{"id":112433,"date":"2020-06-11T19:00:06","date_gmt":"2020-06-12T02:00:06","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=112433"},"modified":"2022-04-07T18:21:18","modified_gmt":"2022-04-08T01:21:18","slug":"cortex-insider-threat","status":"publish","type":"post","link":"https:\/\/www2.paloaltonetworks.com\/blog\/2020\/06\/cortex-insider-threat\/?lang=ja","title":{"rendered":"Cortex XDR \u306b\u3088\u308b\u6458\u767a: \u7269\u7406\u7684\u306a\u30cf\u30c3\u30ad\u30f3\u30b0\u3001\u30a4\u30f3\u30b5\u30a4\u30c0\u30fc\u8105\u5a01\u3092\u6458\u767a\u3059\u308b"},"content":{"rendered":"<p><strong>\u3042\u308b\u65e5\u3001SOC\u30a2\u30ca\u30ea\u30b9\u30c8\u304c\u30e2\u30fc\u30cb\u30f3\u30b0\u30b3\u30fc\u30d2\u30fc\u3092\u7247\u624b\u306b\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u306e\u524d\u306b\u5ea7\u308b\u3068\u3001\u30a4\u30f3\u30b5\u30a4\u30c0\u30fc\u8105\u5a01\u306e\u53ef\u80fd\u6027\u3092\u8b66\u544a\u3059\u308b\u6b21\u306e\u30e1\u30c3\u30bb\u30fc\u30b8\u304c\u8868\u793a\u3055\u308c\u307e\u3057\u305f\u3002<\/strong><\/p>\n<p><strong>\u300c\u3053\u3093\u306b\u3061\u306f\u3002\u79c1\u306fCortex XDR Managed Threat Hunting (MTH)\u30c1\u30fc\u30e0\u306eAlicia\u3067\u3059\u3002\u3042\u306a\u305f\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u5185\u306e\u7591\u308f\u3057\u3044\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u8abf\u67fb\u3057\u3066\u304a\u308a\u3001\u8abf\u67fb\u306e\u304a\u624b\u4f1d\u3044\u3092\u3057\u3066\u3044\u305f\u3060\u304d\u305f\u3044\u306e\u3067\u3059\u304c\u3002\u4ee5\u4e0b\u3092\u78ba\u8a8d\u3057\u3066\u3044\u305f\u3060\u3051\u307e\u3059\u304b?\u300d<\/strong><\/p>\n<p><strong>\u4f55\u3060\u3053\u308c\u306f?! \u5351\u52a3\u306a\u30a4\u30f3\u30b5\u30a4\u30c0\u30fc\u653b\u6483\u304a\u3088\u3073\u305d\u308c\u3092\u691c\u51fa\u3057\u305f\u30b5\u30fc\u30d3\u30b9\u306b\u3064\u3044\u3066\u3001Cortex XDR Managed Threat Hunting\u30c1\u30fc\u30e0\u306b\u30b9\u30dd\u30c3\u30c8\u3092\u5f53\u3066\u305f<a href=\"https:\/\/www.paloaltonetworks.com\/blog\/tag\/ai-stories-ja\/?lang=ja\">\u300cBusted by Cortex XDR series (Cortex XDR\u306b\u3088\u308b\u6458\u767a\u30b7\u30ea\u30fc\u30ba)\u300d<\/a>\u306e\u6700\u65b0\u306e\u4e8b\u4f8b\u3068\u3068\u3082\u306b\u3054\u89a7\u304f\u3060\u3055\u3044!<\/strong><\/p>\n<p><div style=\"max-width:100%\" data-width=\"900\"><span class=\"ar-custom\" style=\"padding-bottom:50%;\"><img loading=\"lazy\" decoding=\"async\"  class=\"aligncenter wp-image-112063 lozad\"  data-src=\"https:\/\/www.paloaltonetworks.com\/blog\/wp-content\/uploads\/2020\/05\/Cortex-sec-cam.jpg\" alt=\"This conceptual image illustrates how the Cortex XDR Managed Threat Hunting team was able to &quot;spot&quot; evidence of an employee operating an insider threat.\" width=\"900\" height=\"450\" \/><\/span><\/div><\/p>\n<p>\u3053\u306e\u5b9f\u969b\u306e\u9867\u5ba2\u4e8b\u4f8b\u306f\u3001EMEA\u3092\u62e0\u70b9\u3068\u3059\u308b\u30b3\u30f3\u30b5\u30eb\u30c6\u30a3\u30f3\u30b0\u30d5\u30a1\u30fc\u30e0\u3067COVID-19\u30d1\u30f3\u30c7\u30df\u30c3\u30af\u304c\u767a\u751f\u3059\u308b\u524d\u306e3\u6708\u306b\u8d77\u304d\u305f\u3082\u306e\u3067\u3001\u3042\u308b\u5f93\u696d\u54e1\u304c\u81ea\u5206\u306e\u30e9\u30c3\u30d7\u30c8\u30c3\u30d7\u3092\u30cf\u30c3\u30ad\u30f3\u30b0\u3057\u3001\u300c\u56fa\u5b9a\u30ad\u30fc\u300d\u3068\u3044\u3046\u6280\u6cd5\u3092\u4f7f\u7528\u3057\u3066\u30ed\u30fc\u30ab\u30eb\u7ba1\u7406\u8005\u306e\u8