{"id":613,"date":"2022-09-20T00:04:51","date_gmt":"2022-09-19T16:04:51","guid":{"rendered":"http:\/\/www.aqwu.net\/wp\/?p=613"},"modified":"2022-09-20T00:04:51","modified_gmt":"2022-09-19T16:04:51","slug":"%e7%bb%95%e8%bf%87-crowdstrike-falcon-edr-%e4%bf%9d%e6%8a%a4%ef%bc%8c%e9%98%b2%e6%ad%a2-lsass-exe-%e7%ad%89%e8%bf%9b%e7%a8%8b%e8%bd%ac%e5%82%a8","status":"publish","type":"post","link":"https:\/\/www.aqwu.net\/wp\/?p=613","title":{"rendered":"\u7ed5\u8fc7 CrowdStrike Falcon EDR \u4fdd\u62a4\uff0c\u9632\u6b62 lsass.exe \u7b49\u8fdb\u7a0b\u8f6c\u50a8"},"content":{"rendered":"\n<p>\u4f5c\u4e3a\u6e17\u900f\u6d4b\u8bd5\u4eba\u5458\uff0c\u5f53\u60a8\u7834\u574f\u7f51\u7edc\u4e0a\u7684 Windows \u673a\u5668\u5e76\u5e0c\u671b\u6269\u5c55\u5230\u5176\u4ed6\u8bbe\u5907\u5e76\u8fdb\u884c\u6a2a\u5411\u79fb\u52a8\u65f6\uff0c\u60a8\u8981\u505a\u7684\u4e3b\u8981\u4e8b\u60c5\u4e4b\u4e00\u5c31\u662f\u8f6c\u50a8 lsass \u8fdb\u7a0b\u5e76\u5c1d\u8bd5\u63d0\u53d6\u5176\u4e2d\u7684\u7eaf\u6587\u672c\u5bc6\u7801\u548c\u54c8\u5e0c\u503c\u5b83\u53ef\u80fd\u5c5e\u4e8e\u5176\u4ed6\u7528\u6237\uff0c\u4f46\u5982\u679c\u673a\u5668\u4e0a\u5b89\u88c5\u4e86 EDR\uff0c\u5b83\u5c06\u963b\u6b62\u60a8\u4ee5\u4f20\u7edf\u65b9\u5f0f\u8f6c\u50a8 lsass\u3002<\/p>\n\n\n\n<p>\u539f\u6587\u94fe\u63a5\uff1ahttps:\/\/medium.com\/@balqurneh\/bypass-crowdstrike-falcon-edr-protection-against-process-dump-like-lsass-exe-3c163e1b8a3e<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/miro.medium.com\/max\/1400\/1*oPKLFojEbFDAwWTSlYvSOA.png\" alt=\"\"\/><\/figure>\n\n\n\n<p id=\"7831\">\u5728\u672c\u6587\u4e2d\uff0c\u6211\u5c06\u6f14\u793a\u4e00\u79cd\u6211\u53d1\u73b0\u7684\u7ed5\u8fc7\u6b64\u68c0\u6d4b\u5e76\u901a\u8fc7\u5145\u5f53\u84dd\u961f\u4ece\u5185\u5b58\u4e2d\u8f6c\u50a8\u54c8\u5e0c\u503c\u7684\u65b9\u6cd5<\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"f9b9\">TL;\u535a\u58eb<\/h1>\n\n\n\n<p id=\"9675\">\u4f7f\u7528\u4efb\u4f55\u53d6\u8bc1\u5de5\u5177\uff08\u5982\uff08dumpit.exe\uff0cMAGNET RAM Capture\uff09\uff09\u5bf9 RAM \u8fdb\u884c\u5185\u5b58\u8f6c\u50a8\uff0c\u5e76\u4ece\u8f6c\u50a8\u4e2d\u4f7f\u7528\u6613\u5931\u6027\u63d0\u53d6 lsass \u8fdb\u7a0b\u6216\u76f4\u63a5\u4ece\u4e2d\u63d0\u53d6\u6563\u5217\u3002<\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"fe4c\">\u957f\u7248\uff1a<\/h1>\n\n\n\n<p id=\"8151\">CrowdStrike Falcon EDR \u4e0d\u5141\u8bb8\u5982\u4e0a\u56fe\u6240\u793a\u7684\u8fdb\u7a0b\u8f6c\u50a8\uff0c\u800c\u662f\u5141\u8bb8\u7cfb\u7edf\u7684 RAM \u8f6c\u50a8\u3002<\/p>\n\n\n\n<p id=\"6d20\">\u6211\u53ef\u80fd\u4f1a\u4f7f\u7528\u4e00\u4e9b\u5de5\u5177\u6765\u6267\u884c\u5185\u5b58\u83b7\u53d6<code>MAGNET RAM Capture<\/code>\uff0c\u8fd9\u662f\u4e00\u4e2a\u514d\u8d39\u5de5\u5177\uff0c\u53ef\u4ee5\u5728\u4efb\u4f55\u5b89\u88c5\u4e2d\u8fd0\u884c<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/miro.medium.com\/max\/1400\/1*trnXlVFOv_gK901ntgEHfg.png\" alt=\"\"\/><\/figure>\n\n\n\n<p