{"id":6215,"date":"2024-06-14T15:08:48","date_gmt":"2024-06-14T07:08:48","guid":{"rendered":"https:\/\/aict.nkust.edu.tw\/digitrans\/?p=6215"},"modified":"2024-06-14T15:08:53","modified_gmt":"2024-06-14T07:08:53","slug":"%e9%a7%ad%e5%ae%a2%e8%97%89%e7%94%b1excel%e5%b7%a8%e9%9b%86%e9%80%b2%e8%a1%8c%e5%a4%9a%e9%9a%8e%e6%ae%b5%e6%83%a1%e6%84%8f%e8%bb%9f%e9%ab%94%e6%94%bb%e6%93%8a%ef%bc%8c%e9%87%9d%e5%b0%8d%e7%83%8f","status":"publish","type":"post","link":"https:\/\/aict.nkust.edu.tw\/digitrans\/?p=6215","title":{"rendered":"\u99ed\u5ba2\u85c9\u7531Excel\u5de8\u96c6\u9032\u884c\u591a\u968e\u6bb5\u60e1\u610f\u8edf\u9ad4\u653b\u64ca\uff0c\u91dd\u5c0d\u70cf\u514b\u862d\u96fb\u8166\u690d\u5165Cobalt Strike"},"content":{"rendered":"\n

2024-06-14 | \u5468\u5cfb\u4f51<\/p>\n\n\n\n

\u8cc7\u5b89\u696d\u8005Fortinet\u91dd\u5c0d\u9396\u5b9a\u70cf\u514b\u862d\u5229\u7528Excel\u5de8\u96c6\u6563\u5e03\u6ef2\u900f\u6e2c\u8a66\u5de5\u5177Cobalt Strike\u7684\u653b\u64ca\u884c\u52d5\u63d0\u51fa\u8b66\u544a\uff0c\u4e26\u6307\u51fa\u5c0d\u65b9\u5728\u904e\u7a0b\u88e1\u63a1\u7528\u5404\u7a2e\u898f\u907f\u624b\u6cd5\uff0c\u4f86\u78ba\u4fdd\u6709\u6548\u916c\u8f09\u80fd\u5920\u6210\u529f\u9001\u9054\u3002<\/p>\n\n\n\n

\u99ed\u5ba2\u5148\u662f\u50b3\u9001\u5167\u542b\u70cf\u514b\u862d\u6587\u5b57\u7684Excel\u5de8\u96c6\uff0c\u4e00\u65e6\u4f7f\u7528\u8005\u4f9d\u7167\u6307\u793a\u555f\u7528\u5de8\u96c6\uff0c\u8a72\u6a94\u6848\u5c31\u6703\u5207\u63db\u6210\u5206\u914d\u8ecd\u4e8b\u55ae\u4f4d\u9810\u7b97\u7684\u5de5\u4f5c\u8868\uff0c\u800c\u5728\u6b64\u540c\u6642\uff0c\u5de8\u96c6\u5247\u6703\u85c9\u7531\u516c\u7528\u7a0b\u5f0fregsvr32\uff0c\u5728\u5f8c\u81fa\u90e8\u7f72DLL\u7a0b\u5f0f\u5eab\uff0c\u4ee5\u4fbf\u4e0b\u8f09\u4f5c\u6848\u5de5\u5177\u3002<\/p>\n\n\n\n

\u9019\u500b\u60e1\u610f\u7a0b\u5f0f\u4e0b\u8f09\u5de5\u5177\u5728\u555f\u52d5\u7684\u904e\u7a0b\u7576\u4e2d\uff0c\u6703\u6aa2\u67e5\u76ee\u6a19\u96fb\u8166\u662f\u5426\u5b58\u5728Avast\u9632\u6bd2\u8edf\u9ad4\u53caProcess Hacker\u7684\u8655\u7406\u7a0b\u5e8f\uff0c\u4e26\u78ba\u8a8d\u96fb\u8166\u7684\u5730\u7406\u4f4d\u7f6e\u5728\u70cf\u514b\u862d\uff0c\u7136\u5f8c\u5f9e\u9060\u7aef\u4f3a\u670d\u5668\u4e0b\u8f09\u53e6\u4e00\u500b\u7d93\u904e\u7de8\u78bc\u8655\u7406\u7684\u6709\u6548\u916c\u8f09\uff0c\u6700\u7d42\u5c07Cobalt Strike\u7684Beacon\u6ce8\u5165\uff0c\u4e26\u8207C2\u4f3a\u670d\u5668\u5efa\u7acb\u9023\u7dda\u3002<\/p>\n\n\n

