebenzisa kumodi yokuvimba, kumaqembu okuhlola, nokuthi yikuphi ukukhishwa okudingayo.

Imithetho ye-ASR ngohlobo: imithetho ejwayelekile yokuvikela neminye imithetho

I-Microsoft ihlukanisa imithetho ye-ASR ibe amaqembu amabili: ngakolunye uhlangothi, imithetho yokuvikela ejwayelekile , okuyileyo eyincomayo ukuthi isebenze cishe njalo ngoba ayinawo umthelela omkhulu ekusetshenzisweni, kanti ngakolunye uhlangothi, eminye imithetho evame ukudinga isigaba sokuhlola esicophelelayo.

Phakathi kwemithetho ejwayelekile yokuvikela kukhona, isibonelo, “Ukusetshenziswa kabi kwe-block kwabashayeli abasayiniwe abasengozini abaxhashazwayo , ” “Ukwebiwa kweziqinisekiso zokuvimba ohlelweni olungaphansi lweziphathimandla zokuphepha zasendaweni (lsass.exe),” kanye “Nokuvinjelwa kokuphikelela ngokubhalisela imicimbi ye-WMI .” Lokhu kuhlose ngqo ukwanda kwamalungelo avamile, ukugwema ukuzivikela, kanye namasu okuphikelela.

Imithetho esele, yize inamandla kakhulu, ingase ingqubuzane kakhulu nezinhlelo zokusebenza zebhizinisi ezisebenzisa kakhulu izikripthi, ama-macro, izinqubo zangemuva, noma amathuluzi okuphatha akude. Lokhu kufaka phakathi yonke imithetho ethinta i-Office, i-Adobe Reader, i-PSExec, i-remote WMI, izikripthi ezifihliwe, ukusebenza kusuka ku-USB, i-WebShells , njll.

Ngomthetho ngamunye, imibhalo ye-Microsoft a Igama le-Intune, igama elingenzeka Kusiphathi Sokucupha, i-GUID ehlukile, okuncikile (AMSI, Cloud Protection, RPC…) kanye nezinhlobo zezehlakalo ezikhiqizwa usesho oluthuthukisiwe (isibonelo, AsrObfuscatedScriptBlocked, AsrOfficeChildProcessAuditednjll.). Lawa ma-GUID yiwo ozodinga ukuwasebenzisa ku-GPO, MDM, naku-PowerShell ukuze unike amandla, ukhubaze, noma uguqule imodi.

Incazelo enemininingwane yemithetho ye-ASR eyinhloko

Imithetho ye-ASR ihlanganisa uhla olubanzi kakhulu lwezindlela zokuhlasela . Imithetho efanele kakhulu ifingqiwe ngezansi, kanye nalokho okuvinjwa yileyo naleyo, ngokusekelwe ezinkombeni ezisemthethweni kanye nokuhlangenwe nakho okusebenzayo.

Vimbela ukuhlukunyezwa kwabashayeli abasayiniwe abasengozini, abaxhashazwayo

Lo mthetho uvimbela uhlelo lokusebenza olunamalungelo anele ekubhaleni abashayeli abasayiniwe kodwa abasengozini kudiski, abahlaseli abangalayisha ukuze bathole ukufinyelela ku-kernel futhi bakhubaze noma badlule izinyathelo zokuphepha. Awuvimbeli ukulayishwa kwabashayeli abasengozini asebevele bekhona, kodwa unqamula enye yezindlela ezijwayelekile zokuzifaka.

Ikhonjwa yi-GUID 56a863a9-875e-4185-98a7-b882c64b5ce5 futhi ikhiqize imicimbi yohlobo AsrVulnerableSignedDriverAudited y AsrVulnerableSignedDriverBlocked kusesho oluthuthukile lwe-Microsoft Defender.

Vimbela i-Adobe Reader ukuthi ingakhi izinqubo zengane

Inhloso yalo mthetho ukuvimbela i-Adobe Reader ukuthi ingasetshenziswa njengesisekelo sokulanda nokuqalisa imithwalo yokukhokha. Ivimbela ukudalwa kwezinqubo zesibili ezivela ku-Reader, ivikela ekusetshenzisweni kwe-PDF kanye namasu obunjiniyela bezenhlalo ancike kulo mbukeli.

