{"id":21744,"date":"2026-09-12T10:43:02","date_gmt":"2026-09-12T07:13:02","guid":{"rendered":"https:\/\/maralhost.com\/kb\/docs\/security\/%d8%b4%d9%86%d8%a7%d8%b3%d8%a7%db%8c%db%8c-reverse-shell-%d8%af%d8%b1-%d9%88%db%8c%d9%86%d8%af%d9%88%d8%b2\/"},"modified":"2026-09-26T11:28:47","modified_gmt":"2026-09-26T07:58:47","slug":"win-revshell","status":"publish","type":"docs","link":"https:\/\/maralhost.com\/kb\/articles\/security\/win-revshell\/","title":{"rendered":"\u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Reverse Shell \u062f\u0631 \u0648\u06cc\u0646\u062f\u0648\u0632"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0642\u062f\u0645\u0647<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0631\u0648\u0634\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u067e\u0633 \u0627\u0632 \u0646\u0641\u0648\u0630 \u0628\u0647 Windows Server \u06cc\u0627 Windows Client \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u0648\u062f\u060c \u0627\u06cc\u062c\u0627\u062f <strong>Reverse Shell<\/strong> \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u06cc\u06a9 \u0627\u062a\u0635\u0627\u0644 \u0639\u0627\u062f\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc\u060c \u0645\u062f\u06cc\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0627\u0632 \u0633\u06cc\u0633\u062a\u0645 \u062e\u0648\u062f \u0628\u0647 Server \u0645\u062a\u0635\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Administrator\n      |\n      v\nWindows Server<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 \u062f\u0631 Reverse Shell \u062c\u0647\u062a \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0631\u0639\u06a9\u0633 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u06cc\u0633\u062a\u0645 \u0622\u0644\u0648\u062f\u0647 \u062e\u0648\u062f\u0634 \u06cc\u06a9 Connection \u062e\u0631\u0648\u062c\u06cc \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u062f\u06cc\u06af\u0631\u06cc \u0628\u0631\u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0647\u0645\u0627\u0646 \u0627\u0631\u062a\u0628\u0627\u0637 \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc Command \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0647\u0645\u06cc\u0646 \u062f\u0644\u06cc\u0644 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0647\u06cc\u0686 \u067e\u0648\u0631\u062a Listener \u0645\u0634\u06a9\u0648\u06a9\u06cc \u0631\u0648\u06cc Server \u0648\u062c\u0648\u062f \u0646\u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/li>\n\n\n\n<li>\u0647\u06cc\u0686 RDP Session \u062c\u062f\u06cc\u062f\u06cc \u062f\u06cc\u062f\u0647 \u0646\u0634\u0648\u062f.<\/li>\n\n\n\n<li>Firewall \u0648\u0631\u0648\u062f\u06cc Connection \u062e\u0627\u0635\u06cc \u062b\u0628\u062a \u0646\u06a9\u0631\u062f\u0647 \u0628\u0627\u0634\u062f.<\/li>\n\n\n\n<li>\u0627\u0645\u0627 \u06cc\u06a9 Process \u0631\u0648\u06cc Server \u0628\u0647 IP \u062e\u0627\u0631\u062c\u06cc \u0645\u062a\u0635\u0644 \u0634\u062f\u0647 \u0628\u0627\u0634\u062f.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647 \u0631\u0648\u0634\u200c\u0647\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Reverse Shell \u062f\u0631 Windows \u0631\u0627 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 <strong>PowerShell\u060c netstat\u060c Task Manager\u060c Event Log\u060c Sysmon \u0648 Windows Firewall Log<\/strong> \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u06a9\u0646\u06cc\u0645.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">\u0647\u062f\u0641 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0648 \u067e\u0627\u0633\u062e \u0628\u0647 \u0641\u0639\u0627\u0644\u06cc\u062a \u0645\u0634\u06a9\u0648\u06a9 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u062a\u062d\u062a \u0645\u062f\u06cc\u0631\u06cc\u062a \u062e\u0648\u062f\u062a\u0627\u0646 \u0627\u0633\u062a \u0648 \u0634\u0627\u0645\u0644 \u0622\u0645\u0648\u0632\u0634 \u0633\u0627\u062e\u062a \u06cc\u0627 \u0627\u062c\u0631\u0627\u06cc Reverse Shell \u0646\u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Reverse Shell \u0686\u06cc\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u06cc\u06a9 \u0627\u0631\u062a\u0628\u0627\u0637 \u0639\u0627\u062f\u06cc Client \u0628\u0647 Server \u0645\u062a\u0635\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Client\n   |\n   v\nServer:3389<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Reverse Shell \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0633\u06cc\u0633\u062a\u0645 \u0645\u0642\u0635\u062f \u062e\u0648\u062f\u0634 \u06cc\u06a9 Connection \u062e\u0631\u0648\u062c\u06cc \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Compromised Windows Server\n            |\n            | Outbound Connection\n            v\n       Remote System<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633 \u06cc\u06a9 Process \u0645\u0627\u0646\u0646\u062f Command Interpreter \u06cc\u0627 Script Engine \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f Input \u0648 Output \u062e\u0648\u062f \u0631\u0627 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0647\u0645\u06cc\u0646 Connection \u062f\u0631\u06cc\u0627\u0641\u062a \u0648 \u0627\u0631\u0633\u0627\u0644 \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u06cc\u0646 \u0631\u0641\u062a\u0627\u0631 \u0628\u0627\u0639\u062b \u0645\u06cc\u200c\u0634\u0648\u062f Reverse Shell \u062f\u0631 \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 \u0645\u0648\u0627\u0631\u062f \u0634\u0628\u06cc\u0647 \u06cc\u06a9 Connection \u062e\u0631\u0648\u062c\u06cc \u0639\u0627\u062f\u06cc \u062f\u06cc\u062f\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Reverse Shell \u062f\u0634\u0648\u0627\u0631 \u0627\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Windows Server \u0628\u0647\u200c\u0637\u0648\u0631 \u0637\u0628\u06cc\u0639\u06cc Connection\u0647\u0627\u06cc \u062e\u0631\u0648\u062c\u06cc \u0632\u06cc\u0627\u062f\u06cc \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>DNS\nWindows Update\nMonitoring\nBackup\nSMTP\nDatabase\nAPI\nCloud Services\nActive Directory\nAntivirus<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0645\u0634\u0627\u0647\u062f\u0647 \u06cc\u06a9 Connection \u062e\u0627\u0631\u062c\u06cc \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0628\u0647 \u0645\u0639\u0646\u06cc Reverse Shell \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0627\u06cc\u062f \u0686\u0646\u062f Evidence \u0631\u0627 \u06a9\u0646\u0627\u0631 \u0647\u0645 \u0642\u0631\u0627\u0631 \u062f\u0647\u06cc\u0645:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Network Connection\n        +\nOwning Process\n        +\nParent Process\n        +\nCommand Line\n        +\nUser\n        +\nEvent Logs<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0631\u0686\u0647 \u0627\u06cc\u0646 \u0646\u0634\u0627\u0646\u0647\u200c\u0647\u0627 \u0628\u06cc\u0634\u062a\u0631 \u0628\u0627 \u06cc\u06a9\u062f\u06cc\u06af\u0631 \u0647\u0645\u200c\u062e\u0648\u0627\u0646\u06cc \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u0646\u062f\u060c \u0627\u062d\u062a\u0645\u0627\u0644 Incident \u0628\u06cc\u0634\u062a\u0631 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0648\u0644\u06cc\u0646 \u0645\u0631\u062d\u0644\u0647: \u0628\u0631\u0631\u0633\u06cc Connection\u0647\u0627\u06cc \u0641\u0639\u0627\u0644<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 PowerShell \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0627\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetTCPConnection<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 Cmdlet \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>LocalAddress\nLocalPort\nRemoteAddress\nRemotePort\nState\nOwningProcess<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0646\u0645\u0627\u06cc\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f. Microsoft \u0646\u06cc\u0632 <code>Get-NetTCPConnection<\/code> \u0631\u0627 \u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 TCP Connection\u0647\u0627 \u0648 PID \u0645\u0627\u0644\u06a9 Connection \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0641\u0642\u0637 Connection\u0647\u0627\u06cc Established \u0631\u0627 \u0646\u0645\u0627\u06cc\u0634 \u062f\u0647\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u062a\u0645\u0631\u06a9\u0632 \u0631\u0648\u06cc Connection\u0647\u0627\u06cc \u0641\u0639\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetTCPConnection -State Established<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0645\u0648\u0646\u0647 \u062e\u0631\u0648\u062c\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>LocalAddress LocalPort RemoteAddress   RemotePort State        OwningProcess\n------------ --------- -------------   ---------- -----        -------------\n10.10.10.20  49722     203.0.113.50    8443       Established  6240<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0627\u06cc\u0646 \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Local Port:\n49722<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>Remote IP:\n203.0.113.50<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>Remote Port:\n8443<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PID:\n6240<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u0631\u0627\u06cc \u0627\u062f\u0627\u0645\u0647 Investigation \u0647\u0645\u0627\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>OwningProcess<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0646\u0645\u0627\u06cc\u0634 Connection\u0647\u0627 \u0628\u0647 \u0647\u0645\u0631\u0627\u0647 \u0646\u0627\u0645 Process<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0627\u06cc\u0646\u06a9\u0647 \u0645\u062c\u0628\u0648\u0631 \u0646\u0628\u0627\u0634\u06cc\u0645 \u0647\u0631 PID \u0631\u0627 \u062c\u062f\u0627\u06af\u0627\u0646\u0647 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetTCPConnection -State Established |\nSelect-Object LocalAddress,\n              LocalPort,\n              RemoteAddress,\n              RemotePort,\n              State,\n              OwningProcess,\n              @{Name=\"ProcessName\";Expression={\n                  (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName\n              }}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06a9\u0646\u0648\u0646 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0646\u062a\u06cc\u062c\u0647\u200c\u0627\u06cc \u0645\u0627\u0646\u0646\u062f \u0632\u06cc\u0631 \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>RemoteAddress   RemotePort   ProcessName   OwningProcess\n-------------   ----------   -----------   -------------\n203.0.113.50    8443         powershell    6240\n198.51.100.25   443          chrome        7712<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f Connection \u062e\u0627\u0631\u062c\u06cc \u0628\u0631\u0627\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>powershell<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0644\u0632\u0648\u0645\u0627\u064b \u0645\u062e\u0631\u0628 \u0646\u06cc\u0633\u062a\u060c \u0627\u0645\u0627 \u0628\u0627\u06cc\u062f \u0645\u0634\u062e\u0635 \u0634\u0648\u062f \u0686\u0631\u0627 PowerShell \u0686\u0646\u06cc\u0646 Connection\u06cc \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u0647 Process\u0647\u0627\u06cc\u06cc \u0628\u06cc\u0634\u062a\u0631 \u0646\u06cc\u0627\u0632\u0645\u0646\u062f \u0628\u0631\u0631\u0633\u06cc \u0647\u0633\u062a\u0646\u062f\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Process\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0627\u06af\u0631 Connection \u062e\u0627\u0631\u062c\u06cc \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647 \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u0646\u062f \u0627\u0631\u0632\u0634 \u0628\u0631\u0631\u0633\u06cc \u0628\u06cc\u0634\u062a\u0631\u06cc \u062f\u0627\u0631\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>powershell.exe\npwsh.exe\ncmd.exe\nwscript.exe\ncscript.exe\nmshta.exe\nrundll32.exe\nregsvr32.exe<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">\u0646\u0627\u0645 Process \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0627\u062b\u0628\u0627\u062a \u0641\u0639\u0627\u0644\u06cc\u062a \u0645\u062e\u0631\u0628 \u0646\u06cc\u0633\u062a.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0631 \u06a9\u062f\u0627\u0645 \u0627\u0632 \u0627\u06cc\u0646 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627 \u06a9\u0627\u0631\u0628\u0631\u062f\u0647\u0627\u06cc \u0642\u0627\u0646\u0648\u0646\u06cc \u0646\u06cc\u0632 \u062f\u0627\u0631\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0622\u0646\u0686\u0647 \u0627\u0647\u0645\u06cc\u062a \u062f\u0627\u0631\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Process\n+\nCommand Line\n+\nParent\n+\nDestination<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Connection \u0628\u0627 netstat<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u0634 \u06a9\u0644\u0627\u0633\u06cc\u06a9 Windows:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>netstat -ano<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06af\u0632\u06cc\u0646\u0647\u200c\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-a = \u062a\u0645\u0627\u0645 Connection\u0647\u0627 \u0648 Listener\u0647\u0627\n-n = \u0646\u0645\u0627\u06cc\u0634 IP \u0648 Port \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0639\u062f\u062f\u06cc\n-o = \u0646\u0645\u0627\u06cc\u0634 PID<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft \u0646\u06cc\u0632 \u0628\u0631\u0627\u06cc Troubleshooting \u0634\u0628\u06a9\u0647 \u0627\u0632 <code>netstat<\/code> \u0648 PID \u0628\u0631\u0627\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Process \u0645\u0627\u0644\u06a9 Connection \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Connection\u0647\u0627\u06cc Established:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>netstat -ano | findstr ESTABLISHED<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0645\u0648\u0646\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>TCP    10.10.10.20:49722    203.0.113.50:8443    ESTABLISHED    6240<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06a9\u0646\u0648\u0646 PID:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>6240<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Process \u0627\u0632 \u0631\u0648\u06cc PID<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 CMD:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tasklist \/FI \"PID eq 6240\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0645\u0648\u0646\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Image Name                     PID Session Name\n========================= ======== ================\npowershell.exe                6240 Console<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 PowerShell:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Process -Id 6240<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0645\u0631\u062d\u0644\u0647 \u0641\u0642\u0637 \u0646\u0627\u0645 Process \u0631\u0627 \u0645\u0634\u062e\u0635 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Investigation \u0648\u0627\u0642\u0639\u06cc \u0628\u0627\u06cc\u062f \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631\u06cc \u0628\u06af\u06cc\u0631\u06cc\u0645.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Command Line Process<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0645\u0631\u0627\u062d\u0644 \u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_Process -Filter \"ProcessId = 6240\" |\nSelect-Object ProcessId,\n              ParentProcessId,\n              Name,\n              ExecutablePath,\n              CommandLine<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062e\u0631\u0648\u062c\u06cc \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0686\u06cc\u0632\u06cc \u0634\u0628\u06cc\u0647 \u0632\u06cc\u0631 \u0628\u0627\u0634\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ProcessId       : 6240\nParentProcessId : 4852\nName            : powershell.exe\nExecutablePath  : C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\nCommandLine     : powershell.exe ...<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0627\u06cc\u0646 \u0645\u0631\u062d\u0644\u0647 \u0628\u0647\u200c\u062e\u0635\u0648\u0635 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0645\u0647\u0645\u200c\u0627\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ParentProcessId\nExecutablePath\nCommandLine<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u0631\u0627 Parent Process \u0627\u0647\u0645\u06cc\u062a \u062f\u0627\u0631\u062f\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u062f Process \u0645\u0648\u0631\u062f\u0646\u0638\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>powershell.exe<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Parent \u0622\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>explorer.exe<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0634\u062f\u060c \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Administrator \u0627\u0632 Desktop \u0622\u0646 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0631\u062f\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Parent:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>services.exe<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0634\u062f\u060c \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u062a\u0648\u0633\u0637 Service \u0627\u062c\u0631\u0627 \u0634\u062f\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Parent \u0686\u06cc\u0632\u06cc \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647 \u0645\u0627\u0646\u0646\u062f \u06cc\u06a9 Web Server Process \u06cc\u0627 Script Host \u0628\u0627\u0634\u062f\u060c Investigation \u0627\u0647\u0645\u06cc\u062a \u0628\u06cc\u0634\u062a\u0631\u06cc \u067e\u06cc\u062f\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 Parent Process<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ParentProcessId = 4852<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0634\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_Process -Filter \"ProcessId = 4852\" |\nSelect-Object ProcessId,\n              ParentProcessId,\n              Name,\n              ExecutablePath,\n              CommandLine<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06a9\u0646\u0648\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 Process Tree \u0627\u0648\u0644\u06cc\u0647 \u0631\u0627 \u0633\u0627\u062e\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Parent Process\n      |\n      v\npowershell.exe\n      |\n      v\nExternal Connection<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u06cc\u06a9 \u0645\u062b\u0627\u0644 \u0645\u0634\u06a9\u0648\u06a9<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u062f Connection \u0632\u06cc\u0631 \u0645\u0634\u0627\u0647\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>powershell.exe\n      |\n      v\n203.0.113.50:8443<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 Parent \u0622\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>w3wp.exe<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>w3wp.exe<\/code> \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 IIS Worker Process \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u0627\u062e\u062a\u0627\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>w3wp.exe\n   |\n   v\npowershell.exe\n   |\n   v\nExternal IP<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 Web Server\u0647\u0627 \u0631\u0641\u062a\u0627\u0631 \u0645\u0639\u0645\u0648\u0644\u06cc \u0645\u062d\u0633\u0648\u0628 \u0646\u0645\u06cc\u200c\u0634\u0648\u062f \u0648 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f \u06a9\u0647 \u0622\u06cc\u0627 Web Application \u0639\u0645\u062f\u0627\u064b PowerShell \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f \u06cc\u0627 \u062e\u06cc\u0631.