{"id":477231,"date":"2023-08-09T09:09:19","date_gmt":"2023-08-09T09:09:19","guid":{"rendered":""},"modified":"2023-09-05T11:14:18","modified_gmt":"2023-09-05T11:14:18","slug":"fileless-attacks","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/vn\/wiki\/fileless-attacks\/","title":{"rendered":"T\u1ea5n c\u00f4ng kh\u00f4ng c\u1ea7n file"},"content":{"rendered":"

Gi\u1edbi thi\u1ec7u<\/h2>\n

Trong b\u1ed1i c\u1ea3nh c\u00e1c m\u1ed1i \u0111e d\u1ecda an ninh m\u1ea1ng ng\u00e0y c\u00e0ng ph\u00e1t tri\u1ec3n, c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng d\u1eef li\u1ec7u \u0111\u00e3 n\u1ed5i l\u00ean nh\u01b0 m\u1ed9t h\u00ecnh th\u1ee9c t\u1ea5n c\u00f4ng m\u1ea1ng \u0111\u1eb7c bi\u1ec7t qu\u1ef7 quy\u1ec7t v\u00e0 nguy hi\u1ec3m. Kh\u00f4ng gi\u1ed1ng nh\u01b0 ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i truy\u1ec1n th\u1ed1ng, c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng s\u1eed d\u1ee5ng t\u1ec7p d\u1ef1a v\u00e0o vi\u1ec7c khai th\u00e1c c\u00e1c c\u00f4ng c\u1ee5 v\u00e0 quy tr\u00ecnh h\u1ec7 th\u1ed1ng \u0111\u00e1ng tin c\u1eady, \u0111\u1ec3 l\u1ea1i r\u1ea5t \u00edt ho\u1eb7c kh\u00f4ng \u0111\u1ec3 l\u1ea1i d\u1ea5u v\u1ebft n\u00e0o tr\u00ean h\u1ec7 th\u1ed1ng c\u1ee7a n\u1ea1n nh\u00e2n. \u0110i\u1ec1u n\u00e0y khi\u1ebfn vi\u1ec7c ph\u00e1t hi\u1ec7n v\u00e0 ph\u00f2ng ch\u1ed1ng ch\u00fang tr\u1edf n\u00ean kh\u00f3 kh\u0103n h\u01a1n, g\u00e2y ra r\u1ee7i ro \u0111\u00e1ng k\u1ec3 cho c\u00e1c c\u00e1 nh\u00e2n, doanh nghi\u1ec7p v\u00e0 t\u1ed5 ch\u1ee9c.<\/p>\n

L\u1ecbch s\u1eed c\u1ee7a c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng file<\/h2>\n

Kh\u00e1i ni\u1ec7m t\u1ea5n c\u00f4ng kh\u00f4ng s\u1eed d\u1ee5ng t\u1ec7p c\u00f3 th\u1ec3 b\u1eaft ngu\u1ed3n t\u1eeb \u0111\u1ea7u nh\u1eefng n\u0103m 2000, nh\u01b0ng m\u1ee9c \u0111\u1ed9 ph\u1ed5 bi\u1ebfn v\u00e0 \u0111\u1ed9 tinh vi c\u1ee7a ch\u00fang \u0111\u00e3 t\u0103ng l\u00ean \u0111\u00e1ng k\u1ec3 trong nh\u1eefng n\u0103m g\u1ea7n \u0111\u00e2y. L\u1ea7n \u0111\u1ea7u ti\u00ean \u0111\u1ec1 c\u1eadp \u0111\u1ebfn c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p c\u00f3 th\u1ec3 l\u00e0 do s\u00e2u \u201cCode Red\u201d v\u00e0o n\u0103m 2001, n\u00f3 s\u1eed d\u1ee5ng m\u1ed9t d\u1ea1ng k\u1ef9 thu\u1eadt kh\u00f4ng d\u00f9ng t\u1ec7p ban \u0111\u1ea7u \u0111\u1ec3 l\u00e2y lan qua c\u00e1c h\u1ec7 th\u1ed1ng d\u1ec5 b\u1ecb t\u1ea5n c\u00f4ng. K\u1ec3 t\u1eeb \u0111\u00f3, t\u1ed9i ph\u1ea1m m\u1ea1ng \u0111\u00e3 m\u00e0i gi\u0169a ph\u01b0\u01a1ng ph\u00e1p c\u1ee7a m\u00ecnh, t\u1eadn d\u1ee5ng c\u00e1c k\u1ef9 thu\u1eadt ti\u00ean ti\u1ebfn \u0111\u1ec3 tr\u00e1nh b\u1ecb ph\u00e1t hi\u1ec7n v\u00e0 t\u0103ng kh\u1ea3 n\u0103ng th\u00e0nh c\u00f4ng cho c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng c\u1ee7a ch\u00fang.<\/p>\n

T\u00ecm hi\u1ec3u v\u1ec1 c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng file<\/h2>\n