I-GUID yakho 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2cfuthi ingadala imicimbi AsrAdobeReaderChildProcessAudited y AsrAdobeReaderChildProcessBlockedKuya ngokuthi iMicrosoft Defender Antivirus iyasebenza.

Vimbela zonke izinhlelo zokusebenza ze-Office kusukela ekudaleni izinqubo zezingane

Lo mthetho uvimbela i-Word, Excel, PowerPoint, OneNote, kanye ne-Access ekuzaleni izinqubo zezingane . Kuyindlela eqondile yokumisa ukuhlaselwa okuningi okusekelwe kuma-macro okuqalisa i-PowerShell, i-CMD , noma amanye amathuluzi esistimu ukuze kusetshenziswe ikhodi enonya.

I-GUID ehlobene yi -d4f940ab-401b-4efc-aadc-ad5f3c50688a . Ezimweni zangempela, ezinye izinhlelo zokusebenza zebhizinisi ezisemthethweni nazo zisebenzisa le ndlela (isibonelo, ukuvula umyalo noma ukufaka izinguquko ku-Registry), ngakho-ke kubalulekile ukuyihlola kumodi yokuhlola kusengaphambili.

Vimba ukwebiwa kwemininingwane ye-LSASS

Lo mthetho uvikela inqubo ye -lsass.exe ekufinyeleleni okungagunyaziwe ngezinye izinqubo, kunciphisa indawo yokuhlasela yamathuluzi afana ne-Mimikatz, azama ukukhipha ama-hashe, amaphasiwedi acacile, noma amathikithi e-Kerberos.

Ifana nefilosofi efanayo ne- Microsoft Defender Credential Guard ; uma usuvele unayo i-Credential Guard evuliwe, umthetho awunezeli okuningi, kodwa uwusizo kakhulu ezindaweni lapho ungakwazi ukuyivula khona ngenxa yokungahambisani nabashayeli noma isofthiwe yomuntu wesithathu. I-GUID yayo yi- 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2.

Vimba okuqukethwe okusebenzisekayo okuvela kumaklayenti e-imeyili kanye ne-webmail

Lokhu kusiletha emthethweni ohlobene eduze nokuhlaselwa kwe-phishing. Kuvimbela ama-executable, ama-script, namafayela acindezelwe alandiwe noma anamathiselwe kumakhasimende e-imeyili kanye ne-webmail ukuthi angasebenzi ngqo. Kusebenza kakhulu ku-Outlook, Outlook.com, kanye nabahlinzeki be-webmail abadumile, futhi kuyasiza kakhulu uma kuhlanganiswa nezinye izivikelo ze-imeyili kanye nezilungiselelo zesiphequluli eziphephile.

I-GUID yakho be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 futhi yakha izenzakalo ezifana AsrExecutableEmailContentAudited y AsrExecutableEmailContentBlockedIwusizo ikakhulukazi ekuhlanganisweni nokunye ukuvikela kwe-imeyili.

Vimbela okusebenzisekayo ekusebenzeni uma kungafinyeleli ukuvama, ubudala, noma imibandela yohlu lokwethenjwa.

Lo mthetho uvimba ukwenziwa kwama-binary (.exe, .dll, .scr, njll.) angatholakali njalo, amadala ngokwanele, noma angathembekile ngokwanele ngokwedatha yodumo lwefu le-Microsoft. Isebenza kahle kakhulu ngokumelene ne-malware entsha, kodwa ingaba bucayi ezindaweni ezinesofthiwe eningi yangaphakathi noma engavamile.

I-GUID ithi 01443614-cd74-433a-b99e-2ecdc07bfc25 futhi incike ngokusobala ekuVikelweni Kwamafu. Futhi, lokhu kuyindaba ecacile yomthetho wokuthi kungcono ukuqala ngemodi yokuhlola bese usebenzisa kancane kancane ukuvimba.

Vimba ukusetshenziswa kwezikripthi okungenzeka zibe-ofuscated

Ikhodi efihliwe ivamile kokubili kubahlaseli, futhi ngezinye izikhathi, kubathuthukisi abasemthethweni. Lo mthetho uhlaziya izici ezisolisayo ku-PowerShell, VBScript, JavaScript, noma izikripthi ze-macro ezifihliwe futhi uvimba lezo ezinamathuba aphezulu okuba nonya.