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Task Manager<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0633\u0631\u06cc\u0639 GUI:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Ctrl + Shift + Esc<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Task Manager \u0631\u0627 \u0628\u0627\u0632 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Details<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u062a\u0648\u0646\u200c\u0647\u0627\u06cc \u0632\u06cc\u0631 \u0645\u0641\u06cc\u062f \u0647\u0633\u062a\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PID\nUser name\nCommand line<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Command Line \u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0646\u0645\u06cc\u200c\u0634\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Right Click \u0631\u0648\u06cc Header\n\u2192 Select Columns\n\u2192 Command line<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0641\u0639\u0627\u0644 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Investigation\u0647\u0627\u06cc \u0633\u0631\u06cc\u0639\u060c Task Manager \u0645\u0641\u06cc\u062f \u0627\u0633\u062a\u061b \u0627\u0645\u0627 PowerShell \u0648 Event Log \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062f\u0642\u06cc\u0642\u200c\u062a\u0631\u06cc \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Process Explorer<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0639\u0645\u06cc\u0642\u200c\u062a\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0627\u0632 \u0627\u0628\u0632\u0627\u0631 \u0631\u0633\u0645\u06cc Microsoft Sysinternals:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Process Explorer<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631 Process Tree\u060c Parent Process\u060c Command Line\u060c User\u060c Handle \u0648 \u0633\u0627\u06cc\u0631 \u0627\u0637\u0644\u0627\u0639\u0627\u062a Process \u0631\u0627 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u06af\u0631\u0627\u0641\u06cc\u06a9\u06cc \u0646\u0645\u0627\u06cc\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0628\u0631\u0631\u0633\u06cc Process\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9\u060c \u0645\u0634\u0627\u0647\u062f\u0647 Parent\/Child Relationship \u0628\u0633\u06cc\u0627\u0631 \u0645\u0647\u0645 \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0634\u0645\u0627\u0631\u0647 Port \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0645\u0639\u06cc\u0627\u0631 \u0646\u06cc\u0633\u062a<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0627\u0634\u062a\u0628\u0627\u0647\u0627\u062a \u0645\u062a\u062f\u0627\u0648\u0644 \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 \u0641\u0642\u0637 Port\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4444\n5555\n9001\n1337<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0645\u0634\u06a9\u0648\u06a9 \u0628\u062f\u0627\u0646\u06cc\u0645.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Reverse Shell \u06cc\u0627 \u0647\u0631 Connection \u0645\u062e\u0631\u0628 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0632 Port\u0647\u0627\u06cc \u0639\u0627\u062f\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>80\n443\n53<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u06cc\u0632 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0632 \u0637\u0631\u0641 \u062f\u06cc\u06af\u0631 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u06cc\u06a9 Application \u0642\u0627\u0646\u0648\u0646\u06cc \u0631\u0648\u06cc Port \u063a\u06cc\u0631\u0645\u0639\u0645\u0648\u0644 \u06a9\u0627\u0631 \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Port Number<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0645\u0639\u06cc\u0627\u0631 \u0645\u0646\u0627\u0633\u0628\u06cc \u0628\u0631\u0627\u06cc Detection \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Remote IP \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u0642\u062a\u06cc Connection \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647 \u067e\u06cc\u062f\u0627 \u0634\u062f\u060c \u0645\u0634\u062e\u0635 \u06a9\u0646\u06cc\u062f Destination \u0686\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u0624\u0627\u0644\u0627\u062a \u0645\u0647\u0645:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>IP \u0645\u062a\u0639\u0644\u0642 \u0628\u0647 Microsoft \u0627\u0633\u062a\u061f<\/li>\n\n\n\n<li>Monitoring Provider \u0627\u0633\u062a\u061f<\/li>\n\n\n\n<li>Backup Service \u0627\u0633\u062a\u061f<\/li>\n\n\n\n<li>Cloud Platform \u0627\u0633\u062a\u061f<\/li>\n\n\n\n<li>API \u0631\u0633\u0645\u06cc Application \u0627\u0633\u062a\u061f<\/li>\n\n\n\n<li>CDN \u0627\u0633\u062a\u061f<\/li>\n\n\n\n<li>\u06cc\u0627 \u0647\u06cc\u0686 \u0627\u0631\u062a\u0628\u0627\u0637\u06cc \u0628\u0627 \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc \u0634\u0646\u0627\u062e\u062a\u0647\u200c\u0634\u062f\u0647 \u0646\u062f\u0627\u0631\u062f\u061f<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Server\u0647\u0627\u06cc Production \u0628\u0647\u062a\u0631 \u0627\u0633\u062a Baseline \u0645\u0634\u062e\u0635\u06cc \u0627\u0632 Connection\u0647\u0627\u06cc \u062e\u0631\u0648\u062c\u06cc \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u06cc\u062c\u0627\u062f Baseline \u0628\u0631\u0627\u06cc Connection\u0647\u0627\u06cc \u062e\u0631\u0648\u062c\u06cc<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u06cc\u06a9 Server \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u062f\u0631 \u062d\u0627\u0644\u062a \u0639\u0627\u062f\u06cc \u0641\u0642\u0637 \u0628\u0647 \u0627\u06cc\u0646 Destination\u0647\u0627 \u0645\u062a\u0635\u0644 \u0634\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>DNS\nActive Directory\nBackup Server\nMonitoring\nMicrosoft Update\nApproved APIs<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0646\u0627\u06af\u0647\u0627\u0646 Process \u062c\u062f\u06cc\u062f\u06cc \u0628\u0647 Destination \u062f\u06cc\u06af\u0631\u06cc \u0645\u062a\u0635\u0644 \u0634\u0648\u062f\u060c \u0628\u0631\u0631\u0633\u06cc \u0622\u0646 \u0633\u0627\u062f\u0647\u200c\u062a\u0631 \u062e\u0648\u0627\u0647\u062f \u0628\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u062a\u0645\u0627\u0645 Connection\u0647\u0627\u06cc \u06cc\u06a9 PID<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 PID \u0645\u0634\u06a9\u0648\u06a9:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>6240<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetTCPConnection -OwningProcess 6240<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0642\u0627\u0628\u0644\u06cc\u062a \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0631\u0633\u0645\u06cc \u062f\u0631 <code>Get-NetTCPConnection<\/code> \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0645\u0648\u0646\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>LocalPort    RemoteAddress    RemotePort    State\n---------    -------------    ----------    -----\n49722        203.0.113.50     8443          Established<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Process\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f\u06cc Connection \u062f\u0627\u0631\u0646\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u062a\u0639\u062f\u0627\u062f Connection\u0647\u0627 \u0628\u0631\u0627\u0633\u0627\u0633 Process:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetTCPConnection |\nGroup-Object OwningProcess |\nSort-Object Count -Descending |\nSelect-Object Count,\n              Name,\n              @{Name=\"Process\";Expression={\n                  (Get-Process -Id $_.Name -ErrorAction SilentlyContinue).ProcessName\n              }}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0631\u0648\u0634 \u0628\u0631\u0627\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Process\u0647\u0627\u06cc \u062f\u0627\u0631\u0627\u06cc Connection\u0647\u0627\u06cc \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc \u0645\u0641\u06cc\u062f \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Windows Security Event ID 4688<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 Event\u0647\u0627 \u0628\u0631\u0627\u06cc Investigation:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4688<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Event 4688 \u0647\u0646\u06af\u0627\u0645 \u0627\u06cc\u062c\u0627\u062f Process \u062c\u062f\u06cc\u062f \u062b\u0628\u062a \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0627\u0644\u0628\u062a\u0647 \u0628\u0627\u06cc\u062f Audit Process Creation \u0641\u0639\u0627\u0644 \u0628\u0627\u0634\u062f. Microsoft \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u0627\u06cc\u0646 Event \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0646\u0627\u0645 Process\u060c Parent Process \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0641\u0639\u0627\u0644 \u0628\u0648\u062f\u0646 Policy \u0645\u0631\u0628\u0648\u0637\u0647 Command Line \u0631\u0627 \u0646\u06cc\u0632 \u062b\u0628\u062a \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4688\n} -MaxEvents 100<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062c\u0633\u062a\u062c\u0648\u06cc PowerShell \u062f\u0631 Event 4688<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4688\n} |\nWhere-Object {\n    $_.Message -match 'powershell.exe|pwsh.exe'\n} |\nSelect-Object TimeCreated,Message<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0631\u0648\u0634 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0632\u0645\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc PowerShell \u0648 Process \u0627\u06cc\u062c\u0627\u062f\u06a9\u0646\u0646\u062f\u0647 \u0622\u0646 \u0631\u0627 \u0645\u0634\u062e\u0635 \u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u0631\u0627 Command Line \u062f\u0631 Event 4688 \u062e\u0627\u0644\u06cc \u0627\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647\u200c\u0635\u0648\u0631\u062a \u067e\u06cc\u0634\u200c\u0641\u0631\u0636 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Event 4688 \u0627\u06cc\u062c\u0627\u062f \u0634\u0648\u062f \u0627\u0645\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Process Command Line<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062e\u0627\u0644\u06cc \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u062b\u0628\u062a Command Line \u0628\u0627\u06cc\u062f Policy:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Include command line in process creation events<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0639\u0627\u0644 \u0634\u0648\u062f. Microsoft \u062a\u0623\u06a9\u06cc\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f \u0627\u06cc\u0646 \u0642\u0627\u0628\u0644\u06cc\u062a \u0628\u0647 Audit Process