{"id":22157,"date":"2026-09-26T11:46:56","date_gmt":"2026-09-26T08:16:56","guid":{"rendered":"https:\/\/maralhost.com\/kb\/docs\/security\/%d8%a8%d8%b1%d8%b1%d8%b3%db%8c-persistence-%d8%af%d8%b1-%d9%88%db%8c%d9%86%d8%af%d9%88%d8%b2\/"},"modified":"2026-09-26T12:10:06","modified_gmt":"2026-09-26T08:40:06","slug":"win-persistence","status":"publish","type":"docs","link":"https:\/\/maralhost.com\/kb\/docs\/security\/win-persistence\/","title":{"rendered":"\u0628\u0631\u0631\u0633\u06cc Persistence \u062f\u0631 \u0648\u06cc\u0646\u062f\u0648\u0632"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\">\u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0631\u0648\u0634\u200c\u0647\u0627\u06cc \u0645\u0627\u0646\u062f\u06af\u0627\u0631\u06cc \u0645\u0647\u0627\u062c\u0645<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0642\u062f\u0645\u0647<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u06cc\u06a9 Incident \u0627\u0645\u0646\u06cc\u062a\u06cc\u060c \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0648\u0644\u06cc\u0647 \u0645\u0647\u0627\u062c\u0645 \u0647\u0645\u06cc\u0634\u0647 \u0645\u0648\u0642\u062a\u06cc \u0628\u0627\u0642\u06cc \u0646\u0645\u06cc\u200c\u0645\u0627\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0639\u062f \u0627\u0632 \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 Windows Server \u06cc\u0627 Windows Client \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0645\u0647\u0627\u062c\u0645 \u062a\u0644\u0627\u0634 \u06a9\u0646\u062f \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f \u06a9\u0647 \u0628\u0639\u062f \u0627\u0632:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Restart \u0633\u06cc\u0633\u062a\u0645<\/li>\n\n\n\n<li>Logoff \u06a9\u0627\u0631\u0628\u0631<\/li>\n\n\n\n<li>\u0628\u0633\u062a\u0647 \u0634\u062f\u0646 Session<\/li>\n\n\n\n<li>Terminate \u0634\u062f\u0646 Process<\/li>\n\n\n\n<li>\u062a\u063a\u06cc\u06cc\u0631 Password<\/li>\n\n\n\n<li>\u0642\u0637\u0639 \u0627\u0631\u062a\u0628\u0627\u0637 \u0627\u0648\u0644\u06cc\u0647<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0648\u0628\u0627\u0631\u0647 \u06a9\u062f \u06cc\u0627 \u0627\u0628\u0632\u0627\u0631 \u0645\u0648\u0631\u062f\u0646\u0638\u0631\u0634 \u0627\u062c\u0631\u0627 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0627\u06cc\u0646 \u0631\u0648\u0634\u200c\u0647\u0627:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Persistence<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627 \u0645\u0627\u0646\u062f\u06af\u0627\u0631\u06cc \u06af\u0641\u062a\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Windows \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645\u200c\u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0642\u0627\u0646\u0648\u0646\u06cc \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u062e\u0648\u062f\u06a9\u0627\u0631 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u0648\u0646\u062f \u0648 \u0647\u0645\u06cc\u0646 \u0642\u0627\u0628\u0644\u06cc\u062a\u200c\u0647\u0627 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u0628\u06af\u06cc\u0631\u0646\u062f\u061b \u0627\u0632 \u062c\u0645\u0644\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Scheduled Tasks\nWindows Services\nRun \/ RunOnce Registry Keys\nStartup Folders\nWinlogon\nWMI Event Subscriptions\nPowerShell Profiles\nLocal Users\nAdministrator Membership<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">MITRE ATT&amp;CK \u0646\u06cc\u0632 Scheduled Task\u060c Windows Service\u060c Registry Run Keys\u060c Startup Folder\u060c Winlogon \u0648 WMI Event Subscription \u0631\u0627 \u062f\u0631 \u0645\u06cc\u0627\u0646 \u062a\u06a9\u0646\u06cc\u06a9\u200c\u0647\u0627\u06cc\u06cc \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0631\u0627\u06cc Persistence \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647 \u0631\u0648\u0634 \u0628\u0631\u0631\u0633\u06cc \u0627\u06cc\u0646 \u0646\u0642\u0627\u0637 \u0631\u0627 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 <strong>PowerShell\u060c CMD\u060c Event Viewer\u060c Registry\u060c Sysmon \u0648 Autoruns<\/strong> \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u06a9\u0646\u06cc\u0645.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">\u0647\u062f\u0641 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Persistence \u0648 Incident Response \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u062a\u062d\u062a \u0645\u062f\u06cc\u0631\u06cc\u062a \u0634\u0645\u0627 \u0627\u0633\u062a \u0648 \u0634\u0627\u0645\u0644 \u0622\u0645\u0648\u0632\u0634 \u0627\u06cc\u062c\u0627\u062f Persistence \u0646\u06cc\u0633\u062a.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Persistence \u0686\u06cc\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u062f \u0645\u0647\u0627\u062c\u0645 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u06cc\u06a9 Vulnerability\u060c Credential \u0633\u0631\u0642\u062a\u200c\u0634\u062f\u0647 \u06cc\u0627 RDP \u0648\u0627\u0631\u062f Server \u0634\u062f\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0648\u0644\u06cc\u0647 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0641\u0642\u0637 \u062a\u0627 \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 Session \u0641\u0639\u0627\u0644 \u0627\u0633\u062a \u0628\u0627\u0642\u06cc \u0628\u0645\u0627\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Initial Access\n     |\n     v\nTemporary Session<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0635\u0648\u0631\u062a Restart \u0634\u062f\u0646 Server \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0622\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u0628\u06cc\u0646 \u0628\u0631\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u06cc\u06a9 Persistence Mechanism \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0633\u0627\u062e\u062a\u0627\u0631\u06cc \u0645\u0627\u0646\u0646\u062f \u0632\u06cc\u0631 \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Initial Access\n     |\n     v\nPersistence\n     |\n     v\nAutomatic Execution\n     |\n     v\nAccess After Reboot \/ Logon<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u062f\u0641 Investigation \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 \u062a\u0645\u0627\u0645 \u0646\u0642\u0627\u0637\u06cc \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0627\u062c\u0631\u0627\u06cc \u062e\u0648\u062f\u06a9\u0627\u0631 \u06cc\u0627 \u062f\u0633\u062a\u0631\u0633\u06cc \u0645\u062c\u062f\u062f \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u0646\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0622\u06cc\u0627 \u0647\u0631 Persistence Mechanism \u0645\u062e\u0631\u0628 \u0627\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062e\u06cc\u0631.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u06cc\u0646 \u0642\u0627\u0628\u0644\u06cc\u062a\u200c\u0647\u0627 \u062a\u0648\u0633\u0637 Windows \u0648 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631\u0647\u0627\u06cc \u0642\u0627\u0646\u0648\u0646\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Windows Update\nBackup Software\nMonitoring Agent\nAntivirus\nDatabase Services\nApplication Updater<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Service\u060c Task \u06cc\u0627 Startup Entry \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0645\u0639\u06cc\u0627\u0631 \u0627\u0635\u0644\u06cc \u0627\u06cc\u0646 \u0646\u06cc\u0633\u062a \u06a9\u0647 \u06cc\u06a9 Scheduled Task \u06cc\u0627 Service \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u06cc\u062f \u0645\u0634\u062e\u0635 \u0634\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Who created it?\nWhen?\nWhat does it execute?\nFrom which path?\nUnder which account?\nIs it documented?\nIs it digitally signed?<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0642\u0628\u0644 \u0627\u0632 \u062a\u063a\u06cc\u06cc\u0631 \u0686\u06cc\u0632\u06cc Evidence \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0627\u062d\u062a\u0645\u0627\u0644 Incident \u0648\u0627\u0642\u0639\u06cc \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f\u060c \u0628\u0644\u0627\u0641\u0627\u0635\u0644\u0647 Service\u060c Task \u06cc\u0627 Registry Entry \u0631\u0627 \u062d\u0630\u0641 \u0646\u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u062a\u062f\u0627 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0622\u0646 \u0631\u0627 \u062b\u0628\u062a \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u06cc\u06a9 \u0641\u0627\u06cc\u0644 \u0645\u0634\u06a9\u0648\u06a9:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Item \"C:\\Path\\Suspicious.exe\" |\nFormat-List *<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633 Hash:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-FileHash `\n\"C:\\Path\\Suspicious.exe\" `\n-Algorithm SHA256<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Signature:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-AuthenticodeSignature `\n\"C:\\Path\\Suspicious.exe\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 \u0627\u0637\u0644\u0627\u0639\u0627\u062a Version:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>(Get-Item \"C:\\Path\\Suspicious.exe\").VersionInfo<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062f\u0631 Incident Response \u0628\u0633\u06cc\u0627\u0631 \u0627\u0631\u0632\u0634\u0645\u0646\u062f \u0647\u0633\u062a\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0627\u0648\u0644: \u0628\u0631\u0631\u0633\u06cc Scheduled Task\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Task Scheduler \u06cc\u06a9\u06cc \u0627\u0632 \u0627\u0648\u0644\u06cc\u0646 \u0646\u0642\u0627\u0637\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u062a\u0645\u0627\u0645 Scheduled Task\u0647\u0627\u06cc \u0633\u06cc\u0633\u062a\u0645:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ScheduledTask<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>Get-ScheduledTask<\/code> \u062a\u0639\u0631\u06cc\u0641 Task\u0647\u0627\u06cc \u062b\u0628\u062a\u200c\u0634\u062f\u0647 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0645\u062d\u0644\u06cc \u0631\u0627 \u0646\u0645\u0627\u06cc\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u062e\u0631\u0648\u062c\u06cc \u06a9\u0627\u0631\u0628\u0631\u062f\u06cc\u200c\u062a\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ScheduledTask |\nSelect-Object TaskName,\n              TaskPath,\n              State,\n              Author,\n              @{Name=\"RunAs\";Expression={$_.Principal.UserId}}<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Action \u0647\u0631 Scheduled Task \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0642\u0633\u0645\u062a Task \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 \u0686\u0647 \u0686\u06cc\u0632\u06cc \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ScheduledTask |\nForEach-Object {\n\n    $Task = $_\n\n    foreach ($Action in $Task.Actions) {\n\n        &#91;PSCustomObject]@{\n            TaskName  = $Task.TaskName\n            TaskPath  = $Task.TaskPath\n            Execute   = $Action.Execute\n            Arguments = $Action.Arguments\n            RunAs     = $Task.Principal.UserId\n        }\n\n    }\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06a9\u0646\u0648\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f