{"id":787,"date":"2020-12-16T15:10:09","date_gmt":"2020-12-16T07:10:09","guid":{"rendered":"https:\/\/blog.billows.com.tw\/?p=787"},"modified":"2020-12-16T15:10:09","modified_gmt":"2020-12-16T07:10:09","slug":"microsoft%e5%be%ae%e8%bb%9f-%e5%ae%a3%e5%b8%83%e5%b0%87%e9%9a%94%e9%9b%a2%e8%88%87apt%e9%a7%ad%e5%ae%a2%e5%85%a5%e4%be%b5%e7%9b%b8%e9%97%9c%e7%9a%84solarwinds%e6%87%89%e7%94%a8","status":"publish","type":"post","link":"https:\/\/blog.billows.com.tw\/?p=787","title":{"rendered":"Microsoft(\u5fae\u8edf) \u5ba3\u5e03\u5c07\u9694\u96e2\u8207APT\u99ed\u5ba2\u5165\u4fb5\u76f8\u95dc\u7684SolarWinds\u61c9\u7528!!!"},"content":{"rendered":"\n

Microsoft\u4eca\u5929\u5ba3\u5e03\u8a08\u5283\u958b\u59cb\u5f37\u884c\u963b\u6b62\u548c\u9694\u96e2\u5df2\u77e5\u542bSolorigate\uff08SUNBURST\uff09\u60e1\u610f\u8edf\u9ad4\u7684SolarWinds Orion\u61c9\u7528\u7a0b\u5f0f\u7248\u672c\u3002<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u5fae\u8edf\u7684\u6c7a\u5b9a\u8207\u4e0a\u9031\u672b\u66dd\u5149\u7684\u5927\u898f\u6a21\u4f9b\u61c9\u93c8\u653b\u64ca\u6709\u95dc\uff0c\u8a72\u653b\u64ca\u5f71\u97ff\u4e86IT\u8edf\u9ad4\u4f9b\u61c9\u5546SolarWinds\u3002\u4e0a\u9031\u65e5\u4e00\u4e9b\u65b0\u805e\u5a92\u9ad4\u5831\u5c0e\u8aaa\uff0c\u8207\u4fc4\u7f85\u65af\u653f\u5e9c\u6709\u806f\u7e6b\u7684\u570b\u5bb6APT\u99ed\u5ba2\u5165\u4fb5\u4e86SolarWinds\uff0c\u4e26\u5728\u7db2\u8def\u76e3\u8996\u548c\u5eab\u5b58\u5e73\u53f0Orion\u7684\u66f4\u65b0\u4e2d\u63d2\u5165\u4e86\u60e1\u610f\u8edf\u9ad4\u3002\u901a\u904eSolarWinds\u7684\u81ea\u52d5\u66f4\u65b0\u6a5f\u5236\u5c07\u60e1\u610fbinary\u6a94\u5206\u767c\u7d66\u5927\u7d0418,000\u500b\u5ba2\u6236\uff0c\u5176\u4e2d\u5305\u62ec\u8a31\u591a\u7f8e\u570b\u653f\u5e9c\u6a5f\u69cb\u3002\u5a01\u8105\u53c3\u8207\u8005\u4f7f\u7528\u9019\u4e9b\u60e1\u610fbinaries\u6a94\u5b89\u88dd\u4e86\u7a31\u70baSolorigate\uff08Microsoft\uff09\u6216SUNBURST\uff08FireEye\uff09\u7684\u5f8c\u9580<\/p>\n\n\n\n

\u65b0\u805e\u5831\u5c0e\u767c\u5e03\u5f8c\u4e0d\u4e45\uff0c SolarWinds\u78ba\u8a8d \u57282020\u5e743\u6708\u81f32020\u5e746\u6708\u4e4b\u9593\u767c\u5e03\u7684Orion\u61c9\u7528\u7a0b\u5f0f2019.4\u81f32020.2.1\u7248\u672c\u5df2\u88ab\u60e1\u610f\u8edf\u9ad4\u7be1\u6539\u3002<\/p>\n\n\n\n

\u6839\u64da\u516c\u53f8\u7684\u6b63\u5f0f\u8072\u660e\uff0cMicrosoft\u662f\u6700\u65e9\u78ba\u8a8dSolarWinds\u4e8b\u4ef6\u7684\u7db2\u8def\u5b89\u5168\u4f9b\u61c9\u5546\u4e4b\u4e00\u3002\u5728\u540c\u4e00\u5929\uff0c\u8a72\u516c\u53f8\u70baSolarWinds Orion\u61c9\u7528\u7a0b\u5f0f\u4e2d\u5305\u542b\u7684Solorigate\u60e1\u610f\u8edf\u9ad4\u6dfb\u52a0\u4e86\u6aa2\u6e2c\u898f\u5247 \u3002<\/p>\n\n\n\n

\u5118\u7ba1Microsoft\u5df2\u7d93\u5728\u6aa2\u6e2c\u4e26\u9694\u96e2\u5f8c\u9580\u7a0b\u5f0f\uff0c\u4f46\u4ed6\u5011\u5c1a\u672a\u9694\u96e2\u53d7\u611f\u67d3\u7684SolarWinds\u7684binary\u6a94\uff0c\u56e0\u70ba\u5b83\u53ef\u80fd\u6703\u5f71\u97ff\u5ba2\u6236\u4f7f\u7528\u7684\u57fa\u672c\u7db2\u8def\u7ba1\u7406\u64cd\u4f5c\u3002<\/p>\n\n\n\n