Creation \u0648\u0627\u0628\u0633\u062a\u0647 \u0627\u0633\u062a \u0648 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u067e\u06cc\u0634\u200c\u0641\u0631\u0636 \u0641\u0639\u0627\u0644 \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u06cc\u0631 Group Policy:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Computer Configuration\n  \u2192 Administrative Templates\n    \u2192 System\n      \u2192 Audit Process Creation\n        \u2192 Include command line in process creation events<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0647\u0634\u062f\u0627\u0631 \u062f\u0631\u0628\u0627\u0631\u0647 Command Line Logging<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Command Line \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0634\u0627\u0645\u0644 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062d\u0633\u0627\u0633 \u0628\u0627\u0634\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Password\nToken\nAPI Key\nConnection String<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft \u0646\u06cc\u0632 \u0647\u0634\u062f\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u0628\u0627 \u0641\u0639\u0627\u0644 \u06a9\u0631\u062f\u0646 Command Line Logging \u0627\u06cc\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0628\u0647\u200c\u0635\u0648\u0631\u062a Plain Text \u062f\u0627\u062e\u0644 Security Event Log \u062b\u0628\u062a \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 Security Log \u0628\u0627\u06cc\u062f \u0645\u062d\u062f\u0648\u062f \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc PowerShell Event ID 4104<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Activity \u0645\u0634\u06a9\u0648\u06a9 \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 PowerShell \u0628\u0627\u0634\u062f\u060c Event:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4104<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0647\u0645\u06cc\u062a \u0628\u0633\u06cc\u0627\u0631 \u0632\u06cc\u0627\u062f\u06cc \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0635\u0648\u0631\u062a \u0641\u0639\u0627\u0644 \u0628\u0648\u062f\u0646 <strong>Script Block Logging<\/strong>\u060c PowerShell \u0645\u062d\u062a\u0648\u0627\u06cc Script Block\u0647\u0627\u06cc\u06cc \u0631\u0627 \u06a9\u0647 \u067e\u0631\u062f\u0627\u0632\u0634 \u0645\u06cc\u200c\u06a9\u0646\u062f \u062f\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Microsoft-Windows-PowerShell\/Operational<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062b\u0628\u062a \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName='Microsoft-Windows-PowerShell\/Operational'\n    Id=4104\n} -MaxEvents 100<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062c\u0633\u062a\u062c\u0648\u06cc Script\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u06cc\u200c\u062a\u0648\u0627\u0646 Event\u0647\u0627 \u0631\u0627 \u0628\u0631\u0627\u0633\u0627\u0633 Keyword \u0628\u0631\u0631\u0633\u06cc \u06a9\u0631\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName='Microsoft-Windows-PowerShell\/Operational'\n    Id=4104\n} |\nWhere-Object {\n    $_.Message -match 'TcpClient|WebClient|Invoke-WebRequest|Net.Sockets'\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f \u0686\u0646\u06cc\u0646 Keyword\u0647\u0627\u06cc\u06cc \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0627\u062b\u0628\u0627\u062a Reverse Shell \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Script \u0642\u0627\u0646\u0648\u0646\u06cc \u0627\u0632 Network API \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u062f\u0641 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Event\u0647\u0627\u06cc\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0628\u0631\u0631\u0633\u06cc \u062f\u0642\u06cc\u0642\u200c\u062a\u0631 \u062f\u0627\u0631\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">PowerShell 7 \u0631\u0627 \u0641\u0631\u0627\u0645\u0648\u0634 \u0646\u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 PowerShell 7 \u0646\u0635\u0628 \u0628\u0627\u0634\u062f\u060c Log\u0647\u0627 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u062f\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PowerShellCore\/Operational<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062b\u0628\u062a \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Script Block Logging \u062f\u0631 PowerShell Core \u0646\u06cc\u0632 Event ID 4104 \u062a\u0648\u0644\u06cc\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -LogName \"PowerShellCore\/Operational\" -MaxEvents 100<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Sysmon<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Server\u0647\u0627\u06cc\u06cc \u06a9\u0647 Monitoring \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0647\u0645\u06cc\u062a \u062f\u0627\u0631\u062f\u060c <strong>Sysmon<\/strong> \u06cc\u06a9\u06cc \u0627\u0632 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u0645\u0647\u0645 Microsoft Sysinternals \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sysmon \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062f\u0642\u06cc\u0642\u06cc \u062f\u0631\u0628\u0627\u0631\u0647 Process \u0648 Network Activity \u062b\u0628\u062a \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0648 Event \u0628\u0633\u06cc\u0627\u0631 \u0645\u0647\u0645 \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0645\u0648\u0636\u0648\u0639:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Event ID 1\nProcess Creation<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Event ID 3\nNetwork Connection<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0633\u062a\u0646\u062f. Microsoft \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 Event 1 \u0627\u0637\u0644\u0627\u0639\u0627\u062a Process Creation \u0648 Command Line \u0631\u0627 \u062b\u0628\u062a \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 Event 3 \u0628\u0631\u0627\u06cc TCP\/UDP Connection\u0647\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 Sysmon Event ID 3<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0635\u0648\u0631\u062a \u0646\u0635\u0628 \u0648 Config \u0634\u062f\u0646 Sysmon:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName='Microsoft-Windows-Sysmon\/Operational'\n    Id=3\n} -MaxEvents 100<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 Event \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Image\nProcessId\nSourceIp\nSourcePort\nDestinationIp\nDestinationPort<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0631\u0627\u0626\u0647 \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u062f\u0627\u062f\u0647 \u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Connection \u062e\u0627\u0631\u062c\u06cc Process \u0628\u0633\u06cc\u0627\u0631 \u0627\u0631\u0632\u0634\u0645\u0646\u062f \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0631\u062a\u0628\u0627\u0637 Event ID 1 \u0648 Event ID 3<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0632\u06cc\u062a\u200c\u0647\u0627\u06cc Sysmon \u0648\u062c\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ProcessGuid<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u062f ProcessGUID \u0628\u0631\u0627\u06cc Correlation \u0631\u0648\u06cc\u062f\u0627\u062f\u0647\u0627\u06cc \u06cc\u06a9 Process \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Process Create\n     |\n     v\nNetwork Connection<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0628\u0627 \u062f\u0642\u062a \u0628\u06cc\u0634\u062a\u0631\u06cc \u0628\u0647 \u0647\u0645 \u0645\u0631\u062a\u0628\u0637 \u06a9\u0631\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u06cc\u06a9 \u0633\u0646\u0627\u0631\u06cc\u0648\u06cc Investigation \u0628\u0627 Sysmon<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u062f Event ID 3 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Image:\nC:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\n\nDestinationIp:\n203.0.113.50\n\nDestinationPort:\n8443<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633 Event ID 1 \u0647\u0645\u0627\u0646 Process \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u06a9\u0646\u06cc\u0645:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ParentImage:\nC:\\Windows\\System32\\inetsrv\\w3wp.exe<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06a9\u0646\u0648\u0646 \u0633\u0627\u062e\u062a\u0627\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>IIS Worker\n    |\n    v\nPowerShell\n    |\n    v\nExternal Connection<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0627\u0631\u06cc\u0645.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 Correlation \u0628\u0647\u200c\u0645\u0631\u0627\u062a\u0628 \u0645\u0647\u0645\u200c\u062a\u0631 \u0627\u0632 \u0645\u0634\u0627\u0647\u062f\u0647 \u0635\u0631\u0641 \u06cc\u06a9 Port \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Windows Firewall Log<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Windows Defender Firewall \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f Connection\u0647\u0627\u06cc Allowed \u0648 Dropped \u0631\u0627 Log \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u06cc\u0631 \u067e\u06cc\u0634\u200c\u0641\u0631\u0636 Log:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>%windir%\\system32\\logfiles\\firewall\\pfirewall.log<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a. Microsoft \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u062f\u0631 \u0635\u0648\u0631\u062a \u0646\u06cc\u0627\u0632 \u0628\u0647 \u062a\u062d\u0644\u06cc\u0644\u060c Logging \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Connection\u0647\u0627\u06cc \u0645\u062c\u0627\u0632 \u0648 Drop \u0634\u062f\u0647 \u0641\u0639\u0627\u0644 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Content `\n\"$env:windir\\System32\\LogFiles\\Firewall\\pfirewall.log\" `\n-Tail 100<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0622\u06cc\u0627 Firewall Log \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u067e\u06cc\u0634\u200c\u0641\u0631\u0636 \u06a9\u0627\u0645\u0644 \u0627\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062e\u06cc\u0631.