{"id":25368,"date":"2022-11-14T10:43:59","date_gmt":"2022-11-14T02:43:59","guid":{"rendered":"https:\/\/hongtronics.com\/?p=25368"},"modified":"2024-07-29T10:48:30","modified_gmt":"2024-07-29T02:48:30","slug":"%e3%80%90%e5%ae%8f%e8%99%b9%e5%88%86%e4%ba%ab%e3%80%91-%e7%a7%bb%e5%8b%95%e7%9b%ae%e6%a8%99%e9%98%b2%e7%a6%a6mtdmoving-target-defense-%e6%88%91%e5%80%91%e7%82%ba%e4%bb%80%e9%ba%bc%e8%a6%81","status":"publish","type":"post","link":"https:\/\/hongtronics.com\/en\/%e3%80%90%e5%ae%8f%e8%99%b9%e5%88%86%e4%ba%ab%e3%80%91-%e7%a7%bb%e5%8b%95%e7%9b%ae%e6%a8%99%e9%98%b2%e7%a6%a6mtdmoving-target-defense-%e6%88%91%e5%80%91%e7%82%ba%e4%bb%80%e9%ba%bc%e8%a6%81\/","title":{"rendered":"[Honghong Sharing] Moving Target Defense (MTD, Moving Target Defense) | Why should we care about attacks in RAM?"},"content":{"rendered":"

 <\/h1>\n\n\n\n

\u5118\u7ba1\u5728\u7db2\u8def\u5b89\u5168\u65b9\u9762\u7684\u6295\u8cc7\u4e0d\u65b7\u589e\u52a0\uff0c\u4f46\u7db2\u8def\u72af\u7f6a\u4ecd\u5728\u6fc0\u589e<\/strong>\u3002\u6bcf\u5929\u7684\u653b\u64ca\u90fd\u6703\u4f7f\u91ab\u7642\u4fdd\u5065\u63d0\u4f9b\u7671\u7613\uff0c\u4e26\u64fe\u4e82\u91d1\u878d\/\u4fdd\u96aa\u670d\u52d9\u516c\u53f8\u3001\u88fd\u9020\u516c\u53f8\u3001\u5f8b\u5e2b\u4e8b\u52d9\u6240\u548c\u8edf\u9ad4\u516c\u53f8\uff0c\u4ee5\u81f3\u65bc\u6709\u95dc\u9589\u7684\u98a8\u96aa\u3002\u9019\u5728\u5f88\u5927\u7a0b\u5ea6\u4e0a\u662f\u56e0\u70ba\u653b\u64ca\u4e00\u76f4\u5728\u8b8a\u5316\uff0c\u800c\u9632\u79a6\u6c92\u6709\u8b8a\u5316\u3002\u5982\u4eca\u7684\u60e1\u610f\u8edf\u9ad4\u8d8a\u4f86\u8d8a\u591a\u5730\u5728RAM\u4e2d\u57f7\u884c\u904b\u884c\u6642\u653b\u64ca\u3002<\/p>\n\n\n\n

\u6839\u64da\u5fae\u8edf\u7684\u6578\u64da\uff0c\u5fae\u8edf\u7522\u54c1\u4e2d70%\u7684\u6f0f\u6d1e\u662fRAM\u5b89\u5168\u554f\u984c<\/strong>\u3002PurpleSec\u767c\u73fe\uff0c2022\u5e74\uff0cRAM\u5d29\u6f70\u662f\u6700\u5e38\u898b\u7684\u96f6\u65e5\u653b\u64ca\u985e\u578b<\/strong>\uff0c\u4f54\u653b\u64ca\u768467.55%\u3002\u5c0d\u65bc\u4f9d\u8cf4\u57fa\u65bc\u6aa2\u6e2c\u7684\u89e3\u6c7a\u65b9\u6848\u4f86\u61c9\u5c0d\u9019\u4e9b\u985e\u578b\u7684\u653b\u64ca\u7684\u9632\u79a6\u8005\u4f86\u8aaa\uff0c\u9019\u662f\u4e00\u500b\u5927\u554f\u984c\u3002<\/p>\n\n\n\n

\u4e0d\u4e45\u524d\uff0c\u5e7e\u4e4e\u6240\u6709\u7684\u60e1\u610f\u8edf\u9ad4\u90fd\u4f9d\u8cf4\u65bc\u53ef\u57f7\u884c\u6587\u4ef6\u3002\u5a01\u8105\u53c3\u8207\u8005\u5728\u53d7\u5bb3\u8005\u74b0\u5883\u4e2d\u7684\u78c1\u76e4\u4e0a\u5b89\u88dd\u4e86\u60e1\u610f\u8edf\u9ad4\u3002\u8a72\u60e1\u610f\u8edf\u9ad4\u5c07\u901a\u904e\u51fd\u6578\u8abf\u7528\u3001\u7cfb\u7d71\u4e8b\u4ef6\u6216\u6d88\u606f\u8207\u53d7\u611f\u67d3\u7684\u8a08\u7b97\u6a5f\u4ea4\u4e92\u6216\u8207\u547d\u4ee4\u548c\u63a7\u5236(C2)\u670d\u52d9\u5668\u901a\u8a0a\u3002<\/p>\n\n\n\n