I-GUID yayo ingu -5beb7efe-fd9a-4556-801d-275e5ffc04cc , futhi isebenzisa i-AMSI (i-Antimalware Scan Interface) kanye nokuvikelwa kwamafu ekwenzeni izinqumo zayo. Ingomunye wemithetho ephumelela kakhulu ngokumelene nemikhankaso yesimanje esekelwe kuskripthi.

Vimbela i-JavaScript noma i-VBScript ukuthi ingaqalisi okusebenzisekayo okulandiwe

Lo mthetho ugxile kuphethini evamile yomlandi: iskripthi se-JS noma se-VBS silanda i-binary ku-inthanethi bese siyisebenzisa . Lokho i-ASR ekwenzayo lapha ukuvimbela leso sinyathelo sokuqalisa i-executable elandiwe.

I-GUID yayo ingu -d3e037e1-3eb8-44c8-a917-57927947596d , ithembele futhi ku-AMSI futhi ibaluleke kakhulu ezimweni lapho ubuchwepheshe noma izikripthi ezindala zisasetshenziswa kusiphequluli noma kudeskithophu.

Vimbela izinhlelo zokusebenza ze-Office ekudaleni okuqukethwe okusebenzisekayo

Enye indlela evamile ukusebenzisa i-Office ukubhala izingxenye ezinonya kudiski eziqhubeka ngemva kokuqala kabusha (isibonelo, i-executable eqhubekayo noma i-DLL). Lo mthetho uvimbela i-Office ekulondolozeni noma ekufinyeleleni lolo hlobo lokuqukethwe okusebenzisekayo ukuze ikuqalise.

I-GUID ingu -3b576869-a4ec-4529-8536-b80a7769e899 futhi incike ku-Microsoft Defender Antivirus kanye ne-RPC. Isebenza kahle kakhulu ekuphuleni izintambo zokutheleleka ezisekelwe kuma-macro ezilanda imithwalo eqhubekayo yokukhokha.

Vimbela izinhlelo zokusebenza ze-Office ekufakeni ikhodi kwezinye izinqubo

Lokhu kuvimbela i-Office ekusebenziseni amasu okufaka inqubo , okuhlanganisa ukufaka ikhodi kwezinye izinqubo ukuze kufihlwe umsebenzi ononya. I-Microsoft ayazi nganoma yikuphi ukusetshenziswa kwebhizinisi okusemthethweni kwale ndlela, ngakho-ke kungumthetho ophephile ukuwusebenzisa ezindaweni eziningi.

I-GUID yayo ingu- 75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84 . Kodwa-ke, izinhlelo zokusebenza ezithile zibhaliwe ukuthi ziyaphikisana nalo mthetho, ngakho-ke uma umsindo uvela endaweni ezungezile, kuyalulekwa ukuhlola ukuhambisana.

Vimbela izinhlelo zokusebenza zokuxhumana ze-Office ekudaleni izinqubo zezingane

Lo mthetho, ohloselwe kakhulu i-Outlook kanye neminye imikhiqizo yokuxhumana ye-Office, uvimba ukudalwa kwezinqubo zezingane ezivela kuklayenti le-imeyili , unciphisa ukuhlaselwa okuxhaphaza ubuthakathaka emithethweni ye-Outlook, amafomu, noma ama-imeyili anonya ukuze kusetshenziswe ikhodi.

I-GUID yayo ingu- 26190899-1602-49e8-8b27-eb1d0a1ce869 futhi iyasiza ukuvala i-vector ekhangayo kakhulu yemikhankaso yobugebengu bokweba imininingwane ebucayi eqondiwe.

Vimba ukuphikelela ngokubhaliselwe komcimbi we-WMI

Izinsongo eziningi ezingenamafayela zithembele ku- WMI ukuze zifeze ukuphikelela ngaphandle kokushiya imikhondo ecacile kudiski. Lo mthetho uvimba ukudalwa kokubhaliselwa kwemicimbi ye-WMI okunonya okungase kuqalise kabusha ikhodi noma nini lapho kuhlangatshezwana nesimo.