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u062f Logging \u0628\u0627\u06cc\u062f \u0628\u0631\u0627\u06cc Profile\u0647\u0627\u06cc \u0645\u0648\u0631\u062f\u0646\u0638\u0631 Config \u0634\u0648\u062f \u0648 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u062b\u0628\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Allowed Connections\nDropped Packets<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0641\u0639\u0627\u0644 \u06a9\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Incident\u0647\u0627\u06cc \u0622\u06cc\u0646\u062f\u0647 \u0628\u0647\u062a\u0631 \u0627\u0633\u062a Logging \u0645\u062a\u0646\u0627\u0633\u0628 \u0628\u0627 \u0638\u0631\u0641\u06cc\u062a Server \u0627\u0632 \u0642\u0628\u0644 \u062a\u0646\u0638\u06cc\u0645 \u0634\u062f\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Scheduled Task\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0639\u062f \u0627\u0632 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Connection \u0645\u0634\u06a9\u0648\u06a9 \u0641\u0642\u0637 Process \u0641\u0639\u0644\u06cc \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Persistence \u0646\u06cc\u0632 \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Scheduled Task\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ScheduledTask<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 Cmdlet Task\u0647\u0627\u06cc \u062b\u0628\u062a\u200c\u0634\u062f\u0647 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0631\u0627 \u0646\u0645\u0627\u06cc\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u062e\u0631\u0648\u062c\u06cc \u06a9\u0627\u0631\u0628\u0631\u062f\u06cc\u200c\u062a\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ScheduledTask |\nSelect-Object TaskName,\n              TaskPath,\n              State,\n              @{Name='RunAs';Expression={$_.Principal.UserId}}<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Action \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Scheduled Task<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Command\u0647\u0627\u06cc\u06cc \u06a9\u0647 Task \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ScheduledTask |\nForEach-Object {\n    &#91;PSCustomObject]@{\n        TaskName = $_.TaskName\n        TaskPath = $_.TaskPath\n        Execute  = ($_.Actions.Execute -join ',')\n        Arguments = ($_.Actions.Arguments -join ',')\n    }\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Task\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0631\u0627 \u0628\u062f\u0648\u0646 \u062f\u0644\u06cc\u0644 \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>powershell.exe\npwsh.exe\ncmd.exe\nwscript.exe\nmshta.exe<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Windows Services<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Persistence \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0627\u0632 \u0637\u0631\u06cc\u0642 Service \u0627\u0646\u062c\u0627\u0645 \u0634\u062f\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Service\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_Service |\nSelect-Object Name,\n              State,\n              StartMode,\n              StartName,\n              PathName<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PathName<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062a\u0648\u062c\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Service\u0647\u0627\u06cc\u06cc \u06a9\u0647 Executable \u0622\u0646\u0647\u0627 \u0627\u0632 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\Users\\\nC:\\Temp\\\nC:\\ProgramData\\...<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0628\u0627\u06cc\u062f \u0628\u0627 Baseline \u0633\u06cc\u0633\u062a\u0645 \u0645\u0642\u0627\u06cc\u0633\u0647 \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Startup Folder<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Startup Folder \u06a9\u0627\u0631\u0628\u0631\u0627\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\Users\\&lt;User&gt;\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 Startup \u0639\u0645\u0648\u0645\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem `\n\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\" `\n-Force<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Run \u0648 RunOnce<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Audit \u062f\u0641\u0627\u0639\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 Registry Path\u0647\u0627\u06cc Startup \u0631\u0627 \u0628\u0647\u200c\u0635\u0648\u0631\u062a Read-only \u0628\u0631\u0631\u0633\u06cc \u06a9\u0631\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ItemProperty `\n\"HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ItemProperty `\n\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u0631\u0648\u062f\u06cc\u200c\u0647\u0627\u06cc \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc PowerShell History<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Process \u0645\u0634\u06a9\u0648\u06a9 \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 PowerShell \u0627\u0633\u062a\u060c History \u0646\u06cc\u0632 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0633\u0631\u0646\u062e \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u06cc\u0631 \u0648\u0627\u0642\u0639\u06cc History:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(Get-PSReadLineOption).HistorySavePath<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Content (Get-PSReadLineOption).HistorySavePath -Tail 100<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 History \u0645\u0646\u0628\u0639 \u0642\u0637\u0639\u06cc \u0646\u06cc\u0633\u062a \u0648 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u067e\u0627\u06a9 \u0634\u062f\u0647 \u0628\u0627\u0634\u062f.<\/li>\n\n\n\n<li>\u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u0628\u0627\u0634\u062f.<\/li>\n\n\n\n<li>Command \u062f\u0627\u062e\u0644 Script \u0627\u062c\u0631\u0627 \u0634\u062f\u0647 \u0628\u0627\u0634\u062f.<\/li>\n\n\n\n<li>\u0627\u0632 Host \u062f\u06cc\u06af\u0631\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f\u0647 \u0628\u0627\u0634\u062f.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 History \u0628\u0627\u06cc\u062f \u062f\u0631 \u06a9\u0646\u0627\u0631 Event 4104 \u0648 4688 \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Process\u0647\u0627\u06cc \u0641\u0639\u0644\u06cc PowerShell \u0648 CMD<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Process powershell,pwsh,cmd -ErrorAction SilentlyContinue<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u062f\u0631\u06cc\u0627\u0641\u062a Command Line:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_Process |\nWhere-Object {\n    $_.Name -in @(\n        'powershell.exe',\n        'pwsh.exe',\n        'cmd.exe'\n    )\n} |\nSelect-Object ProcessId,\n              ParentProcessId,\n              Name,\n              CommandLine<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 Command \u0647\u06cc\u0686 \u062a\u063a\u06cc\u06cc\u0631\u06cc \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0627\u06cc\u062c\u0627\u062f \u0646\u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0635\u0631\u0641\u0627\u064b Process\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Connection\u0647\u0627\u06cc PowerShell \u0641\u0639\u0627\u0644<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$Pids = Get-Process powershell,pwsh -ErrorAction SilentlyContinue |\nSelect-Object -ExpandProperty Id\n\nforeach ($Pid in $Pids) {\n    Get-NetTCPConnection -OwningProcess $Pid -ErrorAction SilentlyContinue\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 PowerShell \u0641\u0639\u0627\u0644 Connection \u062e\u0627\u0631\u062c\u06cc \u062f\u0627\u0631\u062f\u060c Command Line \u0648 Parent \u0622\u0646 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u06cc\u06a9 Workflow \u0639\u0645\u0644\u06cc \u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Reverse Shell<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u0645 \u0631\u0648\u06cc Windows Server \u0631\u0641\u062a\u0627\u0631 \u0645\u0634\u06a9\u0648\u06a9\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0627\u0648\u0644: \u062b\u0628\u062a Connection\u0647\u0627\u06cc \u0641\u0639\u0644\u06cc<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetTCPConnection -State Established |\nSelect-Object LocalAddress,\n              LocalPort,\n              RemoteAddress,\n              RemotePort,\n              OwningProcess |\nExport-Csv C:\\IR\\connections.csv -NoTypeInformation<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u062f\u0648\u0645: \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Process<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u0645 PID:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>6240<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_Process -Filter \"ProcessId = 6240\" |\nSelect-Object *<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0633\u0648\u0645: Parent Process<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>$Process = Get-CimInstance Win32_Process -Filter \"ProcessId = 6240\"\n\nGet-CimInstance Win32_Process `\n-Filter \"ProcessId = $($Process.ParentProcessId)\" |\nSelect-Object ProcessId,\n              Name,\n              CommandLine,\n              ExecutablePath<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0686\u0647\u0627\u0631\u0645: \u0628\u0631\u0631\u0633\u06cc Event 4688<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4688\n} |\nWhere-Object {\n    $_.Message -match '6240|powershell'\n}<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u067e\u0646\u062c\u0645: \u0628\u0631\u0631\u0633\u06cc PowerShell Log<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName='Microsoft-Windows-PowerShell\/Operational'\n    Id=4104\n} -MaxEvents 200<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0634\u0634\u0645: \u0628\u0631\u0631\u0633\u06cc Sysmon<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0635\u0648\u0631\u062a \u0646\u0635\u0628:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName='Microsoft-Windows-Sysmon\/Operational'\n    Id=1,3\n} -MaxEvents 200<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0647\u0641\u062a\u0645: \u0628\u0631\u0631\u0633\u06cc