\"\u56fe\u7247\"\/<\/figure>\n\n\n\n

\u50b3\u7d71\u7db2\u8def\u5b89\u5168\u5728\u4e00\u5b9a\u7a0b\u5ea6\u4e0a\u904b\u4f5c\u826f\u597d<\/strong><\/p>\n\n\n\n

\u4f46\u662f\uff0c\u7121\u8ad6\u662f\u5728\u670d\u52d9\u5668\u4e0a\u9084\u662f\u5728\u53d7\u653b\u64ca\u7684\u7d42\u7aef\u4e0a\uff0c\u8a72\u60e1\u610f\u8edf\u9ad4\u90fd\u6703\u7559\u4e0b\u5176\u5b58\u5728\u7684\u8b49\u64da\u3002\u9632\u79a6\u8005\u53ef\u4ee5\u4f9d\u9760\u7aef\u9ede\u4fdd\u8b77\u5e73\u53f0(EPP)\u3001\u7aef\u9ede\u6aa2\u6e2c\u548c\u97ff\u61c9(EDR\/XDR)\u548c\u9632\u75c5\u6bd2(AV)\u7b49\u5de5\u5177\u4f86\u767c\u73fe\u60e1\u610f\u8edf\u9ad4\u90e8\u7f72\u7684\u8de1\u8c61\u3002\u767c\u73fe\u9019\u4e9b\u653b\u64ca\u6a21\u5f0f\u548c\u7279\u5fb5\u662f\u7db2\u8def\u5b89\u5168\u6280\u8853\u6f14\u8b8a\u7684\u76ee\u7684\u2014\u2014\u5728\u5a01\u8105\u9020\u6210\u771f\u6b63\u7834\u58de\u4e4b\u524d\u6aa2\u6e2c\u548c\u9694\u96e2\u5a01\u8105\u3002<\/p>\n\n\n\n

\u4f46\u96a8\u8457\u653b\u64ca\u93c8\u73fe\u5728\u9032\u5165RAM\uff0c\u5b83\u5011\u5728\u8981\u6aa2\u6e2c\u7684\u7279\u5fb5\u6216\u8981\u5206\u6790\u7684\u884c\u70ba\u6a21\u5f0f\u65b9\u9762\u63d0\u4f9b\u7684\u6771\u897f\u5f88\u5c11\u3002\u50b3\u7d71\u7684\u60e1\u610f\u8edf\u9ad4\u653b\u64ca\u4e26\u6c92\u6709\u6d88\u5931\u3002\u53ea\u662f\u66f4\u591a\u7684\u5a01\u8105\u5728\u904b\u884c\u6642\u4ee5\u8a2d\u5099RAM\u70ba\u76ee\u6a19\uff0c\u800c\u50b3\u7d71\u7684\u9632\u79a6\u8005\u5c0d\u6b64\u7684\u53ef\u898b\u6027\u6709\u9650\u3002<\/p>\n\n\n\n

RAM\u4e2d\u653b\u64ca\u53ef\u4ee5\u5b89\u88dd\u6709\u95dc\u806f\u7684\u6587\u4ef6\uff0c\u4e5f\u53ef\u4ee5\u6c92\u6709\u95dc\u806f\u7684\u6587\u4ef6\uff0c\u4e26\u5728\u6700\u7d42\u7528\u6236\u555f\u52d5\u548c\u95dc\u9589\u61c9\u7528\u7a0b\u5f0f\u4e4b\u9593\u7684\u7a7a\u9593\u4e2d\u5de5\u4f5c\u3002\u50cfEmotet\u3001Jupyter\u3001Cobalt Strike\u548c\u4f9b\u61c9\u93c8\u653b\u64ca\u9019\u6a23\u7684\u904b\u884c\u6642\u653b\u64ca\u53ef\u4ee5\u5728\u53d7\u5bb3\u8005\u7684\u74b0\u5883\u4e2d\u79fb\u52d5\u3002<\/p>\n\n\n\n

\"\u56fe\u7247\"\/<\/figure>\n\n\n\n

\u9019\u4e9b\u5a01\u8105\u901a\u5e38\u4e0d\u6703\u5728\u8a2d\u5099\u78c1\u76e4\u4e0a\u7559\u4e0b\u53ef\u8b58\u5225\u7684\u5370\u8a18\u3002\u9019\u4e9b\u5a01\u8105\u7684\u8b49\u64da\u6700\u7d42\u53ef\u80fd\u6703\u5728\u57fa\u65bc\u7c3d\u540d\u7684\u89e3\u6c7a\u65b9\u6848\u4e0a\u986f\u793a\u70ba\u8b66\u5831\u3002\u9019\u5305\u62ec\u5b89\u5168\u8a0a\u606f\u548c\u4e8b\u4ef6\u7ba1\u7406(SIEM)\u6216\u5b89\u5168\u5354\u8abf\u3001\u81ea\u52d5\u5316\u548c\u97ff\u61c9(SOAR)\u89e3\u6c7a\u65b9\u6848\u3002\u4f46\u5230\u90a3\u6642\uff0c\u5f8c\u885b\u5011\u901a\u5e38\u5df2\u7d93\u4f86\u4e0d\u53ca\u505a\u4efb\u4f55\u4e8b\u60c5\u4e86\u3002<\/p>\n\n\n\n