I-GUID yayo ingu- e6db77e5-3df2-4cf1-b95a-636979351e5b futhi ayisekeli ukukhishwa kwamafayela noma amafolda, ukuze ivimbele ukuthi kusetshenziswe kabi.

Vimba izinqubo ezidalwe kusuka ku-PSExec nemiyalo ye-WMI

I-PsExec kanye ne-WMI ngamathuluzi okuphatha akude asemthethweni, kodwa futhi asetshenziswa kaningi ekunyakazeni okuseceleni kanye nokusabalala kwe-malware . Lo mthetho uvimbela izinqubo ezivela emiyalweni ye -PSExec noma ye-WMI ukuthi zisebenze, ngaleyo ndlela kunciphisa leyo vektha.

I-GUID ingu- d1e49aac-8f56-4280-b9ba-993a6d77406c . Ingenye yaleyo mithetho lapho ukubambisana nabaphathi kanye namaqembu okusebenza kubalulekile ukugwema ukuphazamisa izinqubo zokuphatha ezikude ezisemthethweni.

Vimba ukuqalisa kabusha kwemodi ephephile okuqalwe ngemiyalo

Kumodi ephephile , izixazululo eziningi zokuphepha zikhutshaziwe noma zinqunyelwe kakhulu. Ezinye izixazululo ezisebenzisa kabi i-ransomware ziyala njenge -bcdedit noma i-bootcfg ukuthi ziqalise kabusha kwimodi ephephile futhi zibethele amafayela ngokumelana okuncane. Lo mthetho uvimbela lokho, okuvumela ukufinyelela kwimodi ephephile kuphela ngendawo yokutakula ngesandla.

I-GUID yakho 33ddedf1-c6e0-47cb-833e-de6133960387 futhi yakha izenzakalo ezifana AsrSafeModeRebootBlocked o AsrSafeModeRebootWarnBypassed.

Vimba izinqubo ezingasayiniwe noma ezingathenjwa ezivela ku-USB

Lo mthetho ulawula indawo yokungena evamile: amadrayivu e-USB namakhadi e-SD . Ngalo mthetho, ama-executable angasayiniwe noma angathembekile aqaliswe kulezi midiya ayavinjelwa. Lokhu kusebenza kuma-binary njenge-.exe, .dll, .scr, njll.

I-GUID iyi -b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 futhi iwusizo kakhulu ezindaweni lapho kunengozi yokusetshenziswa kwe-USB okungalawulwa.

Vimba ukusetshenziswa kwamathuluzi esistimu akopishiwe noma angcolile

Ukuhlasela okuningi kuzama ukukopisha noma ukulingisa amathuluzi esistimu ye-Windows (njenge-cmd.exe, i-powershell.exe, i-regsvr32.exe, njll.) ukuze kuhlanganiswe nezinqubo ezisemthethweni. Lo mthetho uvimba ukwenziwa kwezenzo eziqanjwe njengamakhophi noma abakhohlisi bala mathuluzi.

I-GUID yakho c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb futhi ikhiqiza izehlakalo ezifana AsrAbusedSystemToolBlockedIhambisana kahle namanye amasu okulawula uhlelo lokusebenza.

Vimba ukudalwa kwe-WebShell kumaseva

Ama-WebShell ayizikripthi eziklanyelwe ngqo ukunikeza umhlaseli ukulawula okukude phezu kweseva , okubavumela ukuthi bakhiphe imiyalo, balayishe amafayela, bakhiphe idatha, nokuningi. Lo mthetho, ohlose amaseva nezindima ezifana ne-Exchange, uvimba ukudalwa kwalezi zikripthi ezinonya.

I-GUID iyi- a8f5898e-1dc8-49a9-9878-85004b8a61e6 futhi ihloselwe ngqo ukuqinisa amaseva avele obala.

Vimba izingcingo ze-Win32 API ezivela kumamakhro we-Office

Mhlawumbe omunye wemithetho ephumelela kakhulu yokulwa ne-malware ye-macro . Ivimba ikhodi ye-Office VBA ekungeniseni nasekubizeni ama-Win32 API, avame ukusetshenziswa ukulayisha i-shellcode kwimemori, ukuphatha izinqubo, ukufinyelela imemori, njll.