Persistence<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ScheduledTask<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_Service |\nSelect Name,State,StartMode,StartName,PathName<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06a9\u0646\u0648\u0646 Evidence\u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641 \u0631\u0627 \u0628\u0627 \u0647\u0645 \u0645\u0642\u0627\u06cc\u0633\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u0647 \u0627\u0644\u06af\u0648\u06cc\u06cc \u0628\u06cc\u0634\u062a\u0631 \u0645\u0634\u06a9\u0648\u06a9 \u0627\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>w3wp.exe\n   |\n   v\npowershell.exe\n   |\n   v\nExternal IP<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>winword.exe\n   |\n   v\ncmd.exe\n   |\n   v\npowershell.exe\n   |\n   v\nExternal IP<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0646\u06cc\u0627\u0632\u0645\u0646\u062f \u0628\u0631\u0631\u0633\u06cc \u062c\u062f\u06cc \u0628\u0627\u0634\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 Context \u0627\u0647\u0645\u06cc\u062a \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Automation \u0633\u0627\u0632\u0645\u0627\u0646\u06cc \u0631\u0641\u062a\u0627\u0631 \u0645\u0634\u0627\u0628\u0647\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0622\u06cc\u0627 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0641\u0642\u0637 \u0628\u0631\u0627\u0633\u0627\u0633 PowerShell \u0646\u062a\u06cc\u062c\u0647 \u06af\u0631\u0641\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062e\u06cc\u0631.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">PowerShell \u06cc\u06a9\u06cc \u0627\u0632 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u0627\u0635\u0644\u06cc Administration \u062f\u0631 Windows \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0647\u0645\u06cc\u0646 \u062f\u0644\u06cc\u0644 \u0648\u062c\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>powershell.exe<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06a9\u0627\u0645\u0644\u0627\u064b \u0637\u0628\u06cc\u0639\u06cc \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0648\u0627\u0631\u062f\u06cc \u06a9\u0647 \u0628\u0627\u06cc\u062f \u0628\u0627 \u0647\u0645 \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Who started it?\nWhen?\nFrom what parent?\nWith what command line?\nWhere did it connect?\nWas the destination expected?<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u06af\u0631 Process \u0645\u0634\u06a9\u0648\u06a9 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u06cc\u0645 \u0686\u0647 \u06a9\u0646\u06cc\u0645\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0627\u0634\u062a\u0628\u0627\u0647\u0627\u062a \u0631\u0627\u06cc\u062c \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 \u0641\u0648\u0631\u0627\u064b:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Stop-Process -Id PID -Force<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u062c\u0631\u0627 \u06a9\u0646\u06cc\u0645.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Incident \u062c\u062f\u06cc \u0628\u0647\u062a\u0631 \u0627\u0633\u062a \u0627\u0628\u062a\u062f\u0627 Evidence\u0647\u0627\u06cc Volatile \u062b\u0628\u062a \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0632\u06cc\u0631\u0627 \u0628\u0639\u062f \u0627\u0632 Kill \u0634\u062f\u0646 Process \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Connection \u0627\u0632 \u0628\u06cc\u0646 \u0628\u0631\u0648\u062f.<\/li>\n\n\n\n<li>Command Line \u0627\u0632 \u062f\u0633\u062a\u0631\u0633 \u062e\u0627\u0631\u062c \u0634\u0648\u062f.<\/li>\n\n\n\n<li>Parent\/Child Relationship \u062a\u063a\u06cc\u06cc\u0631 \u06a9\u0646\u062f.<\/li>\n\n\n\n<li>Memory Evidence \u0627\u0632 \u0628\u06cc\u0646 \u0628\u0631\u0648\u062f.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u0627\u0648\u0644\u06cc\u0647 Evidence<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u062a\u062f\u0627 Directory \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>New-Item C:\\IR -ItemType Directory -ErrorAction SilentlyContinue<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Connection\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetTCPConnection |\nExport-Csv C:\\IR\\network.csv -NoTypeInformation<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Process\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_Process |\nSelect-Object ProcessId,\n              ParentProcessId,\n              Name,\n              ExecutablePath,\n              CommandLine |\nExport-Csv C:\\IR\\processes.csv -NoTypeInformation<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Session\u0647\u0627\u06cc User:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>quser &gt; C:\\IR\\sessions.txt<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Scheduled Task\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ScheduledTask |\nExport-Clixml C:\\IR\\scheduled-tasks.xml<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Hash \u0641\u0627\u06cc\u0644 Executable \u0645\u0634\u06a9\u0648\u06a9<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Process \u0627\u0632 Executable \u0646\u0627\u0634\u0646\u0627\u0633 \u0627\u062c\u0631\u0627 \u0634\u062f\u0647 \u0627\u0633\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-FileHash `\n\"C:\\Path\\To\\Suspicious.exe\" `\n-Algorithm SHA256<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Hash \u0631\u0627 \u062b\u0628\u062a \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0627\u06cc\u0644 \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0631\u0627 \u0628\u0631\u0627\u06cc \u00ab\u062f\u06cc\u062f\u0646 \u0627\u06cc\u0646\u06a9\u0647 \u0686\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f\u00bb \u0627\u062c\u0631\u0627 \u0646\u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 Containment<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Compromise \u062a\u0623\u06cc\u06cc\u062f \u06cc\u0627 \u0628\u0633\u06cc\u0627\u0631 \u0645\u062d\u062a\u0645\u0644 \u0628\u0627\u0634\u062f\u060c \u0633\u06cc\u0633\u062a\u0645 \u0628\u0627\u06cc\u062f \u0637\u0628\u0642 Incident Response Plan \u0633\u0627\u0632\u0645\u0627\u0646 \u0645\u0647\u0627\u0631 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0644\u0627\u0632\u0645 \u0628\u0627\u0634\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Egress Traffic \u0645\u062d\u062f\u0648\u062f \u0634\u0648\u062f.<\/li>\n\n\n\n<li>Server \u0627\u0632 VLAN \u062c\u062f\u0627 \u0634\u0648\u062f.<\/li>\n\n\n\n<li>Security Group \u062a\u063a\u06cc\u06cc\u0631 \u06a9\u0646\u062f.<\/li>\n\n\n\n<li>Firewall Rule \u0645\u0648\u0642\u062a \u0627\u0639\u0645\u0627\u0644 \u0634\u0648\u062f.<\/li>\n\n\n\n<li>Access \u062e\u0627\u0631\u062c\u06cc \u0645\u062d\u062f\u0648\u062f \u0634\u0648\u062f.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Incident\u0647\u0627\u06cc \u062c\u062f\u06cc \u062e\u0627\u0645\u0648\u0634 \u06a9\u0631\u062f\u0646 \u0641\u0648\u0631\u06cc Server \u0647\u0645\u06cc\u0634\u0647 \u0628\u0647\u062a\u0631\u06cc\u0646 \u06a9\u0627\u0631 \u0646\u06cc\u0633\u062a\u060c \u0632\u06cc\u0631\u0627 Evidence\u0647\u0627\u06cc Volatile \u0627\u0632 \u0628\u06cc\u0646 \u0645\u06cc\u200c\u0631\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Credential\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0645\u0647\u0627\u062c\u0645 \u0631\u0648\u06cc Server Command \u0627\u062c\u0631\u0627 \u06a9\u0631\u062f\u0647 \u0628\u0627\u0634\u062f\u060c \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Credential\u0647\u0627\u06cc \u0645\u0648\u062c\u0648\u062f \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0628\u0627\u0634\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Domain Credential\nLocal Administrator Password\nAPI Token\nDatabase Password\nService Account\nCloud Credential\nBackup Credential<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0635\u0648\u0631\u062a \u062a\u0623\u06cc\u06cc\u062f Incident \u0628\u0627\u06cc\u062f Credential\u0647\u0627\u06cc \u0645\u0631\u062a\u0628\u0637 \u0628\u0631\u0627\u0633\u0627\u0633 Scope \u062d\u0627\u062f\u062b\u0647 Rotate \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Root Cause \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0633\u062a\u0646 Connection \u0641\u0642\u0637 Symptom \u0631\u0627 \u062d\u0630\u0641 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u06cc\u062f \u0645\u0634\u062e\u0635 \u0634\u0648\u062f Reverse Shell \u0686\u06af\u0648\u0646\u0647 \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Web Application \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631<\/li>\n\n\n\n<li>Credential \u0633\u0631\u0642\u062a\u200c\u0634\u062f\u0647<\/li>\n\n\n\n<li>RDP Compromise<\/li>\n\n\n\n<li>Phishing<\/li>\n\n\n\n<li>Service \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631<\/li>\n\n\n\n<li>Application Upload<\/li>\n\n\n\n<li>Malicious Scheduled Task<\/li>\n\n\n\n<li>Service Persistence<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u062a\u0627 Root Cause \u0628\u0631\u0637\u0631\u0641 \u0646\u0634\u0648\u062f\u060c \u0645\u0647\u0627\u062c\u0645 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u062f\u0648\u0628\u0627\u0631\u0647 \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u06af\u0648\u0646\u0647 \u0627\u062d\u062a\u0645\u0627\u0644 Reverse Shell \u0631\u0627 \u06a9\u0627\u0647\u0634 \u062f\u0647\u06cc\u0645\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0642\u062f\u0627\u0645\u0627\u062a \u0645\u0647\u0645 \u062f\u0641\u0627\u0639\u06cc \u0639\u0628\u0627\u0631\u062a\u200c\u0627\u0646\u062f \u0627\u0632:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Patch Management<\/li>\n\n\n\n<li>Microsoft Defender \u06cc\u0627 EDR<\/li>\n\n\n\n<li>Least Privilege<\/li>\n\n\n\n<li>\u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 Local Administrator<\/li>\n\n\n\n<li>Egress Filtering<\/li>\n\n\n\n<li>Firewall Logging<\/li>\n\n\n\n<li>Script Block Logging<\/li>\n\n\n\n<li>Process Creation Auditing<\/li>\n\n\n\n<li>Sysmon<\/li>\n\n\n\n<li>Application Control<\/li>\n\n\n\n<li>ASR Rules<\/li>\n\n\n\n<li>Centralized