\u96b1\u853d\u800c\u5f37\u5927\u7684\u61c9\u7528\u7a0b\u5f0f\u904b\u884c\u6642\u653b\u64ca\u70ba\u52d2\u7d22\u8edf\u9ad4\u90e8\u7f72\u548c\u6578\u64da\u5916\u6d29\u5960\u5b9a\u4e86\u57fa\u790e\u3002<\/p>\n\n\n\n

RAM\u4e2d\u7684\u5a01\u8105\u7121\u8655\u4e0d\u5728<\/strong><\/p>\n\n\n\n

\u4f5c\u70ba\u7121\u6587\u4ef6\u60e1\u610f\u8edf\u9ad4\u7684\u4e00\u9805\u529f\u80fd\uff0c\u5b8c\u6574\u7684RAM\u4e2d\u653b\u64ca\u93c8\u57282010\u5e74\u4ee3\u4e2d\u671f\u958b\u59cb\u51fa\u73fe\u3002\u81ed\u540d\u662d\u8457\u7684Angler\u6f0f\u6d1e\u5de5\u5177\u5305<\/strong>\u4ee5\u5176\u7368\u7279\u7684\u6df7\u6dc6\u800c\u805e\u540d\uff0c\u5b83\u6388\u6b0a\u7db2\u8def\u72af\u7f6a\u5206\u5b50\u6bcf\u6708\u6536\u53d6\u8cbb\u7528\u4f86\u5229\u7528\u7db2\u8def\u700f\u89bd\u5668\u6f0f\u6d1e\u3002<\/p>\n\n\n\n

\u50c5\u57282015\u5e74\uff0c\u7db2\u8def\u72af\u7f6a\u5206\u5b50\u5c31\u5229\u7528Angler\u5f9e\u53d7\u5bb3\u8005\u90a3\u88e1\u7aca\u53d6\u548c\u52d2\u7d22\u4e863400\u842c\u7f8e\u5143<\/strong>\u3002<\/p>\n\n\n\n

\u8fd1\u5e74\u4f86\uff0c\u5728RAM\u65b9\u9762\u7684\u6d29\u9732\u6fc0\u589e\u3002\u5a01\u8105\u53c3\u8207\u8005\u4f7f\u7528Cobalt Strike\u7b49\u5de5\u5177\u5f9e\u8a2d\u5099RAM\u60e1\u610f\u52a0\u8f09\u901a\u8a0a\u4fe1\u6a19\u3002 Cobalt Strike\u662f\u4e00\u7a2e\u5408\u6cd5\u7684\u4e94\u5c64\u653b\u64ca\u89e3\u6c7a\u65b9\u6848\u3002 2019\u81f32020\u5e74\u9593\uff0c\u4f7f\u7528Cobalt Strike\u7684\u7db2\u8def\u653b\u64ca\u589e\u52a0\u4e86161%<\/strong>\u3002\u5b83\u901a\u5e38\u88abConti\u4f7f\u7528\uff0cConti\u662f\u76ee\u524d\u904b\u71df\u4e2d\u6700\u6210\u529f\u7684\u52d2\u7d22\u8edf\u9ad4\u96c6\u5718\uff0c\u57282021\u5e74\u7372\u5f97\u4e861.8\u5104\u7f8e\u5143\u7684\u6536\u5165<\/strong>\u3002<\/p>\n\n\n\n

\"\u56fe\u7247\"\/<\/figure>\n\n\n\n

\u70ba\u4e86\u9003\u907f\u50b3\u7d71\u7684\u4ee5\u7c3d\u540d\u548c\u884c\u70ba\u70ba\u91cd\u9ede\u7684\u5b89\u5168\u89e3\u6c7a\u65b9\u6848\uff0c\u5a01\u8105\u53c3\u8207\u8005\u73fe\u5728\u5275\u5efa\u91dd\u5c0d\u904b\u884c\u6642RAM\u4e2d\u7684\u60e1\u610f\u8edf\u9ad4\uff0c\u4e26\u52ab\u6301\u5408\u6cd5\u9032\u7a0b\u3002 Picus\u5be6\u9a57\u5ba4\u76842021\u5e74\u7d05\u8272\u5831\u544a\u5c0720\u591a\u842c\u500b\u60e1\u610f\u8edf\u9ad4\u6587\u4ef6\u6620\u5c04\u5230MITRE ATT&CK\u6846\u67b6\u3002<\/p>\n\n\n\n