\u7531\u65bc\u8a72\u6728\u99ac\u8edf\u9ad4\u5e36\u4f86\u7684\u5a01\u8105\uff0cMicrosoft\u5df2\u5ba3\u5e03\uff0c\u5f9e\u660e\u5929\uff08\u592a\u5e73\u6d0b\u6a19\u6e96\u6642\u9593\uff0912\u670816\u65e5\u4e0a\u53488:00\u958b\u59cb\uff0cMicrosoft Defender\u5c07\u958b\u59cb\u9694\u96e2\u53d7\u640d\u7684SolarWinds\u7684 binary\u6a94\u3002<\/p>\n\n\n\n

Microsoft Defender\u5c07\u53d7\u611f\u67d3\u7684SolarWinds\u7684 binary\u6a94\u6aa2\u6e2c\u70ba\u201c Trojan\uff1aMSIL \/ Solorigate.BR\uff01dha\u201d\u3002<\/p>\n\n\n\n

Microsoft\u9084\u5efa\u8b70\u5c07\u6240\u6709\u904b\u884cSolarWinds\u8edf\u9ad4\u7684<\/p>\n\n\n\n

\u4f3a\u670d\u5668\u8207\u5176\u4ed6\u74b0\u5883\u9694\u96e2\u958b\u4f86\uff0c\u4e26\u5728\u91cd\u65b0\u4f7f\u7528\u4e4b\u524d\u5fb9\u5e95\u8abf\u67e5\u60e1\u610f\u8edf\u9ad4\u3002<\/p>\n\n\n\n

\u5efa\u8b70\u57f7\u884c\u4ee5\u4e0b\u6b65\u9a5f\uff1a<\/p>\n\n\n\n

*\u7acb\u5373\u9694\u96e2\u53d7\u5f71\u97ff\u7684\u8a2d\u5099\u3002\u5982\u679c\u555f\u52d5\u4e86\u60e1\u610f\u7a0b\u5f0f\uff0c\u5247\u8a2d\u5099\u5f88\u53ef\u80fd\u53d7\u5230\u653b\u64ca\u8005\u7684\u5b8c\u5168\u63a7\u5236\u3002<\/p>\n\n\n\n

*\u78ba\u5b9a\u53d7\u5f71\u97ff\u7684\u8a2d\u5099\u4e0a\u5df2\u4f7f\u7528\u7684\u5e33\u6236\uff0c\u4e26\u8a8d\u70ba\u9019\u4e9b\u5e33\u6236\u5df2\u88ab\u76dc\u7528\u3002\u91cd\u7f6e\u5bc6\u78bc\u6216\u505c\u7528\u5e33\u6236\u3002<\/p>\n\n\n\n

*\u8abf\u67e5\u53d7\u5f71\u97ff\u7684\u7aef\u9ede\u53ef\u80fd\u662f\u5982\u4f55\u53d7\u5230\u5a01\u8105\u7684\u3002<\/p>\n\n\n\n

*\u4f7f\u7528\u53d7\u640d\u5e33\u6236\u4e4b\u4e00\u8abf\u67e5\u8a2d\u5099\u6642\u9593\u8ef8\u4ee5\u6307\u793a\u6a6b\u5411\u904b\u52d5\u6d3b\u52d5\u3002\u6aa2\u67e5\u653b\u64ca\u8005\u53ef\u80fd\u5df2\u653e\u68c4\u4f7f\u7528\u5176\u4ed6\u5de5\u5177\u4f86\u555f\u7528\u6191\u64da\u8a2a\u554f\uff0c\u6a6b\u5411\u79fb\u52d5\u548c\u5176\u4ed6\u653b\u64ca\u6d3b\u52d5\u3002<\/p>\n\n\n\n

\u6709\u95dcSolarWinds\u4f9b\u61c9\u93c8\u7684\u60c5\u8cc7\uff0c\u5c31\u5728\u7ae3\u76df\u79d1\u6280<\/a>\u4ee3\u7406\u7684 AlienVault OTX \u60c5\u8cc7\u5e73\u53f0\u4e0a\uff1a<\/p>\n\n\n\n

*****\u7ae3\u76df\u79d1\u6280<\/a>\u5feb\u5831\u6b61\u8fce\u8f49\u8f09\uff0c\u4f46\u8acb\u8a3b\u660e\u51fa\u8655<\/p>\n\n\n\n

https:\/\/otx.alienvault.com\/pulse\/5fd6df943558e0b56eaf3da8<\/a><\/p>\n\n\n\n

https:\/\/otx.alienvault.com\/pulse\/5fd825b7fa4eb2223a0cf812<\/a><\/p>\n\n\n\n

#\u60c5\u8cc7\u624d\u662f\u738b\u9053<\/p>\n","protected":false},"excerpt":{"rendered":"

Microsoft\u4eca\u5929\u5ba3\u5e03\u8a08\u5283\u958b\u59cb\u5f37\u884c\u963b\u6b62\u548c\u9694\u96e2\u5df2\u77e5\u542bSolorigate\uff08SUNBURST\uff09\u60e1\u610f\u8edf\u9ad4\u7684Sol READ MORE<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-787","post","type-post","status-publish","format-standard","hentry","category-6"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/787","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=787"}],"version-history":[{"count":1,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/787\/revisions"}],"predecessor-version":[{"id":789,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/787\/revisions\/789"}],"wp:attachment":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=787"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=787"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=787"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}