Logging<\/li>\n\n\n\n<li>SIEM<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 Outbound Traffic<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0631\u0627\u0647\u06a9\u0627\u0631\u0647\u0627\u06cc \u062f\u0641\u0627\u0639\u06cc\u060c \u06a9\u0646\u062a\u0631\u0644 Egress Traffic \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 Server\u0647\u0627 \u0646\u06cc\u0627\u0632\u06cc \u0646\u062f\u0627\u0631\u0646\u062f \u0628\u0647 \u0647\u0631 IP \u0648 Port \u0627\u06cc\u0646\u062a\u0631\u0646\u062a \u062f\u0633\u062a\u0631\u0633\u06cc \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 Web Server \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0641\u0642\u0637 \u0646\u06cc\u0627\u0632 \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f \u0628\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>DNS\nWindows Update\nMonitoring\nBackup\nApproved APIs\nDatabase<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062a\u0635\u0644 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Destination\u0647\u0627\u06cc \u0645\u062c\u0627\u0632 \u0645\u0634\u062e\u0635 \u0628\u0627\u0634\u0646\u062f\u060c Connection \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0642\u0627\u0628\u0644 \u062a\u0634\u062e\u06cc\u0635 \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0641\u0639\u0627\u0644 \u06a9\u0631\u062f\u0646 Logging \u0645\u0646\u0627\u0633\u0628 \u0642\u0628\u0644 \u0627\u0632 Incident<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0639\u062f \u0627\u0632 \u0648\u0642\u0648\u0639 Incident \u0646\u0645\u06cc\u200c\u062a\u0648\u0627\u0646 Log\u0647\u0627\u06cc\u06cc \u0631\u0627 \u06a9\u0647 \u0642\u0628\u0644\u0627\u064b \u0641\u0639\u0627\u0644 \u0646\u0628\u0648\u062f\u0647\u200c\u0627\u0646\u062f \u0628\u0627\u0632\u0633\u0627\u0632\u06cc \u06a9\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0647\u0645\u06cc\u0646 \u0628\u0647\u062a\u0631 \u0627\u0633\u062a \u0642\u0628\u0644 \u0627\u0632 \u062d\u0627\u062f\u062b\u0647 \u062d\u062f\u0627\u0642\u0644 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u062f\u0631 Server\u0647\u0627\u06cc \u0645\u0647\u0645 \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Audit Process Creation\nCommand Line Logging\nPowerShell Script Block Logging\nFirewall Logging\nSysmon \/ EDR\nCentralized Logs<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Event ID 4688 \u0648 Sysmon Event\u0647\u0627\u06cc 1 \u0648 3 \u062f\u0631 Correlation Process \u0648 Network \u0628\u0633\u06cc\u0627\u0631 \u06a9\u0627\u0631\u0628\u0631\u062f\u06cc \u0647\u0633\u062a\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0634\u062a\u0628\u0627\u0647\u0627\u062a \u0631\u0627\u06cc\u062c<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u062e\u06cc \u0627\u0634\u062a\u0628\u0627\u0647\u0627\u062a \u0645\u062a\u062f\u0627\u0648\u0644 \u0647\u0646\u06af\u0627\u0645 \u0628\u0631\u0631\u0633\u06cc Reverse Shell \u062f\u0631 Windows \u0639\u0628\u0627\u0631\u062a\u200c\u0627\u0646\u062f \u0627\u0632:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0628\u0631\u0631\u0633\u06cc \u0641\u0642\u0637 Listening Port\u0647\u0627<\/li>\n\n\n\n<li>\u062a\u0645\u0631\u06a9\u0632 \u0641\u0642\u0637 \u0631\u0648\u06cc Port\u0647\u0627\u06cc \u0639\u062c\u06cc\u0628<\/li>\n\n\n\n<li>\u062a\u0635\u0648\u0631 \u0627\u06cc\u0646\u06a9\u0647 \u0647\u0631 PowerShell Process \u0645\u062e\u0631\u0628 \u0627\u0633\u062a<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 OwningProcess<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 Parent Process<\/li>\n\n\n\n<li>\u062a\u0648\u062c\u0647 \u0646\u06a9\u0631\u062f\u0646 \u0628\u0647 Command Line<\/li>\n\n\n\n<li>Kill \u06a9\u0631\u062f\u0646 Process \u0642\u0628\u0644 \u0627\u0632 \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc Evidence<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 Event 4688<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 Event 4104<\/li>\n\n\n\n<li>\u0646\u0627\u062f\u06cc\u062f\u0647 \u06af\u0631\u0641\u062a\u0646 Sysmon Event 3<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 Scheduled Task\u0647\u0627<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 Service\u0647\u0627<\/li>\n\n\n\n<li>\u067e\u06cc\u062f\u0627 \u0646\u06a9\u0631\u062f\u0646 Root Cause<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0647\u062a\u0631\u06cc\u0646 \u0631\u0648\u0634\u200c\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Detection \u062f\u0642\u06cc\u0642\u200c\u062a\u0631:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Connection\u0647\u0627\u06cc Established \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>PID \u0645\u0627\u0644\u06a9 Connection \u0631\u0627 \u0645\u0634\u062e\u0635 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Command Line Process \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Parent Process \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Destination IP \u0631\u0627 \u0628\u0627 Baseline \u0645\u0642\u0627\u06cc\u0633\u0647 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Event 4688 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>PowerShell Event 4104 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Sysmon Event 1 \u0648 3 \u0631\u0627 Correlate \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Scheduled Task\u0647\u0627 \u0648 Service\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>\u0642\u0628\u0644 \u0627\u0632 Kill \u06a9\u0631\u062f\u0646 Process Evidence \u0628\u06af\u06cc\u0631\u06cc\u062f.<\/li>\n\n\n\n<li>Firewall Logging \u0631\u0627 \u0641\u0639\u0627\u0644 \u0646\u06af\u0647 \u062f\u0627\u0631\u06cc\u062f.<\/li>\n\n\n\n<li>Egress Traffic \u0631\u0627 \u0645\u062d\u062f\u0648\u062f \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Root Cause \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u062f.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u06a9\u200c\u0644\u06cc\u0633\u062a<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0627\u062d\u062a\u0645\u0627\u0644 Reverse Shell \u0631\u0648\u06cc Windows Server \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f\u060c \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Connection\u0647\u0627\u06cc Established \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Remote IP\u0647\u0627\u06cc \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0645\u0634\u062e\u0635 \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Remote Port\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>PID \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Connection \u067e\u06cc\u062f\u0627 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Process Name \u0645\u0634\u062e\u0635 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Command Line \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Executable Path \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Parent Process \u0645\u0634\u062e\u0635 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>User \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Process \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Event ID 4688 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Event ID 4104 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Sysmon Event ID 1 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Sysmon Event ID 3 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Windows Firewall Log \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Scheduled Task\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Service\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Startup Location\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>PowerShell History \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Evidence \u0642\u0628\u0644 \u0627\u0632 Terminate \u06a9\u0631\u062f\u0646 Process \u0630\u062e\u06cc\u0631\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Root Cause \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Credential\u0647\u0627\u06cc \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 Rotate \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0637\u0627\u0644\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0637\u0627\u0644\u0639\u0647 \u0628\u06cc\u0634\u062a\u0631 \u062f\u0631\u0628\u0627\u0631\u0647 \u0627\u0628\u0632\u0627\u0631\u0647\u0627 \u0648 Log\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u062f\u0631 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u0645\u0646\u0627\u0628\u0639 \u0631\u0633\u0645\u06cc Microsoft \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Get-NetTCPConnection<\/strong><br>\u0645\u0633\u062a\u0646\u062f\u0627\u062a \u0631\u0633\u0645\u06cc PowerShell \u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 TCP Connection\u0647\u0627\u060c Remote Address\u060c Port\u060c State \u0648 Owning Process.<br><a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/nettcpip\/get-nettcpconnection?view=windowsserver2025-ps&amp;utm_source=maral.cloud\" target=\"_blank\" rel=\"noopener\">https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/nettcpip\/get-nettcpconnection?view=windowsserver2025-ps&amp;utm_source=maral.cloud<\/a><\/li>\n\n\n\n<li><strong>Event ID 4688 \u2013 Process Creation<\/strong><br>\u0645\u0633\u062a\u0646\u062f\u0627\u062a Microsoft \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0627\u06cc\u062c\u0627\u062f Process\u060c Parent Process \u0648 Command Line.<br><a href=\"https:\/\/learn.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-10\/security\/threat-protection\/auditing\/event-4688?utm_source=maral.cloud\" target=\"_blank\" rel=\"noopener\">https:\/\/learn.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-10\/security\/threat-protection\/auditing\/event-4688?utm_source=maral.cloud<\/a><\/li>\n\n\n\n<li><strong>Command Line Process Auditing<\/strong><br>\u0631\u0627\u0647\u0646\u0645\u0627\u06cc Microsoft \u0628\u0631\u0627\u06cc \u0641\u0639\u0627\u0644 \u06a9\u0631\u062f\u0646 Audit Process Creation \u0648 \u062b\u0628\u062a Command Line \u062f\u0631 Event 4688.