\u201c\u4ed6\u5011\u767c\u73fe\uff0c\u53bb\u5e74\u6700\u6d41\u884c\u7684\u4e94\u7a2e\u653b\u64ca\u65b9\u5f0f\u4e2d\uff0c\u6709\u4e09\u7a2e\u662f\u5728RAM\u4e2d\u767c\u751f\u7684\u3002\u201d<\/p>\n\n\n\n

RAM\u6d29\u9732\u73fe\u5728\u662f\u653b\u64ca\u93c8\u7684\u5178\u578b\u7279\u5fb5\uff0c\u5c31\u50cf2021\u5e74\u611b\u723e\u862d\u570b\u5bb6\u91ab\u7642\u670d\u52d9\u9ad4\u4fc2\u88ab\u5165\u4fb5\u4e4b\u524d\u90a3\u6a23\u3002<\/p>\n\n\n\n

\u7121\u6cd5\u5728\u904b\u884c\u6642\u6383\u63cf\u8a2d\u5099RAM<\/strong><\/p>\n\n\n\n

\u5728\u61c9\u7528\u7a0b\u5f0f\u904b\u884c\u6642\u671f\u9593\uff0c\u8a2d\u5099RAM\u4e2d\u767c\u751f\u7684\u60c5\u6cc1\u5c0d\u9632\u79a6\u8005\u4f86\u8aaa\u5927\u591a\u662f\u4e0d\u53ef\u898b\u7684\u3002\u82e5\u8981\u4e86\u89e3\u539f\u56e0\uff0c\u8acb\u8003\u616e\u89e3\u6c7a\u65b9\u6848\u5982\u4f55\u5728\u6709\u4eba\u4f7f\u7528\u61c9\u7528\u7a0b\u5f0f\u6642\u5617\u8a66\u6383\u63cf\u61c9\u7528\u7a0b\u5f0f\u3002 <\/p>\n\n\n\n

\u89e3\u6c7a\u65b9\u6848\u5fc5\u9808\uff1a<\/p>\n\n\n\n

1\uff09 \u5728\u61c9\u7528\u7a0b\u5f0f\u7684\u751f\u547d\u9031\u671f\u5167\u591a\u6b21\u6383\u63cf\u8a2d\u5099RAM\uff0c<\/p>\n\n\n\n

2\uff09\u540c\u6642\u5075\u807d\u6b63\u78ba\u7684\u89f8\u767c\u64cd\u4f5c\uff0c<\/p>\n\n\n\n

3\uff09\u4ee5\u53ca\u67e5\u627e\u60e1\u610f\u6a21\u5f0f\u4ee5\u6355\u7372\u6b63\u5728\u9032\u884c\u7684\u653b\u64ca\u3002<\/p>\n\n\n\n

\u505a\u9019\u4e09\u4ef6\u4e8b\u7684\u6700\u5927\u969c\u7919\u662f\u898f\u6a21\u3002\u5728\u5178\u578b\u61c9\u7528\u7a0b\u5f0f\u7684\u904b\u884c\u6642\u74b0\u5883\u4e2d\uff0c\u53ef\u80fd\u67094GB \u7684\u865b\u64ecRAM\u3002\u4e0d\u53ef\u80fd\u8db3\u5920\u983b\u7e41\u5730\u6383\u63cf\u5982\u6b64\u5927\u91cf\u7684\u6578\u64da\uff0c\u81f3\u5c11\u4e0d\u6703\u6e1b\u6162\u61c9\u7528\u7a0b\u5f0f\u7684\u901f\u5ea6\uff0c\u4ee5\u81f3\u65bc\u7121\u6cd5\u4f7f\u7528\u3002\u56e0\u6b64\uff0cRAM\u6383\u63cf\u7a0b\u5e8f\u53ea\u80fd\u67e5\u770b\u7279\u5b9a\u7684RAM\u5340\u57df\u3001\u7279\u5b9a\u7684\u6642\u9593\u7dda\u89f8\u767c\u5668\u548c\u975e\u5e38\u5177\u9ad4\u7684\u53c3\u6578\u2014\u2014\u6240\u6709\u9019\u4e9b\u90fd\u5047\u8a2dRAM\u72c0\u614b\u662f\u7a69\u5b9a\u548c\u4e00\u81f4\u7684\u3002 <\/p>\n\n\n\n