I-GUID yayo ingu- 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b futhi ithembele ku-AMSI. Empeleni, isusa amathempulethi amaningi e-malware ku-Word naku-Excel athembele kulezi zingcingo ukuze asebenzise ikhodi engadingekile.

Ukusetshenziswa kokuvikelwa kwe-ransomware okuthuthukisiwe

Lo mthetho unezela isendlalelo esengeziwe sokuvikelwa ngokusekelwe ku -heuristics yamakhasimende kanye ne-cloud ukuthola ukuziphatha okufana ne-ransomware. Ucabangela izici ezifana nedumela, isiginesha yedijithali, kanye nokusabalala ukuze kunqunywe ukuthi ifayela lingaba yi-ransomware yini kunohlelo olusemthethweni.

I-GUID yayo ingu- c1db55ab-c21a-4637-bb3f-a12568109d35 , futhi yize izama ukunciphisa imiphumela engamanga, ivame ukwenza iphutha ukuze ingaphuthelwa yi-cipher yangempela.

Izindlela zokumisa: Intune, MDM, Configuration Manager, GPO, kanye nePowerShell

Imithetho yokunciphisa ubuso bokuhlasela ingalungiselelwa ngezindlela eziningana kuye ngokuthi uphatha kanjani inqwaba yamadivayisi akho. Isincomo esijwayelekile seMicrosoft ukusebenzisa amapulatifomu okuphatha ezingeni lebhizinisi (i-Intune noma i-Configuration Manager), njengoba izinqubomgomo zabo zithatha indawo ye-Group Policy Objects (GPOs) noma ukulungiselelwa kwe-PowerShell yendawo lapho uhlelo luqala.

I-Microsoft Intune inikeza izindlela ezintathu: inqubomgomo yokuphepha ye-endpoint ethize ye-ASR, amaphrofayili okucushwa kwedivayisi (Ukuvikelwa Kwe-Endpoint), kanye namaphrofayili enziwe ngokwezifiso asebenzisa i-OMA-URI ukuchaza imithetho nge-GUID kanye nesimo. Kuzo zonke izimo, ungangeza okukhishwe kufayela nefolda ngqo noma ukungenise kusuka kufayela le-CSV.

Ezimweni ama-MDM ajwayelekile I-CSP isetshenziswa ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules Ukuze uchaze uhlu lwama-GUID anezimo, ahlukaniswe amabha aqondile. Isibonelo, ungahlanganisa imithetho embalwa ngokunikeza u-0, 1, 2, noma 6 kuye ngokuthi uyafuna ukukhubaza, ukuvimba, ukuhlola, noma ukuxwayisa. Okungafakiwe kulawulwa ne-CSP. ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions.

Nge- Microsoft Configuration Manager ungakha izinqubomgomo ze- Windows Defender Exploit Guard ezihloselwe "ukuhlasela ukuncishiswa kwendawo", khetha ukuthi yimiphi imithetho ofuna ukuyivimba noma ukuyihlola, bese uyithumela emaqoqweni athile amadivayisi.

Inqubomgomo Yeqembu ikuvumela ukuthi ulungiselele i-ASR ngamathempulethi okuphatha ngokuzulazula uye kuma-node e-Microsoft Defender Antivirus kanye ne-"Attack Surface Reduction". Lapho, unika amandla inqubomgomo ethi "Lungisa imithetho yokunciphisa ubuso bokuhlasela" bese ufaka ama-GUID ngesimo sawo esihambisanayo. I-GPO eyengeziwe ikuvumela ukuthi uchaze ukukhishwa kwefayela kanye nendlela.

Ekugcineni, I-PowerShell Kuyindlela eqondile nelusizo kakhulu yokuhlolwa okukodwa noma izikripthi ezizenzakalelayo. Cmdlets like Set-MpPreference y Add-MpPreference Zikuvumela ukuthi unike amandla, uhlole, uxwayise, noma ukhubaze imithetho ngayinye, futhi uphathe uhlu lokukhishwa nge -AttackSurfaceReductionOnlyExclusionsNokho, uma kukhona i-GPO noma i-Intune ehilelekile, izilungiselelo zabo ziza kuqala.