T\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p l\u00e0 m\u1ed9t lo\u1ea1i t\u1ea5n c\u00f4ng m\u1ea1ng d\u1ef1a v\u00e0o vi\u1ec7c t\u1eadn d\u1ee5ng c\u00e1c quy tr\u00ecnh v\u00e0 c\u00f4ng c\u1ee5 h\u1ee3p ph\u00e1p c\u00f3 s\u1eb5n tr\u00ean h\u1ec7 th\u1ed1ng m\u1ee5c ti\u00eau \u0111\u1ec3 th\u1ef1c hi\u1ec7n c\u00e1c h\u00e0nh \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i. Thay v\u00ec d\u1ef1a v\u00e0o ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i truy\u1ec1n th\u1ed1ng c\u00e0i \u0111\u1eb7t c\u00e1c t\u1ec7p tr\u00ean h\u1ec7 th\u1ed1ng c\u1ee7a n\u1ea1n nh\u00e2n, c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p n\u1eb1m ho\u00e0n to\u00e0n trong b\u1ed9 nh\u1edb, kh\u00f4ng \u0111\u1ec3 l\u1ea1i d\u1ea5u v\u1ebft tr\u00ean \u0111\u0129a. Ch\u00fang th\u01b0\u1eddng l\u1ee3i d\u1ee5ng c\u00e1c l\u1ed7 h\u1ed5ng trong c\u00f4ng c\u1ee5 t\u1ea1o t\u1eadp l\u1ec7nh, PowerShell, C\u00f4ng c\u1ee5 qu\u1ea3n l\u00fd Windows (WMI) v\u00e0 c\u00e1c ti\u1ec7n \u00edch h\u1ec7 th\u1ed1ng kh\u00e1c \u0111\u1ec3 th\u1ef1c thi c\u00e1c t\u1ea3i tr\u1ecdng \u0111\u1ed9c h\u1ea1i c\u1ee7a ch\u00fang.<\/p>\n

C\u1ea5u tr\u00fac b\u00ean trong c\u1ee7a c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng file<\/h2>\n

C\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p th\u01b0\u1eddng tu\u00e2n theo m\u1ed9t quy tr\u00ecnh g\u1ed3m nhi\u1ec1u giai \u0111o\u1ea1n:<\/p>\n

    \n
  1. \n

    S\u1ef1 nhi\u1ec5m tr\u00f9ng<\/strong>: S\u1ef1 x\u00e2m nh\u1eadp ban \u0111\u1ea7u th\u01b0\u1eddng \u0111\u1ea1t \u0111\u01b0\u1ee3c th\u00f4ng qua k\u1ef9 thu\u1eadt x\u00e3 h\u1ed9i ho\u1eb7c khai th\u00e1c c\u00e1c l\u1ed7 h\u1ed5ng ph\u1ea7n m\u1ec1m.<\/p>\n<\/li>\n

  2. \n

    Khai th\u00e1c<\/strong>: K\u1ebb t\u1ea5n c\u00f4ng gi\u00e0nh \u0111\u01b0\u1ee3c ch\u1ed7 \u0111\u1ee9ng tr\u00ean h\u1ec7 th\u1ed1ng v\u00e0 c\u1ed1 g\u1eafng leo thang \u0111\u1eb7c quy\u1ec1n \u0111\u1ec3 gi\u00e0nh quy\u1ec1n truy c\u1eadp qu\u1ea3n tr\u1ecb.<\/p>\n<\/li>\n

  3. \n

    T\u1ea3i tr\u1ecdng d\u1ef1a tr\u00ean b\u1ed9 nh\u1edb<\/strong>: Sau khi c\u00f3 \u0111\u01b0\u1ee3c quy\u1ec1n truy c\u1eadp, k\u1ebb t\u1ea5n c\u00f4ng s\u1ebd t\u1ea3i m\u00e3 \u0111\u1ed9c tr\u1ef1c ti\u1ebfp v\u00e0o b\u1ed9 nh\u1edb c\u1ee7a h\u1ec7 th\u1ed1ng, b\u1ecf qua c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o v\u1ec7 \u0111i\u1ec3m cu\u1ed1i v\u00e0 ch\u1ed1ng vi-r\u00fat truy\u1ec1n th\u1ed1ng.<\/p>\n<\/li>\n

  4. \n

    Ch\u1ea5p h\u00e0nh<\/strong>: K\u1ebb t\u1ea5n c\u00f4ng th\u1ef1c thi t\u1ea3i tr\u1ecdng b\u1eb1ng c\u00e1c c\u00f4ng c\u1ee5 h\u1ec7 th\u1ed1ng h\u1ee3p ph\u00e1p, ch\u1eb3ng h\u1ea1n nh\u01b0 PowerShell ho\u1eb7c WMI, \u0111\u1ec3 tr\u1ed9n l\u1eabn v\u1edbi c\u00e1c ho\u1ea1t \u0111\u1ed9ng th\u00f4ng th\u01b0\u1eddng c\u1ee7a h\u1ec7 th\u1ed1ng.<\/p>\n<\/li>\n