\"\u56fe\u7247\"\/<\/figure>\n\n\n\n

 \u5728\u7bc4\u570d\u5982\u6b64\u6709\u9650\u7684\u60c5\u6cc1\u4e0b\uff0c\u5728\u6700\u597d\u7684\u60c5\u6cc1\u4e0b\uff0c\u5c08\u6ce8\u65bcRAM\u6383\u63cf\u7684\u89e3\u6c7a\u65b9\u6848\u53ef\u80fd\u6703\u4f54\u75283%\u52304%\u7684\u61c9\u7528\u7a0b\u5f0fRAM\u3002\u4f46\u5a01\u8105\u8d8a\u4f86\u8d8a\u591a\u5730\u4f7f\u7528\u591a\u614b\u4f86\u6df7\u6dc6\u4ed6\u5011\u7684\u5b58\u5728\uff0c\u751a\u81f3\u5728RAM\u4e2d\u4e5f\u662f\u5982\u6b64\u3002\u9019\u610f\u5473\u8457\u5728\u5982\u6b64\u5c0f\u7684\u8a2d\u5099RAM\u6a23\u672c\u4e2d\u6355\u7372\u60e1\u610f\u6d3b\u52d5\u5c07\u662f\u5947\u8e5f\u3002\u4f7f\u9019\u4e00\u554f\u984c\u96ea\u4e0a\u52a0\u971c\u7684\u662f\uff0c\u653b\u64ca\u73fe\u5728\u7e5e\u904e\u6216\u7be1\u6539\u4e86\u5927\u591a\u6578\u89e3\u6c7a\u65b9\u6848\u7528\u4f86\u767c\u73fe\u6b63\u5728\u9032\u884c\u7684\u653b\u64ca\u7684\u639b\u9264\u3002<\/p>\n\n\n\n

\u904e\u5f80\u653b\u64ca\u8005\u900f\u904e\u9060\u7a0b\u5b58\u53d6\u7279\u6d1b\u4f0a\u6728\u99ac\u7a0b\u5f0f(RAT)\u3001\u8a0a\u606f\u7aca\u53d6\u7a0b\u5f0f\u548c\u52a0\u8f09\u7a0b\u5f0f\uff0c\u73fe\u5728\u5b83\u5011\u4f7f\u7528\u61c9\u7528\u7a0b\u5f0fRAM\u85c9\u4ee5\u722d\u53d6\u96b1\u85cf\u66f4\u4e45\u3002\u653b\u64ca\u8005\u5728\u7db2\u8def\u4e2d\u505c\u7559\u7684\u5e73\u5747\u6642\u9593\u7d04\u70ba11\u5929\u3002\u5c0d\u65bc\u8001\u9f20\u548c\u8a0a\u606f\u7aca\u53d6\u7b49\u9ad8\u7d1a\u5a01\u8105\uff0c\u9019\u500b\u6578\u5b57\u66f4\u63a5\u8fd145\u5929\u3002<\/p>\n\n\n\n

Windows\u548cLinux\u61c9\u7528\u7a0b\u5f0f\u90fd\u662f\u76ee\u6a19<\/strong><\/p>\n\n\n\n

\u5728RAM\u4e2d\uff0c\u6d29\u9732\u4e0d\u662f\u4e00\u7a2e\u55ae\u4e00\u985e\u578b\u7684\u5a01\u8105\u3002\u76f8\u53cd\uff0c\u9019\u662f\u5c0e\u81f4\u5ee3\u6cdb\u5f8c\u679c\u7684\u653b\u64ca\u93c8\u7684\u4e00\u500b\u7279\u5fb5\u3002\u4f8b\u5982\uff0c\u52d2\u7d22\u8edf\u9ad4\u4e0d\u4e00\u5b9a\u8207RAM\u904b\u884c\u6642\u653b\u64ca\u76f8\u95dc\u806f\u3002\u4f46\u8981\u90e8\u7f72\u52d2\u7d22\u8edf\u9ad4\uff0c\u5a01\u8105\u53c3\u8207\u8005\u901a\u5e38\u5fc5\u9808\u6ef2\u900f\u7db2\u8def\u4e26\u63d0\u5347\u6b0a\u9650\u3002\u9019\u4e9b\u904e\u7a0b\u5f80\u5f80\u5728\u904b\u884c\u6642\u5728RAM\u4e2d\u767c\u751f\u3002<\/p>\n\n\n\n

\"\u56fe\u7247\"\/<\/figure>\n\n\n\n

\u7db2\u8def\u5b89\u5168\u7684\u6a19\u6e96\u65b9\u6cd5\u662f\u6aa2\u6e2c\u6b63\u5728\u9032\u884c\u7684\u653b\u64ca\u6216\u88ab\u7834\u58de\u5f8c\u7684\u653b\u64ca\u3002\u9019\u4f7f\u6bcf\u7a2e\u985e\u578b\u7684\u7d44\u7e54\u548cIT \u8cc7\u7522\u90fd\u9762\u81e8\u201c\u96b1\u5f62\u201d\u904b\u884c\u6642\u653b\u64ca\u7684\u98a8\u96aa\u3002 Morphisec\u7684\u4e8b\u4ef6\u97ff\u61c9\u5718\u968a\u5df2\u7d93\u770b\u5230RAM\u4e2d\u5165\u4fb5\u88ab\u7528\u65bc\u5f9e\u91d1\u878d\u6a5f\u69cb\u7684\u670d\u52d9\u5668\u5230\u91ab\u9662\u7684\u7aef\u9ede\u4ee5\u53ca\u4ecb\u65bc\u5169\u8005\u4e4b\u9593\u7684\u6240\u6709\u60c5\u6cc1\u3002 <\/p>\n\n\n\n