<br><a href=\"https:\/\/learn.microsoft.com\/en-us\/windows-server\/identity\/ad-ds\/manage\/component-updates\/command-line-process-auditing?utm_source=maral.cloud\" target=\"_blank\" rel=\"noopener\">https:\/\/learn.microsoft.com\/en-us\/windows-server\/identity\/ad-ds\/manage\/component-updates\/command-line-process-auditing?utm_source=maral.cloud<\/a><\/li>\n\n\n\n<li><strong>PowerShell Logging<\/strong><br>\u0645\u0633\u062a\u0646\u062f\u0627\u062a Script Block Logging \u0648 Event ID 4104 \u062f\u0631 PowerShell.<br><a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/microsoft.powershell.core\/about\/about_logging?view=powershell-5.1&amp;utm_source=maral.cloud\" target=\"_blank\" rel=\"noopener\">https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/microsoft.powershell.core\/about\/about_logging?view=powershell-5.1&amp;utm_source=maral.cloud<\/a><\/li>\n\n\n\n<li><strong>Sysmon<\/strong><br>\u0645\u0633\u062a\u0646\u062f\u0627\u062a \u0631\u0633\u0645\u06cc Sysinternals \u062f\u0631\u0628\u0627\u0631\u0647 Process Creation\u060c Network Connection \u0648 \u0633\u0627\u06cc\u0631 Event\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc.<br><a href=\"https:\/\/learn.microsoft.com\/en-us\/sysinternals\/downloads\/sysmon?utm_source=maral.cloud\" target=\"_blank\" rel=\"noopener\">https:\/\/learn.microsoft.com\/en-us\/sysinternals\/downloads\/sysmon?utm_source=maral.cloud<\/a><\/li>\n\n\n\n<li><strong>Sysmon Configuration<\/strong><br>\u0645\u0631\u062c\u0639 Event\u0647\u0627\u06cc Sysmon \u0627\u0632 \u062c\u0645\u0644\u0647 Event ID 1 \u0648 Event ID 3 \u0648 \u0631\u0648\u0634 Filter \u06a9\u0631\u062f\u0646 Event\u0647\u0627.<br><a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/security\/operating-system-security\/sysmon\/sysmon-configuration-files?utm_source=maral.cloud\" target=\"_blank\" rel=\"noopener\">https:\/\/learn.microsoft.com\/en-us\/windows\/security\/operating-system-security\/sysmon\/sysmon-configuration-files?utm_source=maral.cloud<\/a><\/li>\n\n\n\n<li><strong>Windows Firewall Logging<\/strong><br>\u0631\u0627\u0647\u0646\u0645\u0627\u06cc Microsoft \u0628\u0631\u0627\u06cc \u062b\u0628\u062a Connection\u0647\u0627\u06cc Allowed \u0648 Dropped \u062f\u0631 Windows Defender Firewall.<br><a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/security\/operating-system-security\/network-security\/windows-firewall\/configure-logging?utm_source=maral.cloud\" target=\"_blank\" rel=\"noopener\">https:\/\/learn.microsoft.com\/en-us\/windows\/security\/operating-system-security\/network-security\/windows-firewall\/configure-logging?utm_source=maral.cloud<\/a><\/li>\n\n\n\n<li><strong>Get-ScheduledTask<\/strong><br>\u0645\u0633\u062a\u0646\u062f\u0627\u062a PowerShell \u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Scheduled Task\u0647\u0627\u06cc \u062b\u0628\u062a\u200c\u0634\u062f\u0647 \u0631\u0648\u06cc Windows.<br><a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/scheduledtasks\/get-scheduledtask?view=windowsserver2025-ps&amp;utm_source=maral.cloud\" target=\"_blank\" rel=\"noopener\">https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/scheduledtasks\/get-scheduledtask?view=windowsserver2025-ps&amp;utm_source=maral.cloud<\/a><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062c\u0645\u0639\u200c\u0628\u0646\u062f\u06cc<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Reverse Shell \u062f\u0631 Windows \u0644\u0632\u0648\u0645\u0627\u064b \u0628\u0627 \u06cc\u06a9 \u067e\u0648\u0631\u062a Listening \u06cc\u0627 RDP Session \u062c\u062f\u06cc\u062f \u0642\u0627\u0628\u0644 \u062a\u0634\u062e\u06cc\u0635 \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 \u0645\u0648\u0627\u0631\u062f \u0628\u0627\u06cc\u062f Connection\u0647\u0627\u06cc \u062e\u0631\u0648\u062c\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0628\u0647\u062a\u0631\u06cc\u0646 \u0646\u0642\u0627\u0637 \u0634\u0631\u0648\u0639:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetTCPConnection -State Established<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0639\u0644\u0627\u0648\u0647 \u0628\u0631 Destination IP \u0648 Port\u060c \u0645\u0642\u062f\u0627\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>OwningProcess<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0646\u06cc\u0632 \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u067e\u0633 \u0627\u0632 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 PID \u0628\u0627\u06cc\u062f Process \u0648 Command Line \u0622\u0646 \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_Process -Filter \"ProcessId = PID\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 \u0633\u067e\u0633 Parent Process \u0645\u0634\u062e\u0635 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Investigation \u0648\u0627\u0642\u0639\u06cc \u0627\u0644\u06af\u0648\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Suspicious Process\n       +\nUnexpected Parent\n       +\nExternal Connection\n       +\nUnusual Command Line<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0647\u0645\u06cc\u062a \u0628\u06cc\u0634\u062a\u0631\u06cc \u0627\u0632 \u0634\u0645\u0627\u0631\u0647 Port \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0641\u0639\u0627\u0644\u06cc\u062a\u200c\u0647\u0627\u06cc \u06af\u0630\u0634\u062a\u0647 \u0646\u06cc\u0632 Event:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4688<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Process Creation\u060c<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Event:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4104<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc PowerShell Script Block\u060c<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Sysmon:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Event ID 1\nEvent ID 3<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Process Creation \u0648 Network Connection \u0628\u0633\u06cc\u0627\u0631 \u0645\u0647\u0645 \u0647\u0633\u062a\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Process \u0645\u0634\u06a9\u0648\u06a9\u06cc \u067e\u06cc\u062f\u0627 \u0634\u062f\u060c \u0642\u0628\u0644 \u0627\u0632 Terminate \u06a9\u0631\u062f\u0646 \u0622\u0646 \u0628\u0627\u06cc\u062f \u0627\u0637\u0644\u0627\u0639\u0627\u062a Network\u060c Process Tree\u060c Command Line \u0648 Log\u0647\u0627 \u062b\u0628\u062a \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u0686\u0646\u06cc\u0646 \u0628\u0631\u0631\u0633\u06cc Scheduled Task\u060c Windows Service\u060c Startup Location \u0648 PowerShell History \u0636\u0631\u0648\u0631\u06cc \u0627\u0633\u062a\u060c \u0632\u06cc\u0631\u0627 Reverse Shell \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0641\u0642\u0637 \u0628\u062e\u0634\u06cc \u0627\u0632 \u06cc\u06a9 Persistence Mechanism \u0628\u0632\u0631\u06af\u200c\u062a\u0631 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0646\u0647\u0627\u06cc\u062a\u060c \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Reverse Shell \u0646\u0628\u0627\u06cc\u062f \u0628\u0631\u0627\u0633\u0627\u0633 \u06cc\u06a9 Port \u06cc\u0627 \u06cc\u06a9 Process \u0627\u0646\u062c\u0627\u0645 \u0634\u0648\u062f. <strong>\u062a\u0634\u062e\u06cc\u0635 \u0645\u0639\u062a\u0628\u0631 \u0632\u0645\u0627\u0646\u06cc \u0634\u06a9\u0644 \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f \u06a9\u0647 Network Connection\u060c Process\u060c Parent Process\u060c Command Line \u0648 Event Log\u0647\u0627 \u062f\u0631 \u06a9\u0646\u0627\u0631 \u06cc\u06a9\u062f\u06cc\u06af\u0631 \u062a\u062d\u0644\u06cc\u0644 \u0634\u0648\u0646\u062f.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06a9\u06cc\u0627\u0646 \u067e\u0648\u0631<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0645\u0642\u062f\u0645\u0647 \u06cc\u06a9\u06cc \u0627\u0632 \u0631\u0648\u0634\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u067e\u0633 \u0627\u0632 \u0646\u0641\u0648\u0630 \u0628\u0647 Windows Server \u06cc\u0627 Windows Client \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u0648\u062f\u060c \u0627\u06cc\u062c\u0627\u062f Reverse Shell \u0627\u0633\u062a. \u062f\u0631 \u06cc\u06a9 \u0627\u062a\u0635\u0627\u0644 \u0639\u0627\u062f\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc\u060c \u0645\u062f\u06cc\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0627\u0632 \u0633\u06cc\u0633\u062a\u0645 \u062e\u0648\u062f \u0628\u0647 Server \u0645\u062a\u0635\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f: \u0627\u0645\u0627 \u062f\u0631 Reverse Shell \u062c\u0647\u062a \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0631\u0639\u06a9\u0633 \u0645\u06cc\u200c\u0634\u0648\u062f. \u0633\u06cc\u0633\u062a\u0645 \u0622\u0644\u0648\u062f\u0647 \u062e\u0648\u062f\u0634 \u06cc\u06a9 Connection \u062e\u0631\u0648\u062c\u06cc \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u062f\u06cc\u06af\u0631\u06cc \u0628\u0631\u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":22150,"parent":17595,"menu_order":59,"comment_status":"open","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_import_markdown_pro_load_document_selector":0,"_import_markdown_pro_submit_text_textarea":"","_llm_markdown_disabled":false},"doc_tag":[],"doc_badge":[],"class_list":["post-21744","docs","type-docs","status-publish","has-post-thumbnail","hentry"],"acf":[],"author_avatar":"https:\/\/maralhost.com\/kb\/wp-content\/litespeed\/avatar\/c59fc140fa83b542ed78a005738a60da.jpg?ver=1794183946","author_name":"Shayan Kianpoor","_links":{"self":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/21744","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/comments?post=21744"}],"version-history":[{"count":2,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/21744\/revisions"}],"predecessor-version":[{"id":22151,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/21744\/revisions\/22151"}],"up":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/17595"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media\/22150"}],"wp:attachment":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media?parent=21744"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/doc_tag?post=21744"},{"taxonomy":"doc_badge","embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/doc_badge?post=21744"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}