  5. \n

    Sau khai th\u00e1c<\/strong>: Sau khi ho\u00e0n th\u00e0nh m\u1ee5c ti\u00eau, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 tri\u1ec3n khai c\u00e1c c\u00f4ng c\u1ee5 b\u1ed5 sung \u0111\u1ec3 duy tr\u00ec t\u00ednh \u1ed5n \u0111\u1ecbnh, thu th\u1eadp d\u1eef li\u1ec7u ho\u1eb7c di chuy\u1ec3n ngang qua m\u1ea1ng.<\/p>\n<\/li>\n<\/ol>\n

    C\u00e1c t\u00ednh n\u0103ng ch\u00ednh c\u1ee7a t\u1ea5n c\u00f4ng Fileless<\/h2>\n

    C\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p s\u1edf h\u1eefu m\u1ed9t s\u1ed1 t\u00ednh n\u0103ng ch\u00ednh gi\u00fap ph\u00e2n bi\u1ec7t ch\u00fang v\u1edbi ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i truy\u1ec1n th\u1ed1ng:<\/p>\n

      \n
    1. \n

      Kh\u00f4ng c\u00f3 t\u1eadp tin tr\u00ean \u0111\u0129a<\/strong>: \u0110\u00fang nh\u01b0 t\u00ean g\u1ecdi, c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng s\u1eed d\u1ee5ng t\u1ec7p kh\u00f4ng d\u1ef1a v\u00e0o vi\u1ec7c ghi t\u1ec7p v\u00e0o \u0111\u0129a c\u1ee7a n\u1ea1n nh\u00e2n, khi\u1ebfn ch\u00fang kh\u00f3 b\u1ecb ph\u00e1t hi\u1ec7n th\u00f4ng qua qu\u00e1 tr\u00ecnh qu\u00e9t ch\u1ed1ng vi-r\u00fat truy\u1ec1n th\u1ed1ng.<\/p>\n<\/li>\n

    2. \n

      N\u01a1i c\u01b0 tr\u00fa b\u1ed9 nh\u1edb<\/strong>: T\u1ea5t c\u1ea3 c\u00e1c th\u00e0nh ph\u1ea7n \u0111\u1ed9c h\u1ea1i \u0111\u1ec1u n\u1eb1m trong b\u1ed9 nh\u1edb c\u1ee7a h\u1ec7 th\u1ed1ng, l\u00e0m gi\u1ea3m kh\u1ea3 n\u0103ng l\u1ed9 di\u1ec7n c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng v\u00e0 t\u0103ng kh\u1ea3 n\u0103ng t\u00e0ng h\u00ecnh c\u1ee7a cu\u1ed9c t\u1ea5n c\u00f4ng.<\/p>\n<\/li>\n

    3. \n

      S\u1ed1ng xa \u0111\u1ea5t li\u1ec1n<\/strong>: C\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng c\u1ea7n d\u00f9ng t\u1ec7p s\u1eed d\u1ee5ng c\u00e1c c\u00f4ng c\u1ee5 v\u00e0 quy tr\u00ecnh h\u1ec7 th\u1ed1ng t\u00edch h\u1ee3p s\u1eb5n, tr\u00e1nh nhu c\u1ea7u t\u1ea3i xu\u1ed1ng v\u00e0 c\u00e0i \u0111\u1eb7t c\u00e1c t\u1ec7p b\u00ean ngo\u00e0i.<\/p>\n<\/li>\n

    4. \n

      K\u1ef9 thu\u1eadt n\u00e9 tr\u00e1nh<\/strong>: Nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng s\u1eed d\u1ee5ng nhi\u1ec1u k\u1ef9 thu\u1eadt kh\u00e1c nhau \u0111\u1ec3 tr\u00e1nh b\u1ecb ph\u00e1t hi\u1ec7n, ch\u1eb3ng h\u1ea1n nh\u01b0 s\u1eed d\u1ee5ng m\u00e3 h\u00f3a ho\u1eb7c m\u00e3 \u0111a h\u00ecnh \u0111\u1ec3 l\u00e0m x\u00e1o tr\u1ed9n s\u1ef1 hi\u1ec7n di\u1ec7n c\u1ee7a ch\u00fang.<\/p>\n<\/li>\n

    5. \n

      Kh\u1edbp l\u1ec7nh nhanh<\/strong>: V\u00ec kh\u00f4ng c\u1ea7n ghi t\u1ec7p n\u00ean c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p c\u00f3 th\u1ec3 th\u1ef1c hi\u1ec7n nhanh ch\u00f3ng, gi\u1ea3m thi\u1ec3u kh\u1ea3 n\u0103ng b\u1ecb ph\u00e1t hi\u1ec7n trong c\u00e1c giai \u0111o\u1ea1n quan tr\u1ecdng c\u1ee7a cu\u1ed9c t\u1ea5n c\u00f4ng.<\/p>\n<\/li>\n<\/ol>\n