\u9019\u4e9b\u5a01\u8105\u4e0d\u50c5\u91dd\u5c0dWindows \u670d\u52d9\u5668\u548c\u8a2d\u5099\u4e0a\u7684RAM\u9032\u7a0b\uff0c\u5b83\u5011\u9084\u91dd\u5c0dLinux\u3002\u53bb\u5e74\uff0c\u7531\u5a01\u8105\u884c\u70ba\u8005\u5275\u5efa\u7684\u60e1\u610f\u7248\u672c\u7684Cobalt Strike\u5c08\u9580\u7528\u65bcLinux\u670d\u52d9\u5668\u3002\u5728\u91d1\u878d\u7b49\u884c\u696d\uff0cLinux\u88ab\u7528\u4f86\u70ba\u865b\u64ec\u5316\u5e73\u53f0\u548c\u7db2\u8def\u670d\u52d9\u5668\u63d0\u4f9b\u52d5\u529b\uff0c\u653b\u64ca\u6fc0\u589e\u3002\u653b\u64ca\u901a\u5e38\u6703\u7834\u58deRAM\u4e2d\u7684\u696d\u52d9\u95dc\u9375\u578b\u670d\u52d9\u5668\uff0c\u5f9e\u800c\u70ba\u8a0a\u606f\u76dc\u7aca\u548c\u6578\u64da\u52a0\u5bc6\u5960\u5b9a\u57fa\u790e\u3002 <\/p>\n\n\n\n

\u9632\u6b62RAM\u4e2d\u904b\u884c\u6642\u653b\u64ca<\/strong><\/p>\n\n\n\n

RAM\u4e2d\u904b\u884c\u6642\u653b\u64ca\u662f\u4e00\u4e9b\u6700\u5148\u9032\u7684\u7834\u58de\u6027\u653b\u64ca\u3002\u4ed6\u5011\u4e0d\u50c5\u91dd\u5c0d\u4f01\u696d\uff0c\u73fe\u5728\u9084\u628a\u6574\u500b\u653f\u5e9c\u90fd\u6263\u70ba\u4eba\u8cea\u3002\u56e0\u6b64\uff0c\u9632\u79a6\u8005\u5fc5\u9808\u5c08\u6ce8\u65bc\u5728\u904b\u884c\u6642\u963b\u6b62\u5c0d\u61c9\u7528\u7a0b\u5f0fRAM\u7684\u5a01\u8105\u3002\u53ea\u5c08\u6ce8\u65bc\u6aa2\u6e2c\u662f\u4e0d\u597d\u7684;RAM\u4e2d\u548c\u7121\u6587\u4ef6\u7684\u60e1\u610f\u8edf\u9ad4\u5be6\u969b\u4e0a\u662f\u4e0d\u53ef\u898b\u7684\u3002\u50b3\u7d71\u7684\u5b89\u5168\u6280\u8853\u5728\u53d7\u4fdd\u8b77\u8cc7\u7522\u5468\u570d\u8c4e\u8d77\u4e00\u5835\u7246\uff0c\u4e26\u4f9d\u8cf4\u65bc\u6aa2\u6e2c\u60e1\u610f\u6d3b\u52d5\uff0c\u7121\u6cd5\u963b\u6b62\u591a\u614b\u548c\u52d5\u614b\u5a01\u8105\u3002<\/p>\n\n\n\n

\"\u56fe\u7247\"\/<\/figure>\n\n\n\n

\u76f8\u53cd\uff0c\u61c9\u901a\u904e\u5b89\u5168\u5c64\u78ba\u4fdd\u6709\u6548\u7684\u6df1\u5ea6\u9632\u79a6\uff0c\u5f9e\u800c\u9996\u5148\u9632\u6b62RAM\u53d7\u640d\u3002\u9019\u5c31\u662f\u79fb\u52d5\u76ee\u6a19\u9632\u79a6\uff08MTD\uff09\u6280\u8853\u7684\u4f5c\u7528\u3002MTD \u901a\u904e\u5728\u904b\u884c\u6642\u8b8a\u5f62\uff08\u96a8\u6a5f\u5316\uff09\u61c9\u7528\u7a0b\u5f0fRAM\u3001API \u548c\u5176\u4ed6\u64cd\u4f5c\u7cfb\u7d71\u8cc7\u6e90\uff0c\u5275\u5efa\u5373\u4f7f\u662f\u9ad8\u7d1a\u5a01\u8105\u4e5f\u7121\u6cd5\u7a7f\u900f\u7684\u52d5\u614b\u653b\u64ca\u9762\u3002<\/strong>\u5be6\u969b\u4e0a\uff0c\u5b83\u4e0d\u65b7\u5730\u79fb\u52d5\u623f\u5c4b\u7684\u9580\uff0c\u540c\u6642\u5c07\u5047\u9580\u7559\u5728\u539f\u8655\uff0c\u5f9e\u800c\u6355\u7372\u60e1\u610f\u8edf\u9ad4\u4ee5\u9032\u884c\u53d6\u8b49\u5206\u6790\u3002\u5373\u4f7f\u5a01\u8105\u884c\u70ba\u8005\u80fd\u627e\u5230\u901a\u5f80\u5efa\u7bc9\u7269\u7684\u9580\uff0c\u7576\u4ed6\u5011\u8fd4\u56de\u6642\uff0c\u5b83\u4e5f\u4e0d\u6703\u5728\u90a3\u88e1\u3002\u56e0\u6b64\uff0c\u4ed6\u5011\u4e0d\u80fd\u5728\u540c\u4e00\u7aef\u9ede\u4e0a\u91cd\u7528\u653b\u64ca\uff0c\u66f4\u4e0d\u7528\u8aaa\u5728\u5176\u4ed6\u7aef\u9ede\u4e0a\u4e86\u3002 <\/p>\n\n\n\n