id=\"2bf1\">\u5185\u5b58\u73b0\u5728\u5df2\u88ab\u6355\u83b7\u5e76\u51c6\u5907\u597d\u8fdb\u884c\u5206\u6790\uff0c\u73b0\u5728\u5c06\u4ece\u4f7f\u7528\u6ce2\u52a8\u7387\u63d0\u53d6\u54c8\u5e0c\u5f00\u59cb\uff0c\u5982\u679c\u60a8\u65e0\u6cd5\u4f20\u8f93\u6587\u4ef6\u6216\u5c06\u56fe\u50cf\u8f6c\u50a8\u590d\u5236\u5230\u653b\u51fb\u673a\u5e76\u5728\u672c\u5730\u5206\u6790\uff0c\u60a8\u53ef\u4ee5\u76f4\u63a5\u5728\u76ee\u6807\u7cfb\u7edf\u4e0a\u4e0b\u8f7d\u6ce2\u52a8\u7387<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/miro.medium.com\/max\/1400\/1*iDuBkpQV8N6kQQAjIa4--A.png\" alt=\"\"\/><\/figure>\n\n\n\n<p id=\"c882\">\u793e\u4f1a\u7684\uff1a<\/p>\n\n\n\n<p id=\"d886\">\u9886\u82f1\uff1a<a href=\"https:\/\/www.linkedin.com\/in\/bilal-alqurneh\/\" rel=\"noreferrer noopener\" target=\"_blank\">https :\/\/www.linkedin.com\/in\/bilal-alqurneh\/<\/a><\/p>\n\n\n\n<p id=\"5bf9\">\u63a8\u7279\uff1a<a href=\"https:\/\/twitter.com\/0xcc00\" rel=\"noreferrer noopener\" target=\"_blank\">https :\/\/twitter.com\/0xcc00<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/medium.com\/m\/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2F3c163e1b8a3e&amp;operation=register&amp;redirect=https%3A%2F%2Fmedium.com%2F%40balqurneh%2Fbypass-crowdstrike-falcon-edr-protection-against-process-dump-like-lsass-exe-3c163e1b8a3e&amp;user=bilal+al-qurneh&amp;userId=6a666420f738&amp;source=-----3c163e1b8a3e---------------------clap_footer-----------\"><\/a><a href=\"https:\/\/medium.com\/m\/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2F3c163e1b8a3e&amp;operation=register&amp;redirect=https%3A%2F%2Fmedium.com%2F%40balqurneh%2Fbypass-crowdstrike-falcon-edr-protection-against-process-dump-like-lsass-exe-3c163e1b8a3e&amp;user=bilal+al-qurneh&amp;userId=6a666420f738&amp;source=-----3c163e1b8a3e---------------------clap_footer-----------\"><\/a><\/p>\n\n\n\n<p>6<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u4f5c\u4e3a\u6e17\u900f\u6d4b\u8bd5\u4eba\u5458\uff0c\u5f53\u60a8\u7834\u574f\u7f51\u7edc\u4e0a\u7684 Windows \u673a\u5668\u5e76\u5e0c\u671b\u6269\u5c55\u5230\u5176\u4ed6\u8bbe\u5907\u5e76\u8fdb\u884c\u6a2a\u5411\u79fb\u52a8\u65f6\uff0c\u60a8\u8981\u505a\u7684\u4e3b\u8981\u4e8b\u60c5 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[11,102,5,43],"tags":[147,148],"class_list":["post-613","post","type-post","status-publish","format-standard","hentry","category-crowdstrike","category-windows-infoarticle","category-infosec","category-infoarticle","tag-crowdstrike-falcon-edr","tag-148"],"views":1958,"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/posts\/613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=613"}],"version-history":[{"count":1,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/posts\/613\/revisions"}],"predecessor-version":[{"id":614,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/posts\/613\/revisions\/614"}],"wp:attachment":[{"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=613"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}