      C\u00e1c lo\u1ea1i t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng file<\/h2>\n

      C\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p c\u00f3 th\u1ec3 c\u00f3 nhi\u1ec1u h\u00ecnh th\u1ee9c kh\u00e1c nhau, bao g\u1ed3m:<\/p>\n\n\n\n\n\n\n\n\n\n
      Ki\u1ec3u<\/th>\nS\u1ef1 mi\u00eau t\u1ea3<\/th>\n<\/tr>\n<\/thead>\n
      T\u1ea5n c\u00f4ng PowerShell<\/strong><\/td>\nT\u1eadn d\u1ee5ng c\u00e1c t\u1eadp l\u1ec7nh PowerShell \u0111\u1ec3 th\u1ef1c thi m\u00e3 \u0111\u1ed9c tr\u1ef1c ti\u1ebfp trong b\u1ed9 nh\u1edb.<\/td>\n<\/tr>\n
      T\u1ea5n c\u00f4ng WMI<\/strong><\/td>\nKhai th\u00e1c C\u00f4ng c\u1ee5 qu\u1ea3n l\u00fd Windows \u0111\u1ec3 th\u1ef1c thi c\u00e1c t\u1eadp l\u1ec7nh v\u00e0 tr\u1ed1n tr\u00e1nh s\u1ef1 ph\u00e1t hi\u1ec7n.<\/td>\n<\/tr>\n
      T\u1ea5n c\u00f4ng d\u1ef1a tr\u00ean v\u0129 m\u00f4<\/strong><\/td>\nS\u1eed d\u1ee5ng macro \u0111\u1ed9c h\u1ea1i trong t\u00e0i li\u1ec7u (v\u00ed d\u1ee5: Microsoft Office) \u0111\u1ec3 ch\u1ea1y m\u00e3 tr\u1ef1c ti\u1ebfp trong b\u1ed9 nh\u1edb.<\/td>\n<\/tr>\n
      T\u1ea5n c\u00f4ng s\u1ed5 \u0111\u0103ng k\u00fd<\/strong><\/td>\nThao t\u00e1c v\u1edbi Windows S\u1ed5 \u0111\u0103ng k\u00fd \u0111\u1ec3 l\u01b0u tr\u1eef v\u00e0 th\u1ef1c thi m\u00e3 \u0111\u1ed9c m\u00e0 kh\u00f4ng c\u1ea7n ghi v\u00e0o \u0111\u0129a.<\/td>\n<\/tr>\n
      S\u1ed1ng nh\u1edd c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng tr\u00ean \u0111\u1ea5t li\u1ec1n<\/strong><\/td>\nS\u1eed d\u1ee5ng c\u00e1c c\u00f4ng c\u1ee5 h\u1ec7 th\u1ed1ng t\u00edch h\u1ee3p, ch\u1eb3ng h\u1ea1n nh\u01b0 \u201cnet\u201d v\u00e0 \u201cwmic\u201d cho m\u1ee5c \u0111\u00edch x\u1ea5u.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      S\u1eed d\u1ee5ng c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng Fileless, v\u1ea5n \u0111\u1ec1 v\u00e0 gi\u1ea3i ph\u00e1p<\/h2>\n

      C\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p \u0111\u1eb7t ra nh\u1eefng th\u00e1ch th\u1ee9c \u0111\u00e1ng k\u1ec3 cho c\u00e1c chuy\u00ean gia v\u00e0 t\u1ed5 ch\u1ee9c an ninh m\u1ea1ng:<\/p>\n

        \n
      1. \n

        Kh\u00f3 ph\u00e1t hi\u1ec7n<\/strong>: C\u00e1c gi\u1ea3i ph\u00e1p ch\u1ed1ng vi-r\u00fat truy\u1ec1n th\u1ed1ng th\u01b0\u1eddng g\u1eb7p kh\u00f3 kh\u0103n trong vi\u1ec7c ph\u00e1t hi\u1ec7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p do thi\u1ebfu t\u1ec7p tr\u00ean \u0111\u0129a, y\u00eau c\u1ea7u b\u1ea3o v\u1ec7 \u0111i\u1ec3m cu\u1ed1i n\u00e2ng cao b\u1eb1ng ph\u00e2n t\u00edch d\u1ef1a tr\u00ean h\u00e0nh vi.<\/p>\n<\/li>\n

      2. \n

        Th\u1eed th\u00e1ch ph\u00e1p y<\/strong>: Vi\u1ec7c thi\u1ebfu c\u00e1c t\u1eadp tin khi\u1ebfn vi\u1ec7c \u0111i\u1ec1u tra sau cu\u1ed9c t\u1ea5n c\u00f4ng tr\u1edf n\u00ean kh\u00f3 kh\u0103n h\u01a1n, c\u00f3 kh\u1ea3 n\u0103ng c\u1ea3n tr\u1edf vi\u1ec7c x\u00e1c \u0111\u1ecbnh c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng.<\/p>\n<\/li>\n