Okungafakwanga, ukungqubuzana kwenqubomgomo, nezaziso

Cishe yonke imithetho ye-ASR ikuvumela ukuthi ukhiphe amafayela namafolda ukuze ugweme ukuvimba izinhlelo zokusebenza ezisemthethweni ezibonisa ukuziphatha okufana ne-malware, ngokuklama. Iyithuluzi elinamandla, kodwa okumele lisetshenziswe ngokunemba kokuhlinzwa: ukukhishwa okubanzi kakhulu kungashiya ubuthakathaka obukhulu.

Uma kusetshenziswa izinqubomgomo ezingqubuzanayo ezivela ku-MDM kanye ne-Intune, ukulungiselelwa kweNqubomgomo Yeqembu kuqala uma kukhona. Ngaphezu kwalokho, imithetho ye-ASR isekela ukuhlanganiswa kwenqubomgomo: kudalwa i-superset kusetshenziswa izilungiselelo ezingangqubuzani, futhi okufakiwe okungqubuzanayo akunakwa kuleyo divayisi.

Isikhathi ngasinye lapho umthetho uqaliswa kumodi yokuvimba, umsebenzisi ubona isaziso sesistimu esichaza ukuthi umsebenzi uvinjelwe ngezizathu zokuphepha. Lezi zaziso zingenziwa ngezifiso ngemininingwane yenkampani kanye nolwazi lokuxhumana. Kweminye imithetho kanye nezifundazwe, izexwayiso ze-EDR kanye nezaziso zangaphakathi nazo ziyakhiqizwa futhi zibonakala ku-portal ye-Microsoft Defender.

Akuyona yonke imithetho ehlonipha ukukhishwa kwe-antivirus ye-Microsoft Defender noma izinkomba zokuyekethisa (ama-IOC) ezilungiselelwe ku-Defender for Endpoint. Isibonelo, umthetho wokuvimba ukwebiwa kwemininingwane ye-LSASS noma umthetho wokuvimbela ukufakwa kwekhodi ye-Office awacabangi ama-IOC athile, ukuze alondoloze ukuqina kwawo.

Ukuqapha Umcimbi we-ASR: Iphothali, Usesho Oluthuthukile, kanye nesibukeli somcimbi

Ukuqapha kubalulekile ekuqinisekiseni ukuthi i-ASR ayilona ibhokisi elimnyama. I-Defender for Endpoint inikeza imibiko eningiliziwe yemicimbi namabhulokhi ahlobene nemithetho ye-ASR, engabukwa kokubili ku-portal ye-Microsoft Defender XDR kanye nokusesha okuthuthukisiwe.

Ukusesha okuthuthukisiwe kukuvumela ukuthi uqalise imibuzo mayelana netafula DeviceEventsukuhlunga ngezinhlobo zesenzo eziqala ngokuthi "Asr". Isibonelo, umbuzo oyisisekelo DeviceEvents | where ActionType startswith 'Asr' Ikubonisa imicimbi ehlobene ne-ASR eqoqwe ngenqubo nangehora, njengoba ijwayela esimweni esisodwa ngehora ukuze kwehliswe ivolumu.

Ezindaweni ezingenayo i-E5 noma ukufinyelela kulawa makhono, kuhlale kukhona inketho yokubuyekeza amalogi e-Windows ku-Event Viewer . I-Microsoft inikeza imibono eyenziwe ngokwezifiso (njengefayela le-cfa-events.xml) elihlunga imicimbi efanele, ngezihlonzi ezifana no-5007 (izinguquko zokucushwa), u-1121 (umthetho kwimodi yokuvimba), kanye no-1122 (umthetho kwimodi yokuhlola).

Ngokusetshenziswa kwe-hybrid, kuvamile kakhulu ukudlulisela le micimbi ku- SIEM noma ipulatifomu yokungena ehlanganisiwe , ukuyihlanganisa nezinye izinkomba, futhi kuqalise izexwayiso ezenziwe ngokwezifiso lapho imithetho ethile iqala ukukhiqiza imicimbi eminingi kakhulu engxenyeni ethile yenethiwekhi.