MTD \u6280\u8853\u4e0d\u662f\u5728\u653b\u64ca\u767c\u751f\u5f8c\u6aa2\u6e2c\u5230\u653b\u64ca\uff0c\u800c\u662f\u5148\u767c\u88fd\u4eba\u5730\u963b\u6b62\u653b\u64ca\uff0c\u800c\u7121\u9700\u7c3d\u540d\u6216\u53ef\u8b58\u5225\u7684\u884c\u70ba\u3002<\/strong>\u800c\u4e14\u5b83\u4e0d\u6703\u5f71\u97ff\u7cfb\u7d71\u6027\u80fd\u3001\u751f\u6210\u8aa4\u5831\u8b66\u5831\u6216\u9700\u8981\u589e\u52a0\u54e1\u5de5\u4eba\u6578\u624d\u80fd\u904b\u884c\u3002<\/p>\n\n\n\n

\u64f4\u5c55\u95b1\u8b80<\/strong><\/p>\n\n\n\n

Morphisec\uff08\u6469\u83f2\u65af\uff09<\/strong><\/p>

Morphisec\uff08\u6469\u83f2\u65af\uff09\u4f5c\u70ba\u79fb\u52d5\u76ee\u6a19\u9632\u79a6\u7684\u9818\u5c0e\u8005\uff0c\u5df2\u7d93\u8b49\u660e\u4e86\u9019\u9805\u6280\u8853\u7684\u5a01\u529b\u3002\u4ed6\u5011\u5df2\u7d93\u57285000\u591a\u5bb6\u4f01\u696d\u90e8\u7f72\u4e86MTD\u9a45\u52d5\u7684\u6f0f\u6d1e\u9810\u9632\u89e3\u6c7a\u65b9\u6848\uff0c\u6bcf\u5929\u4fdd\u8b77800\u591a\u842c\u500b\u7aef\u9ede\u548c\u670d\u52d9\u5668\u514d\u53d7\u8a31\u591a\u6700\u5148\u9032\u7684\u653b\u64ca\u3002\u4e8b\u5be6\u4e0a\uff0cMorphisec\uff08\u6469\u83f2\u65af\uff09\u76ee\u524d\u6bcf\u5929\u963b\u6b6215,000\u81f330,000\u6b21\u52d2\u7d22\u8edf\u9ad4\u3001\u60e1\u610f\u8edf\u9ad4\u548c\u7121\u6587\u4ef6\u653b\u64ca\uff0c\u9019\u4e9b\u653b\u64ca\u662fNGAV\u3001EDR\u89e3\u6c7a\u65b9\u6848\u548c\u7aef\u9ede\u4fdd\u8b77\u5e73\u53f0\uff08EPP\uff09\u672a\u80fd\u6aa2\u6e2c\u548c\/\u6216\u963b\u6b62\u7684\u3002 (\u4f8b\u5982\uff0cMorphisec\u5ba2\u6236\u7684\u6210\u529f\u6848\u4f8b\uff0cGartner\u540c\u884c\u6d1e\u5bdf\u529b\u8a55\u8ad6\u548cPeerSpot\u8a55\u8ad6)\u5728\u5176\u4ed6NGAV\u548cEDR\u89e3\u6c7a\u65b9\u6848\u7121\u6cd5\u963b\u6b62\u7684\u60c5\u6cc1\u4e0b\uff0c\u5728\u7b2c\u96f6\u65e5\u5c31\u88ab\u963b\u6b62\u7684\u6b64\u985e\u653b\u64ca\u7684\u4f8b\u5b50\u5305\u62ec\u4f46\u4e0d\u9650\u65bc\uff1a<\/em><\/p>

\u2013 \u52d2\u7d22\u8edf\u9ad4(\u4f8b\u5982\uff0cConti\u3001Darkside\u3001Lockbit)<\/em><\/p>

\u2013 \u5f8c\u9580\u7a0b\u5f0f(\u4f8b\u5982\uff0cCobalt Strike\u3001\u5176\u4ed6RAM\u4fe1\u6a19)<\/em><\/p>

\u2013 \u4f9b\u61c9\u93c8(\u4f8b\u5982\uff0cCCleaner\u3001\u83ef\u78a9\u3001Kaseya payloads\u3001iTunes)<\/em><\/p>