      3. \n

        N\u00e2ng cao \u0111\u1eb7c quy\u1ec1n<\/strong>: C\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p th\u01b0\u1eddng d\u1ef1a v\u00e0o vi\u1ec7c leo thang \u0111\u1eb7c quy\u1ec1n \u0111\u1ec3 c\u00f3 \u0111\u01b0\u1ee3c quy\u1ec1n truy c\u1eadp qu\u1ea3n tr\u1ecb, nh\u1ea5n m\u1ea1nh s\u1ef1 c\u1ea7n thi\u1ebft c\u1ee7a c\u00e1c bi\u1ec7n ph\u00e1p ki\u1ec3m so\u00e1t truy c\u1eadp m\u1ea1nh m\u1ebd v\u00e0 c\u1eadp nh\u1eadt b\u1ea3o m\u1eadt th\u01b0\u1eddng xuy\u00ean.<\/p>\n<\/li>\n

      4. \n

        Nh\u1eadn th\u1ee9c an ninh<\/strong>: K\u1ef9 thu\u1eadt l\u1eeba \u0111\u1ea3o qua m\u1ea1ng v\u1eabn l\u00e0 m\u1ed9t ph\u01b0\u01a1ng ti\u1ec7n l\u00e2y nhi\u1ec5m ph\u1ed5 bi\u1ebfn, nh\u1ea5n m\u1ea1nh t\u1ea7m quan tr\u1ecdng c\u1ee7a vi\u1ec7c gi\u00e1o d\u1ee5c ng\u01b0\u1eddi d\u00f9ng v\u1ec1 c\u00e1c li\u00ean k\u1ebft l\u1eeba \u0111\u1ea3o v\u00e0 \u0111\u00e1ng ng\u1edd.<\/p>\n<\/li>\n

      5. \n

        B\u1ea3o v\u1ec7 m\u1ed1i \u0111e d\u1ecda n\u00e2ng cao<\/strong>: Vi\u1ec7c tri\u1ec3n khai c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt nhi\u1ec1u l\u1edbp, bao g\u1ed3m h\u1ec7 th\u1ed1ng ph\u00e2n \u0111o\u1ea1n m\u1ea1ng v\u00e0 ph\u00e1t hi\u1ec7n x\u00e2m nh\u1eadp, c\u00f3 th\u1ec3 gi\u1ea3m thi\u1ec3u nguy c\u01a1 x\u1ea3y ra c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p.<\/p>\n<\/li>\n<\/ol>\n

        \u0110\u1eb7c \u0111i\u1ec3m ch\u00ednh v\u00e0 so s\u00e1nh<\/h2>\n\n\n\n\n\n\n\n\n\n
        \u0111\u1eb7c tr\u01b0ng<\/th>\nT\u1ea5n c\u00f4ng kh\u00f4ng c\u1ea7n file<\/th>\nPh\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i truy\u1ec1n th\u1ed1ng<\/th>\n<\/tr>\n<\/thead>\n
        Ki\u00ean tr\u00ec<\/td>\nTh\u01b0\u1eddng t\u1eadn d\u1ee5ng c\u00e1c k\u1ef9 thu\u1eadt s\u1ed1ng nh\u1edd v\u00e0o \u0111\u1ea5t \u0111ai \u0111\u1ec3 c\u00f3 \u0111\u01b0\u1ee3c s\u1ef1 ki\u00ean tr\u00ec.<\/td>\nD\u1ef1a v\u00e0o c\u00e1c t\u1eadp tin b\u1eb1ng v\u0103n b\u1ea3n v\u00e0 c\u00e1c m\u1ee5c \u0111\u0103ng k\u00fd \u0111\u1ec3 duy tr\u00ec s\u1ef1 b\u1ec1n b\u1ec9.<\/td>\n<\/tr>\n
        D\u1ea5u ch\u00e2n<\/td>\n\u0110\u1ec3 l\u1ea1i t\u1ed1i thi\u1ec3u ho\u1eb7c kh\u00f4ng c\u00f3 d\u1ea5u v\u1ebft tr\u00ean \u0111\u0129a.<\/td>\n\u0110\u1ec3 l\u1ea1i c\u00e1c t\u1eadp tin v\u00e0 t\u1ea1o ph\u1ea9m tr\u00ean \u0111\u0129a.<\/td>\n<\/tr>\n
        C\u01a1 ch\u1ebf giao h\u00e0ng<\/td>\nTh\u01b0\u1eddng b\u1eaft \u0111\u1ea7u b\u1eb1ng k\u1ef9 thu\u1eadt x\u00e3 h\u1ed9i ho\u1eb7c khai th\u00e1c l\u1ed7 h\u1ed5ng ph\u1ea7n m\u1ec1m.<\/td>\nTh\u01b0\u1eddng \u0111\u01b0\u1ee3c g\u1eedi qua t\u1ec7p \u0111\u00ednh k\u00e8m email, trang web \u0111\u1ed9c h\u1ea1i ho\u1eb7c ph\u1ea7n m\u1ec1m b\u1ecb nhi\u1ec5m \u0111\u1ed9c.<\/td>\n<\/tr>\n
        Ph\u00e1t hi\u1ec7n<\/td>\nKh\u00f3 ph\u00e1t hi\u1ec7n b\u1eb1ng c\u00e1c ph\u01b0\u01a1ng ph\u00e1p d\u1ef1a tr\u00ean ch\u1eef k\u00fd truy\u1ec1n th\u1ed1ng.<\/td>\nC\u00f3 th\u1ec3 ph\u00e1t hi\u1ec7n b\u1eb1ng c\u00e1ch s\u1eed d\u1ee5ng c\u00e1c gi\u1ea3i ph\u00e1p ch\u1ed1ng vi-r\u00fat d\u1ef1a tr\u00ean ch\u1eef k\u00fd.<\/td>\n<\/tr>\n
        Vector l\u00e2y nhi\u1ec5m<\/td>\nC\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng l\u1eeba \u0111\u1ea3o, l\u1eeba \u0111\u1ea3o tr\u1ef1c tuy\u1ebfn ho\u1eb7c t\u01b0\u1edbi n\u01b0\u1edbc.<\/td>\nT\u1ea3i xu\u1ed1ng \u0111\u1ed9c h\u1ea1i ho\u1eb7c c\u00e1c t\u1eadp tin b\u1ecb nhi\u1ec5m b\u1ec7nh.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        Quan \u0111i\u1ec3m v\u00e0 c\u00f4ng ngh\u1ec7 t\u01b0\u01a1ng lai<\/h2>\n