Command \u0648\u0627\u0642\u0639\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0647\u0631 Task \u0631\u0627 \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u0647 Task\u0647\u0627\u06cc\u06cc \u0628\u06cc\u0634\u062a\u0631 \u0646\u06cc\u0627\u0632\u0645\u0646\u062f \u0628\u0631\u0631\u0633\u06cc \u0647\u0633\u062a\u0646\u062f\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0648\u0627\u0631\u062f\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>powershell.exe\npwsh.exe\ncmd.exe\nwscript.exe\ncscript.exe\nmshta.exe\nrundll32.exe<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u062f\u0631 Task \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f\u0647 \u0628\u0627\u0634\u0646\u062f\u060c \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u0686\u0646\u06cc\u0646 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\Users\\&lt;User&gt;\\AppData\\\nC:\\Users\\Public\\\nC:\\ProgramData\\\nC:\\Temp\\\nC:\\Windows\\Temp\\<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Executable \u0646\u0627\u0634\u0646\u0627\u0633 \u0627\u0632 \u0622\u0646\u0647\u0627 \u0627\u062c\u0631\u0627 \u0634\u0648\u062f\u060c \u0627\u0631\u0632\u0634 Investigation \u0628\u06cc\u0634\u062a\u0631\u06cc \u062f\u0627\u0631\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f \u0627\u06cc\u0646 \u0645\u0648\u0627\u0631\u062f \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0646\u0634\u0627\u0646\u0647 Compromise \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Task\u0647\u0627\u06cc \u0645\u062e\u0641\u06cc \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0631 Scheduled Task \u062f\u0627\u0631\u0627\u06cc Property\u0647\u0627\u06cc\u06cc \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ScheduledTask |\nWhere-Object {\n    $_.Settings.Hidden -eq $true\n} |\nSelect-Object TaskName,TaskPath,State<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0639\u0636\u06cc Task\u0647\u0627\u06cc \u0642\u0627\u0646\u0648\u0646\u06cc \u0646\u06cc\u0632 Hidden \u0647\u0633\u062a\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 Task \u0645\u062e\u0641\u06cc \u0628\u0627\u06cc\u062f \u0628\u0627 Baseline \u0633\u06cc\u0633\u062a\u0645 \u0645\u0642\u0627\u06cc\u0633\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0627\u062c\u0631\u0627\u06cc Scheduled Task<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0632\u0645\u0627\u0646 \u0622\u062e\u0631\u06cc\u0646 \u0627\u062c\u0631\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ScheduledTask |\nGet-ScheduledTaskInfo |\nSelect-Object TaskName,\n              LastRunTime,\n              LastTaskResult,\n              NextRunTime<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062f\u0631 Timeline Incident \u0645\u0641\u06cc\u062f \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Event ID 4698 \u0686\u06cc\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Audit Policy \u0645\u0646\u0627\u0633\u0628 \u0641\u0639\u0627\u0644 \u0628\u0627\u0634\u062f\u060c \u0627\u06cc\u062c\u0627\u062f Scheduled Task \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f Event:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4698<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Security Log \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft Event 4698 \u0631\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>A scheduled task was created<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062a\u0639\u0631\u06cc\u0641 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 Monitoring \u0627\u06cc\u062c\u0627\u062f Task\u0647\u0627 \u0631\u0627 \u0628\u0647\u200c\u062e\u0635\u0648\u0635 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u062d\u0633\u0627\u0633 \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4698\n} -MaxEvents 50<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Event\u0647\u0627\u06cc \u0645\u0647\u0645 Scheduled Task<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0635\u0648\u0631\u062a \u0641\u0639\u0627\u0644 \u0628\u0648\u062f\u0646 Audit \u0645\u0646\u0627\u0633\u0628:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4698 = Task Created\n4699 = Task Deleted\n4700 = Task Enabled\n4701 = Task Disabled\n4702 = Task Updated<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 Event\u0647\u0627 \u062a\u062d\u062a Audit Other Object Access Events \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u06af\u06cc\u0631\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0647\u0645\u0632\u0645\u0627\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4698,4699,4700,4701,4702\n} -MaxEvents 100 |\nSelect-Object TimeCreated,Id,Message<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u062f\u0648\u0645: \u0628\u0631\u0631\u0633\u06cc Windows Services<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Service\u0647\u0627 \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0646\u0642\u0627\u0637 Persistence \u062f\u0631 Windows \u0647\u0633\u062a\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Windows Service \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062f\u0631 Startup \u0633\u06cc\u0633\u062a\u0645 \u0627\u062c\u0631\u0627 \u0634\u0648\u062f \u0648 \u0628\u062f\u0648\u0646 Login \u06a9\u0627\u0631\u0628\u0631 \u062f\u0631 Background \u0641\u0639\u0627\u0644\u06cc\u062a \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">MITRE ATT&amp;CK \u0646\u06cc\u0632 \u0627\u06cc\u062c\u0627\u062f \u06cc\u0627 \u062a\u063a\u06cc\u06cc\u0631 Windows Service \u0631\u0627 \u06cc\u06a9\u06cc \u0627\u0632 \u062a\u06a9\u0646\u06cc\u06a9\u200c\u0647\u0627\u06cc \u0631\u0627\u06cc\u062c Persistence \u0645\u0639\u0631\u0641\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u062a\u062f\u0627 Service\u0647\u0627 \u0631\u0627 \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Service<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 <code>Get-Service<\/code> \u0645\u0633\u06cc\u0631 Executable \u0631\u0627 \u0646\u0645\u0627\u06cc\u0634 \u0646\u0645\u06cc\u200c\u062f\u0647\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Investigation \u0628\u0647\u062a\u0631 \u0627\u0633\u062a \u0627\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_Service<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u0645.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft \u0646\u06cc\u0632 \u0628\u0631\u0627\u06cc \u062f\u0631\u06cc\u0627\u0641\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a Service\u0647\u0627 \u0627\u0632 <code>Win32_Service<\/code> \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0646\u0645\u0627\u06cc\u0634 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0647\u0645 Service\u0647\u0627<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_Service |\nSelect-Object Name,\n              DisplayName,\n              State,\n              StartMode,\n              StartName,\n              PathName<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647\u200c\u062e\u0635\u0648\u0635 \u0633\u062a\u0648\u0646\u200c\u0647\u0627\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>StartMode\nStartName\nPathName<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0647\u0645\u06cc\u062a \u062f\u0627\u0631\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Service\u0647\u0627\u06cc Auto Start \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_Service |\nWhere-Object {\n    $_.StartMode -eq \"Auto\"\n} |\nSelect-Object Name,\n              State,\n              StartName,\n              PathName<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0631 Service \u0628\u0627 Auto Start \u0628\u0627\u06cc\u062f Purpose \u0645\u0634\u062e\u0635\u06cc \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Service\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9 \u0686\u0647 \u0648\u06cc\u0698\u06af\u06cc\u200c\u0647\u0627\u06cc\u06cc \u062f\u0627\u0631\u0646\u062f\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u062a\u0631\u06a9\u06cc\u0628 \u0632\u06cc\u0631 \u0646\u06cc\u0627\u0632\u0645\u0646\u062f \u0628\u0631\u0631\u0633\u06cc \u0627\u0633\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Unknown Service\n+\nAuto Start\n+\nLocalSystem\n+\nExecutable in AppData<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Generic Service Name\n+\nUnsigned Executable\n+\nRecently Created<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0627\u0645 Service \u0645\u0639\u06cc\u0627\u0631 \u0642\u0627\u0628\u0644 \u0627\u0639\u062a\u0645\u0627\u062f\u06cc \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0644\u0627\u064b \u0646\u0627\u0645\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>WindowsUpdateHelper\nSystemMonitor\nSecurityAgent<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0642\u0627\u0646\u0648\u0646\u06cc \u06cc\u0627 \u0635\u0631\u0641\u0627\u064b Masquerading \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0633\u06cc\u0631 Service \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u0645 Service \u0645\u0648\u0631\u062f\u0646\u0638\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ExampleService<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_Service |\nWhere-Object {\n    $_.Name -eq \"ExampleService\"\n} |\nFormat-List *<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633 Executable \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Item \"C:\\Path\\Service.exe\" |\nFormat-List *<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Hash:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-FileHash `\n\"C:\\Path\\Service.exe\" `\n-Algorithm SHA256<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Signature:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-AuthenticodeSignature `\n\"C:\\Path\\Service.exe\"<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Event ID 7045<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u0642\u062a\u06cc Service \u062c\u062f\u06cc\u062f\u06cc \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 Install \u0634\u0648\u062f\u060c Service Control Manager \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f Event:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>7045<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 System Log \u062b\u0628\u062a \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft Event 7045 \u0631\u0627 \u0628\u0627 \u0639\u0628\u0627\u0631\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>A service was installed in the system<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0645\u0627\u06cc\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f \u0648 Event \u0634\u0627\u0645\u0644 Service Name\u060c File Name\u060c Start Type \u0648 Service Account \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName='System'\n    Id=7045\n} -MaxEvents 50 |\nSelect-Object TimeCreated,Message<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Event ID 4697<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Security Auditing \u0646\u06cc\u0632 Event:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4697<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0628\u0631\u0627\u06cc \u062a\u0644\u0627\u0634 \u062c\u0647\u062a Install \u06a9\u0631\u062f\u0646 Service \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u062f\u0627\u0631\u062f \u0648 Microsoft \u0622\u0646 \u0631\u0627 \u062f\u0631 \u0641\u0647\u0631\u0633\u062a Event\u0647\u0627\u06cc \u0642\u0627\u0628\u0644 \u0645\u0627\u0646\u06cc\u062a\u0648\u0631 Security \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4697\n} -MaxEvents 50<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f Event \u0628\u0647 Audit Policy \u0633\u06cc\u0633\u062a\u0645 \u0628\u0633\u062a\u06af\u06cc \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0633\u0648\u0645: \u0628\u0631\u0631\u0633\u06cc Registry Run \u0648 RunOnce<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Windows \u062f\u0627\u0631\u0627\u06cc Registry Key\u0647\u0627\u06cc\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc Program \u0647\u0646\u06af\u0627\u0645 Login \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0686\u0647\u0627\u0631 \u0645\u0633\u06cc\u0631 \u0627\u0635\u0644\u06cc \u0639\u0628\u0627\u0631\u062a\u200c\u0627\u0646\u062f \u0627\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n\nHKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n\nHKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n\nHKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 <code>Run<\/code> \u062f\u0631 \u0647\u0631 Login \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u0634\u0648\u062f \u0648 <code>RunOnce<\/code> \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc \u06cc\u06a9\u200c\u0628\u0627\u0631\u0647 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Run Key \u0628\u0627 PowerShell<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ItemProperty `\n\"HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ItemProperty `\n\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">RunOnce:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ItemProperty `\n\"HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ItemProperty `\n\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\"<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0646\u0633\u062e\u0647 32 \u0628\u06cc\u062a\u06cc Registry \u0631\u0627 \u0641\u0631\u0627\u0645\u0648\u0634 \u0646\u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u06cc Windows 64-bit \u0628\u0639\u0636\u06cc Application\u0647\u0627\u06cc 32-bit \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Entry\u0647\u0627\u06cc \u062e\u0648\u062f \u0631\u0627 \u062f\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0642\u0631\u0627\u0631 \u062f\u0647\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ItemProperty `\n\"HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\" `\n-ErrorAction SilentlyContinue<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Run Entry \u0645\u0634\u06a9\u0648\u06a9 \u0686\u0647 \u0648\u06cc\u0698\u06af\u06cc\u200c\u0647\u0627\u06cc\u06cc \u062f\u0627\u0631\u062f\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0648\u0627\u0631\u062f\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Unknown Value Name\n+\nExecutable in AppData<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>System-like Name\n+\nUnsigned Binary<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PowerShell \/ Script Interpreter\n+\nUnexpected Script<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">MITRE \u0646\u06cc\u0632 Registry Run Keys \u0648 Startup Folder \u0631\u0627 \u0627\u0632 \u0646\u0642\u0627\u0637 \u0634\u0646\u0627\u062e\u062a\u0647\u200c\u0634\u062f\u0647 Autostart \u0648 Persistence \u062f\u0631 Windows \u0637\u0628\u0642\u0647\u200c\u0628\u0646\u062f\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Registry Entry \u0631\u0627 \u062d\u0630\u0641 \u0646\u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Entry \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0631\u062f\u06cc\u062f\u060c \u0627\u0628\u062a\u062f\u0627 \u0622\u0646 \u0631\u0627 Export \u06cc\u0627 \u062b\u0628\u062a \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg query \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ItemProperty `\n\"HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" |\nFormat-List *<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 \u0641\u0627\u06cc\u0644 \u0627\u0634\u0627\u0631\u0647\u200c\u0634\u062f\u0647 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0686\u0647\u0627\u0631\u0645: \u0628\u0631\u0631\u0633\u06cc Startup Folder<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u0645\u0648\u062c\u0648\u062f \u062f\u0631 Startup Folder \u0646\u06cc\u0632 \u0647\u0646\u06af\u0627\u0645 Login \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f \u0648 MITRE \u0627\u06cc\u0646 \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645 \u0631\u0627 \u0647\u0645\u0631\u0627\u0647 \u0628\u0627 Registry Run Keys \u062f\u0631 T1547.001 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Startup Folder \u06a9\u0627\u0631\u0628\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\Users\\&lt;User&gt;\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Startup Folder \u0645\u0634\u062a\u0631\u06a9:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Startup \u06a9\u0627\u0631\u0628\u0631 \u0641\u0639\u0644\u06cc \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem `\n\"$env:APPDATA\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" `\n-Force<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Startup \u0639\u0645\u0648\u0645\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem `\n\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\" `\n-Force<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Startup Folder \u062a\u0645\u0627\u0645 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem `\n\"C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" `\n-Force `\n-ErrorAction SilentlyContinue<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.exe\n.bat\n.cmd\n.vbs\n.ps1\n.lnk<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062a\u0648\u062c\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 \u0648\u062c\u0648\u062f \u0622\u0646\u0647\u0627 \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0645\u062e\u0631\u0628 \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Shortcut\u0647\u0627 \u0631\u0627 \u062c\u062f\u06cc \u0628\u06af\u06cc\u0631\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0627\u06cc\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.lnk<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0646\u0627\u0645 \u06a9\u0627\u0645\u0644\u0627\u064b \u0639\u0627\u062f\u06cc \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f \u0627\u0645\u0627 Target \u062f\u06cc\u06af\u0631\u06cc \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc Shortcut \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0627\u0632 PowerShell \u0648 WScript Shell \u0628\u0647\u200c\u0635\u0648\u0631\u062a Read-only \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$Shell = New-Object -ComObject WScript.Shell\n\n$Shortcut = $Shell.CreateShortcut(\n    \"C:\\Path\\Example.lnk\"\n)\n\n$Shortcut.TargetPath\n$Shortcut.Arguments<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Target \u0648 Arguments \u0631\u0627 \u0628\u0627 Application \u0645\u0648\u0631\u062f \u0627\u0646\u062a\u0638\u0627\u0631 \u0645\u0642\u0627\u06cc\u0633\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u067e\u0646\u062c\u0645: \u0628\u0631\u0631\u0633\u06cc Winlogon<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Winlogon \u06cc\u06a9\u06cc \u062f\u06cc\u06af\u0631 \u0627\u0632 \u0646\u0642\u0627\u0637 \u062d\u0633\u0627\u0633 Windows \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">MITRE \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 Registry \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Winlogon \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0631\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc DLL \u06cc\u0627 Executable \u062f\u0631 \u0632\u0645\u0627\u0646 Login \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u06cc\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u06cc\u0631 \u0627\u0635\u0644\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ItemProperty `\n\"HKLM:\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" |\nSelect-Object Shell,Userinit<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Shell \u0648 Userinit<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u0645\u0639\u0645\u0648\u0644\u06cc \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0627\u06cc\u062f \u0645\u0642\u0627\u062f\u06cc\u0631 \u0627\u06cc\u0646 \u0628\u062e\u0634 \u0628\u0627 Baseline \u0627\u0633\u062a\u0627\u0646\u062f\u0627\u0631\u062f Windows \u0645\u0637\u0627\u0628\u0642\u062a \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0648 Property \u0645\u0647\u0645:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Shell\nUserinit<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0633\u062a\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">MITRE \u0628\u0647\u200c\u0637\u0648\u0631 \u0645\u0634\u062e\u0635 <code>Shell<\/code> \u0648 <code>Userinit<\/code> \u0631\u0627 \u0627\u0632 \u0642\u0633\u0645\u062a\u200c\u0647\u0627\u06cc\u06cc \u0645\u0639\u0631\u0641\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u0647 \u062a\u063a\u06cc\u06cc\u0631 \u0622\u0646\u0647\u0627 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0627\u0639\u062b \u0627\u062c\u0631\u0627\u06cc \u0645\u062c\u062f\u062f \u06a9\u062f \u062f\u0631 Login \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0631 \u0645\u0633\u06cc\u0631 \u0627\u0636\u0627\u0641\u06cc \u06cc\u0627 Executable \u0646\u0627\u0634\u0646\u0627\u0633 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">HKCU Winlogon \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ItemProperty `\n\"HKCU:\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" `\n-ErrorAction SilentlyContinue<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f Configuration \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647 \u062f\u0631 User Scope \u0646\u06cc\u0632 \u0628\u0627\u06cc\u062f Investigation \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0634\u0634\u0645: \u0628\u0631\u0631\u0633\u06cc WMI Persistence<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Windows Management Instrumentation \u06cc\u0627:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>WMI<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f Event Subscription \u062f\u0627\u0626\u0645\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u062f Permanent WMI Consumer\u0647\u0627 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0639\u062f \u0627\u0632 Restart \u0633\u06cc\u0633\u062a\u0645 \u0646\u06cc\u0632 \u0628\u0627\u0642\u06cc \u0628\u0645\u0627\u0646\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">MITRE \u0646\u06cc\u0632 WMI Event Subscription \u0631\u0627 \u06cc\u06a9 \u062a\u06a9\u0646\u06cc\u06a9 Persistence \u0645\u0639\u0631\u0641\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9 WMI Subscription \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0627\u0632 \u0633\u0647 \u0642\u0633\u0645\u062a \u062a\u0634\u06a9\u06cc\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Event Filter\nConsumer\nBinding<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">WMI Event Filter\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance `\n-Namespace root\\subscription `\n-ClassName __EventFilter<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 Property\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Name\nQuery\nEventNamespace<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062a\u0648\u062c\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">CommandLine Event Consumer\u0647\u0627<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance `\n-Namespace root\\subscription `\n-ClassName CommandLineEventConsumer<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0648\u0627\u0631\u062f \u0645\u0647\u0645:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Name\nCommandLineTemplate\nExecutablePath<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Consumer \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 Command \u06cc\u0627 Script \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">ActiveScript Event Consumer\u0647\u0627<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance `\n-Namespace root\\subscription `\n-ClassName ActiveScriptEventConsumer<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f Script Consumer \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0631\u0648\u06cc Server \u0628\u0627\u06cc\u062f \u0628\u0627 Configuration \u0633\u0627\u0632\u0645\u0627\u0646 \u0645\u0642\u0627\u06cc\u0633\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Binding\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance `\n-Namespace root\\subscription `\n-ClassName __FilterToConsumerBinding<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Binding \u0645\u0634\u062e\u0635 \u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u062f\u0627\u0645 Filter \u0628\u0647 \u06a9\u062f\u0627\u0645 Consumer \u0645\u062a\u0635\u0644 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Investigation \u0628\u0627\u06cc\u062f \u0647\u0631 \u0633\u0647 \u0642\u0633\u0645\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Filter\nConsumer\nBinding<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627 \u06cc\u06a9\u062f\u06cc\u06af\u0631 \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Sysmon \u0648 WMI Persistence<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Sysmon \u0627\u0632 \u0642\u0628\u0644 \u0646\u0635\u0628 \u0648 Config \u0634\u062f\u0647 \u0628\u0627\u0634\u062f\u060c Event\u0647\u0627\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>19 = WMI Event Filter\n20 = WMI Event Consumer\n21 = WMI Filter-to-Consumer Binding<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f WMI Registration \u0631\u0627 \u062b\u0628\u062a \u06a9\u0646\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u062a\u0646\u062f\u0627\u062a \u0641\u0639\u0644\u06cc Microsoft \u0627\u06cc\u0646 Event\u0647\u0627 \u0631\u0627 \u0645\u0634\u062e\u0635\u0627\u064b \u0628\u0631\u0627\u06cc WMI \u0648 \u062a\u0634\u062e\u06cc\u0635 Persistence \u0648 Fileless Activity \u0645\u0639\u0631\u0641\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName='Microsoft-Windows-Sysmon\/Operational'\n    Id=19,20,21\n} -MaxEvents 100 |\nSelect-Object TimeCreated,Id,Message<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0647\u0641\u062a\u0645: \u0628\u0631\u0631\u0633\u06cc PowerShell Profile<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">PowerShell \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062f\u0631 \u0632\u0645\u0627\u0646 \u0634\u0631\u0648\u0639 Session \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Profile \u0631\u0627 Load \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft \u0628\u0631\u0627\u06cc PowerShell \u0686\u0646\u062f Profile \u0645\u062e\u062a\u0644\u0641 \u062f\u0631 \u0633\u0637\u062d User \u0648 All Users \u062a\u0639\u0631\u06cc\u0641 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Profile \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Session \u0641\u0639\u0644\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$PROFILE<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u062a\u0645\u0627\u0645 Profile Path\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$PROFILE | Format-List *<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0622\u06cc\u0627 Profile \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f\u061f<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>Test-Path $PROFILE<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Item $PROFILE |\nFormat-List *<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 \u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0645\u062d\u062a\u0648\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Content $PROFILE<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Profile\u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641 PowerShell<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>$PROFILE.AllUsersAllHosts\n$PROFILE.AllUsersCurrentHost\n$PROFILE.CurrentUserAllHosts\n$PROFILE.CurrentUserCurrentHost<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062a\u0645\u0627\u0645 \u0627\u06cc\u0646 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u062f\u0631 Investigation \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">PowerShell 5 \u0648 PowerShell 7<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u06cc \u06cc\u06a9 Server \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0647\u0631 \u062f\u0648 \u0646\u0633\u062e\u0647 \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Windows PowerShell\nPowerShell 7<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 Profile Path\u0647\u0627\u06cc \u0622\u0646\u0647\u0627 \u0627\u0644\u0632\u0627\u0645\u0627\u064b \u06cc\u06a9\u0633\u0627\u0646 \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0641\u0642\u0637 Profile \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Shell \u0641\u0639\u0644\u06cc \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062f\u0631 PowerShell Profile \u062f\u0646\u0628\u0627\u0644 \u0686\u0647 \u0686\u06cc\u0632\u06cc \u0628\u06af\u0631\u062f\u06cc\u0645\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0648\u0627\u0631\u062f \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647 \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Execution of unknown script\nExternal download\nHidden process\nUnknown module import\nEncoded command\nExecutable from AppData<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u06cc\u062f Investigation \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u0686\u0646\u06cc\u0646 Timestamp \u0641\u0627\u06cc\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Item $PROFILE |\nSelect-Object FullName,\n              CreationTime,\n              LastWriteTime<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0631\u0627\u06cc Timeline \u0645\u0641\u06cc\u062f \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0647\u0634\u062a\u0645: \u0628\u0631\u0631\u0633\u06cc Local User\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Persistence \u0627\u0644\u0632\u0627\u0645\u0627\u064b \u0628\u0647 \u0645\u0639\u0646\u06cc \u0627\u062c\u0631\u0627\u06cc \u062e\u0648\u062f\u06a9\u0627\u0631 Program \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Account \u062c\u062f\u06cc\u062f\u06cc \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Local User\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-LocalUser<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062e\u0631\u0648\u062c\u06cc \u06a9\u0627\u0631\u0628\u0631\u062f\u06cc\u200c\u062a\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-LocalUser |\nSelect-Object Name,\n              Enabled,\n              LastLogon,\n              PasswordLastSet,\n              SID<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Account\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Administrator\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-LocalGroupMember Administrators |\nSelect-Object Name,\n              ObjectClass,\n              PrincipalSource<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Unknown Local User\nUnknown Domain User\nUnexpected Domain Group<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Administrators \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f Persistence \u0627\u0632 \u0637\u0631\u06cc\u0642 Account \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Built-in Administrator<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062d\u062a\u06cc \u0627\u06af\u0631 Rename \u0634\u062f\u0647 \u0628\u0627\u0634\u062f \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0622\u0646 \u0631\u0627 \u0628\u0631\u0627\u0633\u0627\u0633 SID \u0628\u0627 RID:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>500<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-LocalUser |\nWhere-Object {\n    $_.SID.Value -match '-500$'\n}<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Event\u0647\u0627\u06cc Account Management<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Investigation \u06a9\u0627\u0631\u0628\u0631\u0627\u0646\u060c Event\u0647\u0627\u06cc \u0632\u06cc\u0631 \u0645\u0641\u06cc\u062f\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4720 = User Created\n4722 = User Enabled\n4725 = User Disabled\n4726 = User Deleted\n4732 = Member Added to Local Security Group\n4738 = User Changed<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4720,4722,4725,4726,4732,4738\n} -MaxEvents 100 |\nSelect-Object TimeCreated,Id,Message<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0646\u0647\u0645: \u0628\u0631\u0631\u0633\u06cc Autoruns<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0628\u0647\u062a\u0631\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc Microsoft \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc Autostart Location\u0647\u0627\u06cc Windows:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Autoruns<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0632 \u0645\u062c\u0645\u0648\u0639\u0647 Sysinternals \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft \u062a\u0648\u0636\u06cc\u062d \u0645\u06cc\u200c\u062f\u0647\u062f Autoruns \u062a\u0639\u062f\u0627\u062f \u0632\u06cc\u0627\u062f\u06cc \u0627\u0632 \u0646\u0642\u0627\u0637 \u0627\u062c\u0631\u0627\u06cc \u062e\u0648\u062f\u06a9\u0627\u0631 Windows \u0631\u0627 \u0646\u0645\u0627\u06cc\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f\u060c \u0627\u0632 \u062c\u0645\u0644\u0647:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Startup Folder<\/li>\n\n\n\n<li>Run<\/li>\n\n\n\n<li>RunOnce<\/li>\n\n\n\n<li>Services<\/li>\n\n\n\n<li>Scheduled Tasks<\/li>\n\n\n\n<li>Winlogon<\/li>\n\n\n\n<li>WMI<\/li>\n\n\n\n<li>Explorer Extensions<\/li>\n\n\n\n<li>Drivers<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 \u0633\u0627\u06cc\u0631 Autostart Location\u0647\u0627.