\u2013 \u60e1\u610f\u8edf\u9ad4\u4e0b\u8f09\u7a0b\u5f0f(\u4f8b\u5982\uff0cEmotet\u3001QBot\u3001Qakbot\u3001Trickbot\u3001IceDid)<\/em><\/p><\/blockquote>\n\n\n\n

Morphisec\uff08\u6469\u83f2\u65af\uff09\u70ba\u95dc\u9375\u61c9\u7528\u7a0b\u5f0f\uff0cwindows\u548clinux\u672c\u5730\u548c\u96f2\u7aef\u670d\u52d9\u5668\u63d0\u4f9b\u89e3\u6c7a\u65b9\u6848\uff0c2MB\u5927\u5c0f\u5feb\u901f\u90e8\u7f72\u3002\u514d\u8cbb\u7684Guard Lite\u89e3\u6c7a\u65b9\u6848\uff0c\u5c07\u5fae\u8edf\u7684Defener AV\u8b8a\u6210\u4e00\u500b\u4f01\u696d\u7d1a\u7684\u89e3\u6c7a\u65b9\u6848\u3002\u8b93\u4f01\u696d\u53ef\u4ee5\u5f9e\u55ae\u4e00\u5730\u9ede\u63a7\u5236\u6240\u6709\u7d42\u7aef\u3002\u8acb\u806f\u7e6b\u6211\u5011\u514d\u8cbb\u7372\u53d6\uff01<\/p>\n\n\n\n

\u66f4\u591a\u8cc7\u8a0a\u6b61\u8fce\u5230\u5b8f\u8679\u5b98\u7db2\u4e86\u89e3\uff0c\u6216\u806f\u7e6b\u6211\u5011! >> https:\/\/hongtronics.com\/morphisec-safe-internet-situation\/<\/a><\/p>\n\n\n\n

\u6216\u5230\u5b8f\u8679\u5b98\u65b9Youtube\u983b\u9053\u4e86\u89e3\u66f4\u591a\u7522\u54c1\u8cc7\u8a0a >> https:\/\/youtube.com\/@hongtronics<\/a><\/p>\n\n\n\n

\"\"<\/figure>","protected":false},"excerpt":{"rendered":"

  \u5118\u7ba1\u5728\u7db2\u8def\u5b89\u5168\u65b9\u9762\u7684\u6295\u8cc7\u4e0d\u65b7\u589e\u52a0\uff0c\u4f46\u7db2\u8def\u72af\u7f6a\u4ecd\u5728\u6fc0\u589e\u3002\u6bcf\u5929\u7684\u653b\u64ca\u90fd\u6703\u4f7f\u91ab\u7642\u4fdd\u5065\u63d0\u4f9b\u7671\u7613\uff0c\u4e26\u64fe\u4e82\u91d1 […]<\/p>","protected":false},"author":33,"featured_media":25369,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_eb_attr":"","ocean_post_layout":"","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"0","ocean_second_sidebar":"0","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"minimal","ocean_center_header_left_menu":"0","ocean_custom_header_template":"0","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"0","ocean_menu_typo_font_family":"0","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"0","iawp_total_views":83,"ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"off","ocean_gallery_id":[],"footnotes":""},"categories":[2362],"tags":[1890],"table_tags":[],"class_list":["post-25368","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-2362","tag-mtd","entry","has-media","owp-thumbs-layout-horizontal","owp-btn-normal","owp-tabs-layout-horizontal","has-no-thumbnails","has-product-nav"],"aioseo_notices":[],"jetpack_featured_media_url":"https:\/\/hongtronics.com\/wp-content\/uploads\/2022\/11\/640-2.png","_links":{"self":[{"href":"https:\/\/hongtronics.com\/en\/wp-json\/wp\/v2\/posts\/25368","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hongtronics.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hongtronics.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hongtronics.com\/en\/wp-json\/wp\/v2\/users\/33"}],"replies":[{"embeddable":true,"href":"https:\/\/hongtronics.com\/en\/wp-json\/wp\/v2\/comments?post=25368"}],"version-history":[{"count":2,"href":"https:\/\/hongtronics.com\/en\/wp-json\/wp\/v2\/posts\/25368\/revisions"}],"predecessor-version":[{"id":27188,"href":"https:\/\/hongtronics.com\/en\/wp-json\/wp\/v2\/posts\/25368\/revisions\/27188"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hongtronics.com\/en\/wp-json\/wp\/v2\/media\/25369"}],"wp:attachment":[{"href":"https:\/\/hongtronics.com\/en\/wp-json\/wp\/v2\/media?parent=25368"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hongtronics.com\/en\/wp-json\/wp\/v2\/categories?post=25368"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hongtronics.com\/en\/wp-json\/wp\/v2\/tags?post=25368"},{"taxonomy":"table_tags","embeddable":true,"href":"https:\/\/hongtronics.com\/en\/wp-json\/wp\/v2\/table_tags?post=25368"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}