        Khi c\u00f4ng ngh\u1ec7 ti\u1ebfp t\u1ee5c ph\u00e1t tri\u1ec3n, c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p c\u0169ng s\u1ebd ph\u00e1t tri\u1ec3n. C\u00e1c xu h\u01b0\u1edbng v\u00e0 s\u1ef1 ph\u00e1t tri\u1ec3n trong t\u01b0\u01a1ng lai c\u00f3 th\u1ec3 bao g\u1ed3m:<\/p>\n

          \n
        1. \n

          T\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng file tr\u00ean thi\u1ebft b\u1ecb di \u0111\u1ed9ng<\/strong>: M\u1edf r\u1ed9ng ph\u1ea1m vi t\u1ea5n c\u00f4ng kh\u00f4ng c\u1ea7n d\u00f9ng t\u1ec7p \u0111\u1ec3 nh\u1eafm m\u1ee5c ti\u00eau v\u00e0o c\u00e1c n\u1ec1n t\u1ea3ng di \u0111\u1ed9ng khi ch\u00fang tr\u1edf n\u00ean ph\u1ed5 bi\u1ebfn h\u01a1n.<\/p>\n<\/li>\n

        2. \n

          Ph\u00e1t hi\u1ec7n \u0111\u01b0\u1ee3c h\u1ed7 tr\u1ee3 b\u1edfi AI<\/strong>: Nh\u1eefng ti\u1ebfn b\u1ed9 trong tr\u00ed tu\u1ec7 nh\u00e2n t\u1ea1o s\u1ebd c\u1ea3i thi\u1ec7n kh\u1ea3 n\u0103ng ph\u00e1t hi\u1ec7n c\u1ee7a c\u00e1c h\u1ec7 th\u1ed1ng ph\u00e1t hi\u1ec7n t\u1ea5n c\u00f4ng kh\u00f4ng c\u1ea7n d\u00f9ng t\u1ec7p.<\/p>\n<\/li>\n

        3. \n

          B\u1ea3o m\u1eadt d\u1ef1a tr\u00ean ph\u1ea7n c\u1ee9ng<\/strong>: C\u00e1c gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt d\u1ef1a tr\u00ean ph\u1ea7n c\u1ee9ng c\u00f3 th\u1ec3 xu\u1ea5t hi\u1ec7n \u0111\u1ec3 cung c\u1ea5p th\u00eam m\u1ed9t l\u1edbp b\u1ea3o v\u1ec7 ch\u1ed1ng l\u1ea1i c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p.<\/p>\n<\/li>\n

        4. \n

          Ki\u1ebfn tr\u00fac kh\u00f4ng tin c\u1eady<\/strong>: C\u00e1c t\u1ed5 ch\u1ee9c c\u00f3 th\u1ec3 \u00e1p d\u1ee5ng ki\u1ebfn tr\u00fac kh\u00f4ng tin c\u1eady \u0111\u1ec3 h\u1ea1n ch\u1ebf chuy\u1ec3n \u0111\u1ed9ng ngang v\u00e0 ng\u0103n ch\u1eb7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng c\u1ea7n truy c\u1eadp.<\/p>\n<\/li>\n<\/ol>\n