\n
\"\"\/<\/a><\/figure>\n<\/div>\n\n\n

\u503c\u5f97\u7559\u610f\u7684\u662f\uff0c\u9019\u7a2e\u5229\u7528Excel\u5de8\u96c6\u6563\u5e03Cobalt Strike Beacon\u7684\u653b\u64ca\u884c\u52d5\uff0c\u5728\u70cf\u514b\u862d\u5df2\u767c\u751f\u591a\u8d77\uff0c\u4f8b\u5982\uff1a2022\u5e74\u6709\u4eba\u4ee5\u70cf\u514b\u862d\u8ecd\u65b9\u70ba\u8a98\u990c\u767c\u52d5\u653b\u64ca\uff0c2023\u5e74\uff0c\u70cf\u514b\u862d\u96fb\u8166\u7dca\u6025\u61c9\u8b8a\u5718\u968a\uff08CERT-UA\uff09\u6307\u51fa\uff0c\u99ed\u5ba2\u7d44\u7e54UAC-0057\u5229\u7528\u542b\u6709\u5de8\u96c6\u53ca\u8a98\u990c\u5716\u6a94\u7684XLS\u6a94\u6848\uff0c\u76ee\u7684\u662f\u5728\u53d7\u5bb3\u96fb\u8166\u690d\u5165PicassoLoader\u3001Cobalt Strike Beacon\u3002\u800c\u9019\u6b21\u7684\u653b\u64ca\u884c\u52d5\u7576\u4e2d\uff0c\u99ed\u5ba2\u52a0\u5165\u4e86\u66f4\u591a\u7684\u8ff4\u907f\u624b\u6bb5\uff0c\u589e\u52a0\u80fd\u5920\u6210\u529f\u7684\u6a5f\u7387\u3002<\/p>\n\n\n\n

\u8cc7\u6599\u4f86\u6e90:https:\/\/www.ithome.com.tw\/news\/163380<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

2024-06-14 | \u5468\u5cfb\u4f51 \u8cc7\u5b89\u696d\u8005Fortinet\u91dd\u5c0d\u9396\u5b9a\u70cf\u514b\u862d\u5229\u7528Excel\u5de8\u96c6\u6563\u5e03\u6ef2\u900f\u6e2c\u8a66\u5de5\u5177Cobalt Strike\u7684\u653b\u64ca\u884c\u52d5\u63d0\u51fa\u8b66\u544a\uff0c\u4e26\u6307\u51fa\u5c0d\u65b9\u5728\u904e\u7a0b\u88e1\u63a1\u7528\u5404\u7a2e\u898f…<\/p>\n","protected":false},"author":4,"featured_media":6216,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[352],"tags":[204],"class_list":["post-6215","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-information-security","tag-204"],"gutentor_comment":0,"jetpack_featured_media_url":"https:\/\/i0.wp.com\/aict.nkust.edu.tw\/digitrans\/wp-content\/uploads\/2024\/06\/cobalt-process-diagram-156.png?fit=960%2C420&ssl=1","jetpack-related-posts":[],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/aict.nkust.edu.tw\/digitrans\/index.php?rest_route=\/wp\/v2\/posts\/6215","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aict.nkust.edu.tw\/digitrans\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aict.nkust.edu.tw\/digitrans\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aict.nkust.edu.tw\/digitrans\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/aict.nkust.edu.tw\/digitrans\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6215"}],"version-history":[{"count":1,"href":"https:\/\/aict.nkust.edu.tw\/digitrans\/index.php?rest_route=\/wp\/v2\/posts\/6215\/revisions"}],"predecessor-version":[{"id":6217,"href":"https:\/\/aict.nkust.edu.tw\/digitrans\/index.php?rest_route=\/wp\/v2\/posts\/6215\/revisions\/6217"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aict.nkust.edu.tw\/digitrans\/index.php?rest_route=\/wp\/v2\/media\/6216"}],"wp:attachment":[{"href":"https:\/\/aict.nkust.edu.tw\/digitrans\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6215"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aict.nkust.edu.tw\/digitrans\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6215"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aict.nkust.edu.tw\/digitrans\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6215"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}