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u0631\u0627 Autoruns \u0645\u0641\u06cc\u062f \u0627\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647\u200c\u062c\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u062f\u0633\u062a\u06cc \u062f\u0647\u200c\u0647\u0627 Registry Path \u0648 Folder \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 \u0622\u0646\u0647\u0627 \u0631\u0627 \u062f\u0631 \u06cc\u06a9 Interface \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Tab\u0647\u0627\u06cc \u0645\u0647\u0645 \u0628\u0631\u0627\u06cc Investigation \u0639\u0628\u0627\u0631\u062a\u200c\u0627\u0646\u062f \u0627\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Logon\nScheduled Tasks\nServices\nDrivers\nWMI\nWinlogon<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Hide Microsoft Entries<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Autoruns \u06af\u0632\u06cc\u0646\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Hide Signed Microsoft Entries<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0627\u0631\u062f \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062a\u0645\u0631\u06a9\u0632 Investigation \u0631\u0627 \u0631\u0648\u06cc Third-party Autostart Entry\u0647\u0627 \u0628\u06cc\u0634\u062a\u0631 \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Signed \u0628\u0648\u062f\u0646 \u06cc\u0627 Microsoft \u0646\u0628\u0648\u062f\u0646 \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0645\u0639\u06cc\u0627\u0631 \u0633\u0627\u0644\u0645 \u06cc\u0627 \u0645\u062e\u0631\u0628 \u0628\u0648\u062f\u0646 \u0646\u06cc\u0633\u062a.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Autoruns \u0628\u0627\u06cc\u062f \u0628\u0631\u0627\u06cc \u06a9\u0627\u0647\u0634 Noise \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u0648\u062f\u060c \u0646\u0647 \u0646\u062a\u06cc\u062c\u0647\u200c\u06af\u06cc\u0631\u06cc \u0642\u0637\u0639\u06cc.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Autorunsc<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0633\u062e\u0647 Command Line \u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Autorunsc<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft \u0627\u0639\u0644\u0627\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f Autorunsc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062e\u0631\u0648\u062c\u06cc \u0631\u0627 \u0628\u0647 CSV \u06cc\u0627 XML \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0646\u062f \u0648 \u0645\u0648\u0627\u0631\u062f\u06cc \u0645\u0627\u0646\u0646\u062f Hash \u0648 Signature Verification \u0631\u0627 \u0646\u06cc\u0632 \u0646\u0645\u0627\u06cc\u0634 \u062f\u0647\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0642\u0627\u0628\u0644\u06cc\u062a \u0628\u0631\u0627\u06cc Incident Response \u0648 \u0645\u0642\u0627\u06cc\u0633\u0647 Baseline \u0628\u0633\u06cc\u0627\u0631 \u0645\u0641\u06cc\u062f \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u062f\u0647\u0645: \u0628\u0631\u0631\u0633\u06cc Registry \u0628\u0627 Sysmon<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Sysmon \u0628\u0647\u200c\u062f\u0631\u0633\u062a\u06cc Config \u0634\u062f\u0647 \u0628\u0627\u0634\u062f\u060c \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a Registry \u0646\u06cc\u0632 \u0642\u0627\u0628\u0644 \u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u0647\u0633\u062a\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">MITRE \u062f\u0631 Detection Strategy \u0645\u0631\u062a\u0628\u0637 \u0628\u0627 Registry Startup Persistence \u0628\u0647 Event\u0647\u0627\u06cc Registry \u0648 Process Creation Sysmon \u0628\u0631\u0627\u06cc Correlation \u0627\u0634\u0627\u0631\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc Event\u0647\u0627\u06cc Registry:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName='Microsoft-Windows-Sysmon\/Operational'\n    Id=12,13,14\n} -MaxEvents 200<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0633\u062a\u0647 \u0628\u0647 Configuration Sysmon \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Registry Key Create\/Delete\nRegistry Value Set\nRegistry Key\/Value Rename<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062b\u0628\u062a \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Event\u0647\u0627 \u0631\u0627 \u0628\u0627 Process Creation \u062a\u0631\u06a9\u06cc\u0628 \u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9 Registry Entry \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u06a9\u0627\u0641\u06cc \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0644\u0627\u064b \u0627\u06af\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Run Key modified<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 \u06a9\u0645\u06cc \u0628\u0639\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Unknown.exe executed<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0646\u06cc\u062f\u060c Evidence \u0642\u0648\u06cc\u200c\u062a\u0631\u06cc \u062f\u0627\u0631\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sysmon Event:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Process Creation \u06a9\u0627\u0631\u0628\u0631\u062f \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 Correlation:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Registry Modification\n       |\n       v\nProcess Execution<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0647\u0645\u06cc\u062a \u0632\u06cc\u0627\u062f\u06cc \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u06cc\u0627\u0632\u062f\u0647\u0645: Process\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Persistence \u062f\u0631 \u0646\u0647\u0627\u06cc\u062a \u0645\u0639\u0645\u0648\u0644\u0627\u064b Process\u06cc \u0631\u0627 \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-Process<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u0647\u062a\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_Process |\nSelect-Object ProcessId,\n              ParentProcessId,\n              Name,\n              ExecutablePath,\n              CommandLine<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647\u200c\u062e\u0635\u0648\u0635:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ParentProcessId\nExecutablePath\nCommandLine<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Process Tree \u0686\u0631\u0627 \u0645\u0647\u0645 \u0627\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u062f \u06cc\u06a9 Executable \u0646\u0627\u0634\u0646\u0627\u0633 \u0627\u0632 Startup \u0627\u062c\u0631\u0627 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0633\u0627\u062e\u062a\u0627\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>explorer.exe\n     |\n     v\nunknown.exe<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u06cc\u062f\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627 Service:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>services.exe\n     |\n     v\nunknown.exe<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627 Scheduled Task:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>taskeng \/ taskhost\n     |\n     v\npowershell.exe<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Parent Process \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u062a\u0634\u062e\u06cc\u0635 Persistence Mechanism \u06a9\u0645\u06a9 \u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Network Connection\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9 Persistence \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0628\u0639\u062f \u0627\u0632 \u0627\u062c\u0631\u0627 Connection \u062e\u0627\u0631\u062c\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetTCPConnection -State Established<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0646\u0645\u0627\u06cc\u0634 Process:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetTCPConnection -State Established |\nSelect-Object RemoteAddress,\n              RemotePort,\n              OwningProcess,\n              @{Name=\"Process\";Expression={\n                  (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName\n              }}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Service \u06cc\u0627 Task \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0628\u0647 Destination \u062e\u0627\u0631\u062c\u06cc \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647 \u0645\u062a\u0635\u0644 \u0634\u062f\u0647 \u0628\u0627\u0634\u062f\u060c Investigation \u0627\u0647\u0645\u06cc\u062a \u0628\u06cc\u0634\u062a\u0631\u06cc \u067e\u06cc\u062f\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u062f\u0631 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc \u062d\u0633\u0627\u0633<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u06cc\u0631\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\ProgramData\nC:\\Users\\Public\nC:\\Windows\\Temp\nC:\\Users\\&lt;User&gt;\\AppData<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0628\u0631\u0627\u0633\u0627\u0633 Timeline Incident \u0628\u0631\u0631\u0633\u06cc \u06a9\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0647\u0641\u062a \u0631\u0648\u0632 \u0627\u062e\u06cc\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem C:\\ProgramData -File -Recurse -ErrorAction SilentlyContinue |\nWhere-Object {\n    $_.LastWriteTime -gt (Get-Date).AddDays(-7)\n} |\nSelect-Object FullName,\n              Length,\n              CreationTime,\n              LastWriteTime<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u06cc Server\u0647\u0627\u06cc \u0628\u0632\u0631\u06af \u062c\u0633\u062a\u062c\u0648\u06cc Recursive \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0632\u0645\u0627\u0646\u200c\u0628\u0631 \u0628\u0627\u0634\u062f\u061b \u0628\u0627\u0632\u0647 \u0648 \u0645\u0633\u06cc\u0631 \u0631\u0627 \u0628\u0631\u0627\u0633\u0627\u0633 Incident \u0645\u062d\u062f\u0648\u062f \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u06cc\u06a9 Workflow \u0639\u0645\u0644\u06cc \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc Persistence<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u0645 \u0631\u0648\u06cc \u06cc\u06a9 Windows Server \u0627\u062d\u062a\u0645\u0627\u0644 Compromise \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0627\u0648\u0644: Process\u0647\u0627<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_Process |\nSelect ProcessId,\n       ParentProcessId,\n       Name,\n       ExecutablePath,\n       CommandLine<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u062f\u0648\u0645: Network<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-NetTCPConnection -State Established<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0633\u0648\u0645: Scheduled Tasks<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ScheduledTask<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ScheduledTask |\nForEach-Object {\n    &#91;PSCustomObject]@{\n        TaskName = $_.TaskName\n        TaskPath = $_.TaskPath\n        RunAs    = $_.Principal.UserId\n        Action   = ($_.Actions.Execute -join ',')\n        Args     = ($_.Actions.Arguments -join ',')\n    }\n}<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0686\u0647\u0627\u0631\u0645: Services<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_Service |\nSelect Name,\n       State,\n       StartMode,\n       StartName,\n       PathName<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u067e\u0646\u062c\u0645: Run Keys<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ItemProperty `\n\"HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ItemProperty `\n\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0634\u0634\u0645: Startup Folder<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ChildItem `\n\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\" `\n-Force<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0647\u0641\u062a\u0645: Winlogon<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ItemProperty `\n\"HKLM:\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" |\nSelect Shell,Userinit<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0647\u0634\u062a\u0645: WMI<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance `\n-Namespace root\\subscription `\n-ClassName __EventFilter<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance `\n-Namespace root\\subscription `\n-ClassName CommandLineEventConsumer<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance `\n-Namespace root\\subscription `\n-ClassName __FilterToConsumerBinding<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0646\u0647\u0645: PowerShell Profile<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>$PROFILE | Format-List *<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u062f\u0647\u0645: User\u0647\u0627 \u0648 Administrator\u0647\u0627<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-LocalUser<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-LocalGroupMember Administrators<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u06cc\u0627\u0632\u062f\u0647\u0645: Event\u0647\u0627<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName='Security'\n    Id=4698,4702,4697,4720,4732\n} -MaxEvents 100<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-WinEvent -FilterHashtable @{\n    LogName='System'\n    Id=7045\n} -MaxEvents 50<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u06cc\u06a9 Audit \u0627\u0648\u0644\u06cc\u0647 \u0628\u0627 PowerShell<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0633\u0631\u06cc\u0639 \u0686\u0646\u062f \u0646\u0642\u0637\u0647 \u0627\u0635\u0644\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Write-Host \"`n=== SCHEDULED TASKS ===\"\n\nGet-ScheduledTask |\nSelect TaskName,\n       TaskPath,\n       State,\n       @{N='RunAs';E={$_.Principal.UserId}}\n\n\nWrite-Host \"`n=== AUTO START SERVICES ===\"\n\nGet-CimInstance Win32_Service |\nWhere-Object {\n    $_.StartMode -eq 'Auto'\n} |\nSelect Name,\n       State,\n       StartName,\n       PathName\n\n\nWrite-Host \"`n=== HKLM RUN ===\"\n\nGet-ItemProperty `\n\"HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" `\n-ErrorAction SilentlyContinue\n\n\nWrite-Host \"`n=== STARTUP FOLDER ===\"\n\nGet-ChildItem `\n\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\" `\n-Force `\n-ErrorAction SilentlyContinue\n\n\nWrite-Host \"`n=== LOCAL ADMINS ===\"\n\nGet-LocalGroupMember Administrators |\nSelect Name,\n       ObjectClass,\n       PrincipalSource<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 Script \u0647\u06cc\u0686 Persistence Mechanism \u062c\u062f\u06cc\u062f\u06cc \u0627\u06cc\u062c\u0627\u062f \u0646\u0645\u06cc\u200c\u06a9\u0646\u062f \u0648 \u0641\u0642\u0637 Inventory \u0627\u0648\u0644\u06cc\u0647 \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u062f\u0647\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u0647 \u062a\u0631\u06a9\u06cc\u0628\u200c\u0647\u0627\u06cc\u06cc \u0628\u06cc\u0634\u062a\u0631 \u0645\u0634\u06a9\u0648\u06a9 \u0647\u0633\u062a\u0646\u062f\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>New Scheduled Task\n+\nPowerShell\n+\nRuns as SYSTEM\n+\nUnknown Script<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>New Service\n+\nAuto Start\n+\nUnsigned Executable\n+\nAppData Path<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Run Registry Entry\n+\nRecently Created EXE\n+\nExternal Network Connection<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>WMI Consumer\n+\nUnknown Command\n+\nSysmon Events 19\/20\/21<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Unknown Local User\n+\nAdministrators Membership\n+\nRecent RDP Login<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9 Indicator \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0631\u0627\u06cc \u0646\u062a\u06cc\u062c\u0647\u200c\u06af\u06cc\u0631\u06cc \u06a9\u0627\u0641\u06cc \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Persistence \u0645\u0634\u06a9\u0648\u06a9 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u06cc\u0645\u061b \u0686\u0647 \u06a9\u0646\u06cc\u0645\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0648\u0631\u0627\u064b \u0622\u0646 \u0631\u0627 Delete \u0646\u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u062a\u062f\u0627 \u062b\u0628\u062a \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Name\nPath\nUser\nCommand Line\nCreation Time\nLast Write Time\nHash\nDigital Signature\nRelated Logs\nNetwork Connections<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0641\u0627\u06cc\u0644 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-FileHash `\n\"C:\\Path\\File.exe\" `\n-Algorithm SHA256<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-AuthenticodeSignature `\n\"C:\\Path\\File.exe\"<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Export \u06a9\u0631\u062f\u0646 Scheduled Task \u0645\u0634\u06a9\u0648\u06a9<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u0627\u0637\u0644\u0627\u0639\u0627\u062a Task \u0631\u0627 \u0642\u0628\u0644 \u0627\u0632 \u062a\u063a\u06cc\u06cc\u0631 \u0630\u062e\u06cc\u0631\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ScheduledTask -TaskName \"ExampleTask\" |\nExport-Clixml C:\\IR\\ExampleTask.xml<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u0686\u0646\u06cc\u0646 Event\u0647\u0627\u06cc \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Task \u0631\u0627 \u0630\u062e\u06cc\u0631\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0637\u0644\u0627\u0639\u0627\u062a Service \u0631\u0627 \u0630\u062e\u06cc\u0631\u0647 \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_Service |\nWhere-Object {\n    $_.Name -eq \"ExampleService\"\n} |\nExport-Clixml C:\\IR\\ExampleService.xml<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Registry Evidence \u0631\u0627 \u062b\u0628\u062a \u06a9\u0646\u06cc\u0645<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>reg export \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" C:\\IR\\HKLM_Run.reg<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u06a9\u0627\u0631 \u0642\u0628\u0644 \u0627\u0632 Remediation \u06a9\u0645\u06a9 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0648\u0636\u0639\u06cc\u062a \u0641\u0639\u0644\u06cc Registry \u062d\u0641\u0638 \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u0631\u0627 \u062d\u0630\u0641 \u0641\u0648\u0631\u06cc \u0627\u0634\u062a\u0628\u0627\u0647 \u0627\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0631\u0636 \u06a9\u0646\u06cc\u062f \u06cc\u06a9 Scheduled Task \u0645\u0634\u06a9\u0648\u06a9 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0647\u200c\u0627\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0641\u0648\u0631\u0627\u064b Task \u0631\u0627 \u062d\u0630\u0641 \u06a9\u0646\u06cc\u062f \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Task Action\nArguments\nUser\nTrigger\nCreation Context<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0627\u0632 \u062f\u0633\u062a \u0628\u062f\u0647\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u062f\u0641 Investigation \u0641\u0642\u0637 \u062d\u0630\u0641 Persistence \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u06cc\u062f \u0645\u0634\u062e\u0635 \u0634\u0648\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Initial Access \u0686\u0647 \u0628\u0648\u062f\u0647\u061f<\/li>\n\n\n\n<li>Persistence \u0686\u0647 \u0632\u0645\u0627\u0646\u06cc \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647\u061f<\/li>\n\n\n\n<li>\u0686\u0647 Account\u06cc \u0622\u0646 \u0631\u0627 \u0627\u06cc\u062c\u0627\u062f \u06a9\u0631\u062f\u0647\u061f<\/li>\n\n\n\n<li>Payload \u0627\u0632 \u06a9\u062c\u0627 \u0622\u0645\u062f\u0647\u061f<\/li>\n\n\n\n<li>Credential \u062f\u06cc\u06af\u0631\u06cc Compromise \u0634\u062f\u0647\u061f<\/li>\n\n\n\n<li>\u0633\u06cc\u0633\u062a\u0645 \u062f\u06cc\u06af\u0631\u06cc \u0646\u06cc\u0632 \u062f\u0631\u06af\u06cc\u0631 \u0627\u0633\u062a\u061f<\/li>\n\n\n\n<li>\u0686\u0647 Network Connection\u0647\u0627\u06cc\u06cc \u0628\u0631\u0642\u0631\u0627\u0631 \u0634\u062f\u0647\u061f<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Root Cause \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Persistence \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0645\u0631\u062d\u0644\u0647\u200c\u0627\u06cc \u0628\u0639\u062f \u0627\u0632 Initial Access \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Initial Access \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0627\u0632 \u0637\u0631\u06cc\u0642:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>RDP Compromise\nStolen Credentials\nWeb Vulnerability\nMalicious File\nPhishing\nVulnerable Service\nRemote Management<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Persistence \u062d\u0630\u0641 \u0634\u0648\u062f \u0648\u0644\u06cc Root Cause \u0628\u0627\u0642\u06cc \u0628\u0645\u0627\u0646\u062f\u060c \u0645\u0647\u0627\u062c\u0645 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u062f\u0648\u0628\u0627\u0631\u0647 \u0648\u0627\u0631\u062f \u0633\u06cc\u0633\u062a\u0645 \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Credential\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Administrative Access \u062a\u0623\u06cc\u06cc\u062f \u0634\u062f\u0647 \u0627\u0633\u062a\u060c Scope Credential Exposure \u0628\u0627\u06cc\u062f \u0645\u0634\u062e\u0635 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0644\u0627\u0632\u0645 \u0628\u0627\u0634\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Local Administrator Password\nDomain Password\nService Accounts\nAPI Tokens\nDatabase Credentials\nCloud Credentials\nBackup Credentials<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u0633\u0627\u0633 Incident Response Plan \u0633\u0627\u0632\u0645\u0627\u0646 Rotate \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u0647 \u0632\u0645\u0627\u0646\u06cc Rebuild \u0628\u0647\u062a\u0631 \u0627\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0645\u0647\u0627\u062c\u0645 Administrative \u06cc\u0627 SYSTEM Access \u0637\u0648\u0644\u0627\u0646\u06cc\u200c\u0645\u062f\u062a \u062f\u0627\u0634\u062a\u0647 \u0648 \u0686\u0646\u062f Persistence Mechanism \u06cc\u0627 \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc \u0639\u0645\u06cc\u0642 \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u0647 \u0628\u0627\u0634\u062f\u060c \u067e\u0627\u06a9\u200c\u0633\u0627\u0632\u06cc \u062f\u0633\u062a\u06cc \u0647\u0645\u06cc\u0634\u0647 \u0642\u0627\u0628\u0644 \u0627\u0639\u062a\u0645\u0627\u062f \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0686\u0646\u06cc\u0646 \u0634\u0631\u0627\u06cc\u0637\u06cc \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Rebuild from trusted image\n+\nRestore known-good data\n+\nCredential rotation<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0632 \u062a\u0644\u0627\u0634 \u0628\u0631\u0627\u06cc \u062d\u0630\u0641 \u062a\u06a9\u200c\u062a\u06a9 Persistence\u0647\u0627 \u0645\u0637\u0645\u0626\u0646\u200c\u062a\u0631 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u062a\u0635\u0645\u06cc\u0645 \u0628\u0627\u06cc\u062f \u0628\u0631\u0627\u0633\u0627\u0633 Scope Incident \u0648 \u0633\u06cc\u0627\u0633\u062a \u0633\u0627\u0632\u0645\u0627\u0646 \u06af\u0631\u0641\u062a\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0627\u06cc \u067e\u06cc\u0634\u06af\u06cc\u0631\u06cc \u0686\u0647 \u06a9\u0646\u06cc\u0645\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0642\u062f\u0627\u0645\u0627\u062a \u0645\u0647\u0645 \u0639\u0628\u0627\u0631\u062a\u200c\u0627\u0646\u062f \u0627\u0632:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Least Privilege<\/li>\n\n\n\n<li>\u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 Local Administrator<\/li>\n\n\n\n<li>Windows LAPS<\/li>\n\n\n\n<li>Microsoft Defender \/ EDR<\/li>\n\n\n\n<li>Sysmon<\/li>\n\n\n\n<li>PowerShell Script Block Logging<\/li>\n\n\n\n<li>Process Creation Auditing<\/li>\n\n\n\n<li>Scheduled Task Auditing<\/li>\n\n\n\n<li>Service Installation Monitoring<\/li>\n\n\n\n<li>File Integrity Monitoring<\/li>\n\n\n\n<li>Application Control<\/li>\n\n\n\n<li>Centralized Logging<\/li>\n\n\n\n<li>SIEM<\/li>\n\n\n\n<li>Patch Management<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Baseline \u0628\u0633\u06cc\u0627\u0631 \u0645\u0647\u0645 \u0627\u0633\u062a<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0628\u0647\u062a\u0631\u06cc\u0646 \u0631\u0648\u0634\u200c\u0647\u0627\u06cc Detection \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 \u0628\u062f\u0627\u0646\u06cc\u0645 \u062d\u0627\u0644\u062a \u0639\u0627\u062f\u06cc Server \u0686\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0644\u0627\u064b Baseline \u0634\u0627\u0645\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Approved Services\nApproved Scheduled Tasks\nApproved Local Administrators\nApproved Run Entries\nApproved Startup Programs\nApproved WMI Subscriptions<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0627\u06cc\u0646 \u0635\u0648\u0631\u062a \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u062c\u062f\u06cc\u062f \u0628\u0633\u06cc\u0627\u0631 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0645\u0634\u062e\u0635 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Autoruns \u0628\u0631\u0627\u06cc Baseline<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u062e\u0631\u0648\u062c\u06cc Autostart\u0647\u0627\u06cc \u0633\u0627\u0644\u0645 Server \u0631\u0627 \u062f\u0631 \u0632\u0645\u0627\u0646 Deploy \u062b\u0628\u062a \u06a9\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0639\u062f\u0627\u064b \u062f\u0631 Incident \u06cc\u0627 Audit \u062e\u0631\u0648\u062c\u06cc \u062c\u062f\u06cc\u062f \u0628\u0627 Baseline \u0645\u0642\u0627\u06cc\u0633\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Autoruns \u0628\u0647 \u062f\u0644\u06cc\u0644 \u067e\u0648\u0634\u0634 \u06af\u0633\u062a\u0631\u062f\u0647 Autostart Location\u0647\u0627 \u0627\u0628\u0632\u0627\u0631 \u0645\u0646\u0627\u0633\u0628\u06cc \u0628\u0631\u0627\u06cc \u0686\u0646\u06cc\u0646 \u0645\u0642\u0627\u06cc\u0633\u0647\u200c\u0627\u06cc \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Log\u0647\u0627 \u0631\u0627 \u0645\u0631\u06a9\u0632\u06cc \u06a9\u0646\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Log \u0641\u0642\u0637 \u0631\u0648\u06cc Server \u0622\u0644\u0648\u062f\u0647 \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f\u060c Administrator \u0645\u0647\u0627\u062c\u0645 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0622\u0646 \u0631\u0627 \u062d\u0630\u0641 \u06cc\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0647\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Server\u0647\u0627\u06cc \u0645\u0647\u0645 \u0628\u0647\u062a\u0631 \u0627\u0633\u062a Log\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Security\nSystem\nPowerShell\nSysmon\nDefender\nTask Scheduler<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 SIEM \u06cc\u0627 Log Server \u0645\u0631\u06a9\u0632\u06cc \u0627\u0631\u0633\u0627\u0644 \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0634\u062a\u0628\u0627\u0647\u0627\u062a \u0631\u0627\u06cc\u062c<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u062e\u06cc \u0627\u0634\u062a\u0628\u0627\u0647\u0627\u062a \u0631\u0627\u06cc\u062c \u0647\u0646\u06af\u0627\u0645 \u0628\u0631\u0631\u0633\u06cc Persistence \u062f\u0631 Windows \u0639\u0628\u0627\u0631\u062a\u200c\u0627\u0646\u062f \u0627\u0632:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0628\u0631\u0631\u0633\u06cc \u0641\u0642\u0637 Scheduled Task<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 Windows Service<\/li>\n\n\n\n<li>\u0646\u0627\u062f\u06cc\u062f\u0647 \u06af\u0631\u0641\u062a\u0646 Run \u0648 RunOnce<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 Startup Folder<\/li>\n\n\n\n<li>\u0646\u0627\u062f\u06cc\u062f\u0647 \u06af\u0631\u0641\u062a\u0646 Winlogon<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 WMI Subscription<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 PowerShell Profile<\/li>\n\n\n\n<li>\u062a\u0648\u062c\u0647 \u0646\u06a9\u0631\u062f\u0646 Local User \u0648 Administrator<\/li>\n\n\n\n<li>\u0627\u0639\u062a\u0645\u0627\u062f \u0628\u0647 \u0646\u0627\u0645 Service \u06cc\u0627 Task<\/li>\n\n\n\n<li>\u062d\u0630\u0641 \u0641\u0648\u0631\u06cc Evidence<\/li>\n\n\n\n<li>\u0646\u062a\u06cc\u062c\u0647\u200c\u06af\u06cc\u0631\u06cc \u0641\u0642\u0637 \u0628\u0631\u0627\u0633\u0627\u0633 \u0641\u0627\u06cc\u0644 Unsigned<\/li>\n\n\n\n<li>\u0646\u0627\u062f\u06cc\u062f\u0647 \u06af\u0631\u0641\u062a\u0646 Event ID 4698<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 Event ID 7045<\/li>\n\n\n\n<li>\u0646\u0627\u062f\u06cc\u062f\u0647 \u06af\u0631\u0641\u062a\u0646 Sysmon Event\u0647\u0627\u06cc WMI<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 Network Activity<\/li>\n\n\n\n<li>\u067e\u06cc\u062f\u0627 \u0646\u06a9\u0631\u062f\u0646 Root Cause<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0647\u062a\u0631\u06cc\u0646 \u0631\u0648\u0634\u200c\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0635\u062d\u06cc\u062d Persistence:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Scheduled Task\u0647\u0627 \u0631\u0627 Baseline \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Action \u0648 Arguments \u0647\u0631 Task \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Service\u0647\u0627\u06cc Auto Start \u0631\u0627 Inventory \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Service Path\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Run \u0648 RunOnce Registry Key\u0647\u0627 \u0631\u0627 \u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Startup Folder \u062a\u0645\u0627\u0645 User\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Winlogon Registry \u0631\u0627 Baseline \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>WMI Subscription\u0647\u0627 \u0631\u0627 Audit \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>PowerShell Profile\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Local Administrator\u0647\u0627 \u0631\u0627 \u0645\u0633\u062a\u0646\u062f\u0633\u0627\u0632\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Autoruns \u0631\u0627 \u0628\u0631\u0627\u06cc Audit \u062f\u0648\u0631\u0647\u200c\u0627\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Sysmon \u0631\u0627 \u0628\u0627 Configuration \u0645\u0646\u0627\u0633\u0628 Deploy \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Event\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0631\u0627 \u0645\u0631\u06a9\u0632\u06cc \u0646\u06af\u0647\u062f\u0627\u0631\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>\u0642\u0628\u0644 \u0627\u0632 Remediation Evidence \u062a\u0647\u06cc\u0647 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Initial Access \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u062f.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u06a9\u200c\u0644\u06cc\u0633\u062a<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc Persistence \u0631\u0648\u06cc Windows Server \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0631\u0627 \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Process\u0647\u0627\u06cc \u0641\u0639\u0627\u0644 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Network Connection\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Scheduled Task\u0647\u0627 Inventory \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Task Action \u0648 Arguments \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Hidden Task\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Event ID 4698 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Event ID 4702 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Service\u0647\u0627\u06cc Auto Start \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Service Path\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Service Account\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Event ID 7045 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Event ID 4697 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>HKLM Run \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>HKCU Run \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>RunOnce \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>WOW6432Node Run \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Startup Folder \u0639\u0645\u0648\u0645\u06cc \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Startup Folder \u062a\u0645\u0627\u0645 User\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Shortcut\u0647\u0627\u06cc \u0646\u0627\u0634\u0646\u0627\u0633 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Winlogon Shell \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Winlogon Userinit \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>WMI Event Filter\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>WMI Consumer\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>WMI Binding\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Sysmon Event 19 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Sysmon Event 20 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Sysmon Event 21 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>PowerShell Profile\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Local User\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Local Administrator\u0647\u0627 \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Autoruns \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9 Hash \u0634\u062f\u0647\u200c\u0627\u0646\u062f.<\/li>\n\n\n\n<li>Digital Signature \u0628\u0631\u0631\u0633\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Evidence \u0642\u0628\u0644 \u0627\u0632 \u062d\u0630\u0641 \u062d\u0641\u0638 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n\n\n\n<li>Root Cause \u0645\u0634\u062e\u0635 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0637\u0627\u0644\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0637\u0627\u0644\u0639\u0647 \u0628\u06cc\u0634\u062a\u0631 \u062f\u0631\u0628\u0627\u0631\u0647 Persistence \u0648 \u0646\u0642\u0627\u0637 Autostart \u062f\u0631 Windows:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Microsoft Sysinternals \u2013 Autoruns<\/strong><br>\u0645\u0631\u062c\u0639 \u0631\u0633\u0645\u06cc Autoruns \u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Startup\u060c Run\/RunOnce\u060c Services\u060c Scheduled Tasks\u060c WMI\u060c Winlogon \u0648 \u0633\u0627\u06cc\u0631 Autostart Location\u0647\u0627.