          M\u00e1y ch\u1ee7 proxy v\u00e0 c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng file<\/h2>\n

          M\u00e1y ch\u1ee7 proxy c\u00f3 th\u1ec3 \u0111\u00f3ng m\u1ed9t vai tr\u00f2 quan tr\u1ecdng trong vi\u1ec7c b\u1ea3o v\u1ec7 ch\u1ed1ng l\u1ea1i c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p. B\u1eb1ng c\u00e1ch \u0111\u1ecbnh tuy\u1ebfn l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp internet th\u00f4ng qua m\u00e1y ch\u1ee7 proxy, c\u00e1c t\u1ed5 ch\u1ee9c c\u00f3 th\u1ec3 th\u1ef1c hi\u1ec7n c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt b\u1ed5 sung nh\u01b0:<\/p>\n

            \n
          1. \n

            L\u1ecdc n\u1ed9i dung web<\/strong>: M\u00e1y ch\u1ee7 proxy c\u00f3 th\u1ec3 ch\u1eb7n quy\u1ec1n truy c\u1eadp v\u00e0o c\u00e1c trang web \u0111\u1ed9c h\u1ea1i \u0111\u00e3 bi\u1ebft v\u00e0 c\u00e1c mi\u1ec1n \u0111\u00e1ng ng\u1edd, gi\u1ea3m nguy c\u01a1 t\u1ea3i xu\u1ed1ng c\u00e1c t\u1ea3i tr\u1ecdng t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p.<\/p>\n<\/li>\n

          2. \n

            Ph\u00f2ng ch\u1ed1ng x\u00e2m nh\u1eadp<\/strong>: M\u00e1y ch\u1ee7 proxy c\u00f3 kh\u1ea3 n\u0103ng ng\u0103n ch\u1eb7n x\u00e2m nh\u1eadp c\u00f3 th\u1ec3 ph\u00e1t hi\u1ec7n v\u00e0 ch\u1eb7n l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp \u0111\u1ed9c h\u1ea1i li\u00ean quan \u0111\u1ebfn c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p.<\/p>\n<\/li>\n

          3. \n

            Ki\u1ec3m tra SSL<\/strong>: Proxy c\u00f3 th\u1ec3 ki\u1ec3m tra l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a \u0111\u1ec3 t\u00ecm d\u1ea5u hi\u1ec7u c\u1ee7a ho\u1ea1t \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i, ho\u1ea1t \u0111\u1ed9ng n\u00e0y th\u01b0\u1eddng \u0111\u01b0\u1ee3c c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng s\u1eed d\u1ee5ng t\u1ec7p s\u1eed d\u1ee5ng \u0111\u1ec3 che gi\u1ea5u ho\u1ea1t \u0111\u1ed9ng c\u1ee7a ch\u00fang.<\/p>\n<\/li>\n

          4. \n

            \u1ea8n danh v\u00e0 quy\u1ec1n ri\u00eang t\u01b0<\/strong>: M\u00e1y ch\u1ee7 proxy c\u00f3 th\u1ec3 n\u00e2ng cao quy\u1ec1n ri\u00eang t\u01b0 v\u00e0 \u1ea9n danh c\u1ee7a ng\u01b0\u1eddi d\u00f9ng, gi\u1ea3m nguy c\u01a1 b\u1ecb t\u1ea5n c\u00f4ng c\u00f3 ch\u1ee7 \u0111\u00edch.<\/p>\n<\/li>\n<\/ol>\n

            Li\u00ean k\u1ebft li\u00ean quan<\/h2>\n

            \u0110\u1ec3 bi\u1ebft th\u00eam th\u00f4ng tin v\u1ec1 c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng s\u1eed d\u1ee5ng t\u1ec7p v\u00e0 an ninh m\u1ea1ng, h\u00e3y xem x\u00e9t kh\u00e1m ph\u00e1 c\u00e1c t\u00e0i nguy\u00ean sau:<\/p>\n

              \n
            1. MITER ATT&CK\u00ae cho k\u1ef9 thu\u1eadt kh\u00f4ng d\u00f9ng file<\/a><\/li>\n
            2. Th\u00f4ng tin chi ti\u1ebft c\u1ee7a C\u01a1 quan An ninh m\u1ea1ng v\u00e0 C\u01a1 s\u1edf h\u1ea1 t\u1ea7ng (CISA) v\u1ec1 Ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i kh\u00f4ng d\u00f9ng t\u1ec7p<\/a><\/li>\n
            3. C\u1ed5ng th\u00f4ng tin v\u1ec1 m\u1ed1i \u0111e d\u1ecda c\u1ee7a Kaspersky<\/a><\/li>\n
            4. Blog c\u1ee7a Symantec v\u1ec1 ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i kh\u00f4ng d\u00f9ng file<\/a><\/li>\n<\/ol>\n