Ukunciphisa indawo yokuhlasela ngale kwe-ASR: amasu, ubuchwepheshe nezinselele

Nakuba imithetho ye-ASR iyisici esibalulekile, ukunciphisa indawo yokuhlasela njengesu eliphelele kudlulela ngale kwephuzu lokugcina. Kuhilela ukumaka zonke izimpahla nezindawo zokungena , ukususa izinsizakalo ezingadingekile, ukuhlukanisa amanethiwekhi, ukusebenzisa izilawuli zokufinyelela eziqinile, ukuqinisa izinhlelo, ukugcina ukucushwa okuphephile, nokuvikela ifu nama-API.

Izinhlangano ngokuvamile ziqala ngohlu oluphelele lwamadivayisi , isofthiwe, ama-akhawunti, kanye nokuxhumeka . Okulandelayo, zihlonza izinsizakalo nezinhlelo zokusebenza ezingasetshenziswanga, zizikhiphe, zivale amachweba enethiwekhi, futhi zikhubaze izici ezingangezi inani. Lokhu kwenza indawo ibe lula futhi kunciphisa inani "leminyango" edinga ukubhekwa.

Isici sokulawula ukufinyelela sibalulekile: ukusetshenziswa kwesimiso samalungelo aphansi, amaphasiwedi aqinile, ukuqinisekiswa kwezinto eziningi, ukuhoxiswa okusheshayo kokufinyelela lapho othile eshintsha izindima noma eshiya inhlangano, kanye nokuqapha imizamo yokungena esolisayo.

Efwini, indawo yokuhlasela ikhula ngesevisi ngayinye entsha, i-API, noma ukuhlanganiswa. Ukungalungiselelwa kahle kwesitoreji , izindima ezibanzi kakhulu, ama-akhawunti ayizintandane, kanye nokuzenzakalelayo okungavikelekile kuyizinkinga ezivamile. Yilapho ukuhlolwa kokucushwa okuvamile, ukubethela idatha ekuphumuleni nasekuhambeni, ukuhlukaniswa kwenethiwekhi ebonakalayo, kanye nokubuyekezwa kwemvume okuqhubekayo kudlala khona indima.

Ukuze kusekelwe konke lokhu, kusetshenziswa ubuchwepheshe obufana namathuluzi okuthola izimpahla kanye nokumaka, izikena zobuthakathaka, izinhlelo zokulawula ukufinyelela, amapulatifomu okuphatha ukucushwa, kanye namathuluzi okuphepha kwenethiwekhi (izicishamlilo, i-IDS/IPS, i-NDR, njll.). Izixazululo ezifana ne-SentinelOne, isibonelo, zihlanganisa ukuvikelwa kwe-endpoint, ukuhlaziywa kokuziphatha, kanye nempendulo ezenzakalelayo ukuze kuncishiswe indawo yokuhlasela ephumelelayo.

Izinselele ziningi: ukuncika kohlelo okuyinkimbinkimbi , izinhlelo zokusebenza ezindala ezingasekeli izindlela zesimanje, ijubane elisheshayo lokushintsha kobuchwepheshe, ukulinganiselwa kwezinsizakusebenza, kanye nokungqubuzana okukhona njalo phakathi kokuphepha nokukhiqiza. Ukuthola ibhalansi efanele kudinga ukuqonda okujulile kwebhizinisi nokubeka phambili izimpahla nezinqubo ezibalulekile.

Ngenxa yalesi simo, imithetho ye-ASR iba ngelinye lamathuluzi asebenza kahle kakhulu okunciphisa inkundla yokudlala yomhlaseli ekugcineni. Uma ihlelwe kahle (kuqala ngokuhlola), ilungiswe kahle ngezinto ezikhishwe ngokunembile, futhi iqashwe ngokucophelela, ivimbela iphutha lomsebenzisi, ukuxhashazwa okukodwa, noma idrayivu ye-USB enonya ukuthi ingakhuli ngokuzenzakalelayo ibe yisigameko esibucayi, okusiza ukugcina indawo encane, elawuleka kalula, futhi, ngaphezu kwakho konke, indawo yokuhlasela enzima kakhulu ukuyisebenzisa.