<br><a href=\"https:\/\/learn.microsoft.com\/en-us\/sysinternals\/downloads\/autoruns?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">Microsoft Learn \u2013 Autoruns<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Run and RunOnce Registry Keys<\/strong><br>\u0645\u0633\u062a\u0646\u062f\u0627\u062a \u0631\u0633\u0645\u06cc Microsoft \u062f\u0631\u0628\u0627\u0631\u0647 Registry Key\u0647\u0627\u06cc Run \u0648 RunOnce.<br><a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/setupapi\/run-and-runonce-registry-keys?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">Microsoft Learn \u2013 Run and RunOnce Registry Keys<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Get-ScheduledTask<\/strong><br>\u0645\u0631\u062c\u0639 PowerShell \u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Scheduled Task\u0647\u0627\u06cc \u062b\u0628\u062a\u200c\u0634\u062f\u0647 \u0631\u0648\u06cc Windows.<br><a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/scheduledtasks\/get-scheduledtask?view=windowsserver2022-ps&amp;utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">Microsoft Learn \u2013 Get-ScheduledTask<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Sysmon Events<\/strong><br>\u0645\u0631\u062c\u0639 Event\u0647\u0627\u06cc Sysmon \u0627\u0632 \u062c\u0645\u0644\u0647 Event\u0647\u0627\u06cc WMI\u060c Process \u0648 Registry.<br><a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/security\/operating-system-security\/sysmon\/sysmon-events?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">Microsoft Learn \u2013 Sysmon Events<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PowerShell Profiles<\/strong><br>\u0645\u0633\u062a\u0646\u062f\u0627\u062a Profile\u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641 PowerShell \u062f\u0631 \u0633\u0637\u062d User \u0648 System.<br><a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/microsoft.powershell.core\/about\/about_profiles?view=powershell-7.6&amp;utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">Microsoft Learn \u2013 about Profiles<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>MITRE ATT&amp;CK \u2013 Persistence<\/strong><br>\u0641\u0647\u0631\u0633\u062a Technique\u0647\u0627\u06cc \u0645\u0631\u062a\u0628\u0637 \u0628\u0627 \u062d\u0641\u0638 \u062f\u0633\u062a\u0631\u0633\u06cc \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645.<br><a href=\"https:\/\/attack.mitre.org\/tactics\/TA0003\/?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">MITRE ATT&amp;CK \u2013 Persistence<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>MITRE ATT&amp;CK \u2013 Registry Run Keys \/ Startup Folder<\/strong><br>\u062c\u0632\u0626\u06cc\u0627\u062a \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Run Key \u0648 Startup Folder \u0628\u0631\u0627\u06cc Persistence.<br><a href=\"https:\/\/attack.mitre.org\/techniques\/T1547\/001\/?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">MITRE ATT&amp;CK \u2013 Registry Run Keys \/ Startup Folder<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>MITRE ATT&amp;CK \u2013 Scheduled Task<\/strong><br>\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Windows Task Scheduler \u0628\u0631\u0627\u06cc Persistence.<br><a href=\"https:\/\/attack.mitre.org\/techniques\/T1053\/005\/?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">MITRE ATT&amp;CK \u2013 Scheduled Task<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>MITRE ATT&amp;CK \u2013 Windows Service<\/strong><br>\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0627\u06cc\u062c\u0627\u062f \u06cc\u0627 \u062a\u063a\u06cc\u06cc\u0631 Service \u0628\u0631\u0627\u06cc Persistence.<br><a href=\"https:\/\/attack.mitre.org\/techniques\/T1543\/003\/?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">MITRE ATT&amp;CK \u2013 Windows Service<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>MITRE ATT&amp;CK \u2013 WMI Event Subscription<\/strong><br>\u062a\u0648\u0636\u06cc\u062d WMI Permanent Event Subscription \u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 Persistence Mechanism.<br><a href=\"https:\/\/attack.mitre.org\/techniques\/T1546\/003\/?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noopener\">MITRE ATT&amp;CK \u2013 WMI Event Subscription<\/a><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062c\u0645\u0639\u200c\u0628\u0646\u062f\u06cc<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Persistence \u062f\u0631 Windows \u0645\u062d\u062f\u0648\u062f \u0628\u0647 \u06cc\u06a9 Scheduled Task \u06cc\u0627 Registry Key \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0632 \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645\u200c\u0647\u0627\u06cc \u0642\u0627\u0646\u0648\u0646\u06cc Windows \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Scheduled Tasks\nServices\nRun Keys\nStartup Folders\nWinlogon\nWMI\nPowerShell Profiles\nUser Accounts<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u062d\u0641\u0638 \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Scheduled Task\u0647\u0627 \u06cc\u06a9\u06cc \u0627\u0632 \u0628\u0647\u062a\u0631\u06cc\u0646 \u0646\u0642\u0627\u0637 \u0634\u0631\u0648\u0639:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ScheduledTask<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Service\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-CimInstance Win32_Service<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0637\u0644\u0627\u0639\u0627\u062a\u06cc \u0645\u0627\u0646\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>StartMode\nStartName\nPathName<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Run Key\u0647\u0627 \u0631\u0627 \u0646\u06cc\u0632 \u0628\u0627\u06cc\u062f \u062f\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>HKLM\nHKCU\nWOW6432Node<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc \u06a9\u0631\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Autostart\u0647\u0627\u06cc Login\u060c Startup Folder \u0648 Winlogon \u0627\u0647\u0645\u06cc\u062a \u0632\u06cc\u0627\u062f\u06cc \u062f\u0627\u0631\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">WMI Persistence \u0646\u06cc\u0632 \u0646\u0628\u0627\u06cc\u062f \u0646\u0627\u062f\u06cc\u062f\u0647 \u06af\u0631\u0641\u062a\u0647 \u0634\u0648\u062f\u061b \u0628\u0647\u200c\u062e\u0635\u0648\u0635 \u0627\u06af\u0631 Sysmon \u0641\u0639\u0627\u0644 \u0628\u0627\u0634\u062f Event\u0647\u0627\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>19\n20\n21<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u062f\u0631 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc WMI Event Subscription \u06a9\u0645\u06a9 \u06a9\u0646\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u06a9\u0646\u0627\u0631 \u0628\u0631\u0631\u0633\u06cc \u062f\u0633\u062a\u06cc\u060c Microsoft Autoruns \u06cc\u06a9\u06cc \u0627\u0632 \u06a9\u0627\u0631\u0628\u0631\u062f\u06cc\u200c\u062a\u0631\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631\u0647\u0627 \u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0645\u062c\u0645\u0648\u0639\u0647 \u0628\u0632\u0631\u06af\u06cc \u0627\u0632 Autostart Location\u0647\u0627\u06cc Windows \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0645\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 \u06cc\u06a9 Task\u060c Service \u06cc\u0627 Registry Entry \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0627\u062b\u0628\u0627\u062a Compromise \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Persistence Entry\n+\nExecutable\n+\nUser\n+\nTimestamp\n+\nProcess\n+\nNetwork\n+\nEvent Logs<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u06a9\u0646\u0627\u0631 \u06cc\u06a9\u062f\u06cc\u06af\u0631 \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Persistence \u0645\u0634\u06a9\u0648\u06a9\u06cc \u067e\u06cc\u062f\u0627 \u0634\u062f\u060c \u0627\u0628\u062a\u062f\u0627 Evidence \u0631\u0627 \u062d\u0641\u0638 \u06a9\u0646\u06cc\u062f\u060c \u0633\u067e\u0633 Scope \u062d\u0627\u062f\u062b\u0647 \u0648 Initial Access \u0631\u0627 \u0645\u0634\u062e\u0635 \u06a9\u0646\u06cc\u062f \u0648 \u0628\u0639\u062f Remediation \u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u062d\u0630\u0641 Persistence \u0628\u062f\u0648\u0646 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Root Cause \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0641\u0642\u0637 \u06cc\u06a9\u06cc \u0627\u0632 \u0646\u0634\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0646\u0641\u0648\u0630 \u0631\u0627 \u062d\u0630\u0641 \u06a9\u0646\u062f \u0648 \u0645\u0627\u0646\u0639 \u0628\u0627\u0632\u06af\u0634\u062a \u0645\u0647\u0627\u062c\u0645 \u0646\u0634\u0648\u062f.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06a9\u06cc\u0627\u0646 \u067e\u0648\u0631<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0631\u0648\u0634\u200c\u0647\u0627\u06cc \u0645\u0627\u0646\u062f\u06af\u0627\u0631\u06cc \u0645\u0647\u0627\u062c\u0645 \u0645\u0642\u062f\u0645\u0647 \u062f\u0631 \u06cc\u06a9 Incident \u0627\u0645\u0646\u06cc\u062a\u06cc\u060c \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0648\u0644\u06cc\u0647 \u0645\u0647\u0627\u062c\u0645 \u0647\u0645\u06cc\u0634\u0647 \u0645\u0648\u0642\u062a\u06cc \u0628\u0627\u0642\u06cc \u0646\u0645\u06cc\u200c\u0645\u0627\u0646\u062f. \u0628\u0639\u062f \u0627\u0632 \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 Windows Server \u06cc\u0627 Windows Client \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0645\u0647\u0627\u062c\u0645 \u062a\u0644\u0627\u0634 \u06a9\u0646\u062f \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f \u06a9\u0647 \u0628\u0639\u062f \u0627\u0632: \u062f\u0648\u0628\u0627\u0631\u0647 \u06a9\u062f \u06cc\u0627 \u0627\u0628\u0632\u0627\u0631 \u0645\u0648\u0631\u062f\u0646\u0638\u0631\u0634 \u0627\u062c\u0631\u0627 \u0634\u0648\u062f. \u0628\u0647 \u0627\u06cc\u0646 \u0631\u0648\u0634\u200c\u0647\u0627: Persistence \u06cc\u0627 \u0645\u0627\u0646\u062f\u06af\u0627\u0631\u06cc \u06af\u0641\u062a\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f. \u062f\u0631 Windows \u0645\u06a9\u0627\u0646\u06cc\u0632\u0645\u200c\u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641\u06cc [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":22162,"parent":17595,"menu_order":61,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-22157","docs","type-docs","status-publish","has-post-thumbnail","hentry"],"acf":[],"author_avatar":"https:\/\/maralhost.com\/kb\/wp-content\/litespeed\/avatar\/c59fc140fa83b542ed78a005738a60da.jpg?ver=1789947097","author_name":"Shayan Kianpoor","_links":{"self":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/22157","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/comments?post=22157"}],"version-history":[{"count":2,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/22157\/revisions"}],"predecessor-version":[{"id":22163,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/22157\/revisions\/22163"}],"up":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/17595"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media\/22162"}],"wp:attachment":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media?parent=22157"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/doc_tag?post=22157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}