              T\u00f3m l\u1ea1i, c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng d\u00f9ng t\u1ec7p th\u1ec3 hi\u1ec7n m\u1ed9t m\u1ed1i \u0111e d\u1ecda m\u1ea1ng ph\u1ee9c t\u1ea1p v\u00e0 l\u00e9n l\u00fat, \u0111\u00f2i h\u1ecfi s\u1ef1 c\u1ea3nh gi\u00e1c th\u01b0\u1eddng xuy\u00ean v\u00e0 c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt ch\u1ee7 \u0111\u1ed9ng. B\u1eb1ng c\u00e1ch hi\u1ec3u ph\u01b0\u01a1ng ph\u00e1p c\u1ee7a h\u1ecd, \u0111\u1ea7u t\u01b0 v\u00e0o c\u00e1c gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt ti\u00ean ti\u1ebfn v\u00e0 t\u1eadn d\u1ee5ng kh\u1ea3 n\u0103ng b\u1ea3o v\u1ec7 c\u1ee7a m\u00e1y ch\u1ee7 proxy, c\u00e1c t\u1ed5 ch\u1ee9c c\u00f3 th\u1ec3 b\u1ea3o v\u1ec7 t\u1ed1t h\u01a1n tr\u01b0\u1edbc m\u1ed1i \u0111e d\u1ecda ng\u00e0y c\u00e0ng ph\u00e1t tri\u1ec3n n\u00e0y.<\/p>","protected":false},"featured_media":477232,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-477231","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about Fileless Attacks: A Stealthy Cyber Threat<\/mark>","faq_items":[{"question":"What are fileless attacks, and how do they work?","answer":"

              Fileless attacks are a type of cyber attack that avoids traditional malware files and operates entirely in the system's memory. Instead of writing files on the victim's disk, these attacks leverage legitimate system tools, like PowerShell or WMI, to execute malicious code directly in memory. This makes fileless attacks difficult to detect using traditional antivirus solutions, making them a potent threat.<\/p>"},{"question":"How did fileless attacks originate?","answer":"

              Fileless attacks have been around since the early 2000s, with the \"Code Red\" worm being one of the earliest examples. Over the years, cybercriminals have refined their techniques, capitalizing on vulnerabilities in scripting engines and system utilities to create more sophisticated and evasive fileless attacks.<\/p>"},{"question":"What are the key features of fileless attacks?","answer":"

              The key features of fileless attacks include their lack of files on disk, memory residency, exploitation of system tools, evasion techniques, and fast execution. By residing in memory, these attacks reduce their exposure and footprint, enabling them to bypass traditional security measures effectively.<\/p>"},{"question":"What types of fileless attacks exist?","answer":"

              There are several types of fileless attacks, including:<\/p>

              1. PowerShell Attacks: Leveraging PowerShell scripts to execute malicious code in memory.<\/li>
              2. WMI Attacks: Exploiting Windows Management Instrumentation for evading detection.<\/li>
              3. Macro-based Attacks: Using malicious macros in documents for memory-based execution.<\/li>
              4. Registry Attacks: Manipulating the Windows Registry to run code without writing to disk.<\/li>
              5. Living off the Land Attacks: Utilizing built-in system tools for malicious purposes.<\/li><\/ol>"},{"question":"How can organizations defend against fileless attacks?","answer":"

                Defending against fileless attacks requires a multi-layered approach:<\/p>

                1. Advanced Endpoint Protection: Employing behavior-based analysis and AI-powered detection to identify fileless attack patterns.<\/li>
                2. Security Awareness Training: Educating users to recognize social engineering and phishing attempts.<\/li>
                3. Privilege Management: Implementing strict access controls and regular security updates to prevent privilege escalation.<\/li>
                4. Network Segmentation: Employing network segmentation and intrusion detection to limit lateral movement.<\/li>
                5. Proxy Server Protection: Utilizing proxy servers with web content filtering, intrusion prevention, and SSL inspection capabilities to bolster security.<\/li><\/ol>"},{"question":"What are the future perspectives and technologies related to fileless attacks?","answer":"

                  The future of fileless attacks may involve targeting mobile devices, advancements in AI-powered detection, hardware-based security solutions, and increased adoption of zero-trust architectures to counter these threats.<\/p>"},{"question":"How can proxy servers help in mitigating fileless attacks?","answer":"

                  Proxy servers can enhance cybersecurity defenses against fileless attacks by:<\/p>

                  1. Web Content Filtering: Blocking access to known malicious websites and suspicious domains.<\/li>
                  2. Intrusion Prevention: Detecting and blocking malicious traffic associated with fileless attacks.<\/li>
                  3. SSL Inspection: Inspecting encrypted traffic for signs of malicious activity used by fileless attacks.<\/li>
                  4. Anonymity and Privacy: Enhancing user privacy and anonymity, reducing the risk of targeted attacks.<\/li><\/ol>

                    Discover more about fileless attacks, their challenges, and protective measures using proxy servers to bolster your cybersecurity defenses against these elusive threats!<\/p>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki\/477231","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki\/477231\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/media\/477232"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/media?parent=477231"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}