a8d\u8a3c\u60c5\u5831\u3092\u53d6\u5f97\u3059\u308b\u3053\u3068\u304b\u3089\u59cb\u307e\u308a\u307e\u3057\u305f\u3002\u6b21\u306b\u3001MTH\u30c1\u30fc\u30e0\u304c\u3069\u3046\u3084\u3063\u3066\u3053\u306e\u5f93\u696d\u54e1\u3092\u6355\u307e\u3048\u305f\u304b\u3001\u5f93\u696d\u54e1\u304c\u3069\u306e\u3088\u3046\u306b\u30cf\u30c3\u30ad\u30f3\u30b0\u3092\u5b66\u3093\u3067\u5b9f\u884c\u3057\u305f\u304b\u3001\u304a\u3088\u3073\u9867\u5ba2\u306eSOC\u30c1\u30fc\u30e0\u304c\u3069\u306e\u3088\u3046\u306b\u653b\u6483\u3092\u5c01\u3058\u8fbc\u3081\u305f\u304b\u3092\u793a\u3057\u307e\u3059\u3002<\/p>\n<table width=\"100%\">\n<tbody>\n<tr>\n<td>\u300c\u56fa\u5b9a\u30ad\u30fc\u300d\u3068\u306f?<br \/>\nWindows\u306b\u306f\u3001\u30ed\u30b0\u30a4\u30f3\u753b\u9762\u3067\u306e\u30ad\u30fc\u306e\u7d44\u307f\u5408\u308f\u305b\u306b\u3088\u3063\u3066\u8d77\u52d5\u3067\u304d\u308b\u30a2\u30af\u30bb\u30b7\u30d3\u30ea\u30c6\u30a3\u6a5f\u80fd\u304c\u4ed8\u3044\u3066\u3044\u307e\u3059\u3002\u653b\u6483\u8005\u306f\u3053\u308c\u3089\u306e\u30d7\u30ed\u30b0\u30e9\u30e0\u3092\u7f6e\u304d\u63db\u3048\u3066\u3001\u30b3\u30de\u30f3\u30c9\u30d7\u30ed\u30f3\u30d7\u30c8\u3092\u8d77\u52d5\u3067\u304d\u307e\u3059\u3002\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u3001\u3053\u308c\u3089\u306e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306f\u3001\u7ba1\u7406\u8005\u306e\u8a8d\u8a3c\u60c5\u5831\u3092\u4f7f\u7528\u3057\u3066\u30b7\u30b9\u30c6\u30e0\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u4e0b\u3067\u5b9f\u884c\u3055\u308c\u307e\u3059\u3002<br \/>\n\u4e00\u822c\u7684\u306a\u30a2\u30af\u30bb\u30b7\u30d3\u30ea\u30c6\u30a3\u30d7\u30ed\u30b0\u30e9\u30e0\u306f\u6b21\u306e2\u3064\u3067\u3059\u3002<\/p>\n<ol>\n<li>C:\\Windows\\System32\\sethc.exe\u3002Shift\u30ad\u30fc\u30925\u56de\u62bc\u3059\u3068\u8d77\u52d5\u3057\u307e\u3059(\u56fa\u5b9a\u30ad\u30fc)<\/li>\n<li>C:\\Windows\\System32\\utilman.exe\u3002\u30ed\u30b0\u30a4\u30f3\u753b\u9762\u3067Windows + U\u3092\u62bc\u3057\u3066\u4f7f\u7528\u3067\u304d\u308b\u62e1\u5927\u93e1\u3001\u30cf\u30a4 \u30b3\u30f3\u30c8\u30e9\u30b9\u30c8 \u30c6\u30fc\u30de\u3001\u97f3\u58f0\u6848\u5185\u3001\u30b9\u30af\u30ea\u30fc\u30f3\u30ad\u30fc\u30dc\u30fc\u30c9\u306a\u3069\u306e\u30a2\u30af\u30bb\u30b7\u30d3\u30ea\u30c6\u30a3\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u30e6\u30fc\u30b6\u30fc\u304c\u8a2d\u5b9a\u3059\u308b\u305f\u3081\u306b\u8a2d\u8a08\u3055\u308c\u305fWindows\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3067\u3059\u3002<\/li>\n<\/ol>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u9867\u5ba2\u306eSOC\u30a2\u30ca\u30ea\u30b9\u30c8\u304cAlicia\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u306eCortex XDR\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u30af\u30ea\u30c3\u30af\u3059\u308b\u3068\u3001Alicia\u304c\u8aac\u660e\u3057\u3066\u3044\u308b\u5185\u5bb9\u306e\u5168\u4f53\u50cf\u304c\u8868\u793a\u3055\u308c\u307e\u3057\u305f\u3002Cortex XDR\u306b\u3088\u308a\u3001\u7591\u308f\u3057\u3044\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u304c\u30b7\u30f3\u30d7\u30eb\u306b\u56f3\u793a\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n<div class=\"mceTemp\"><\/div>\n<figure id=\"attachment_112089\" aria-describedby=\"caption-attachment-112089\" style=\"width: 1999px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.paloaltonetworks.com\/blog\/wp-content\/uploads\/2020\/05\/utilmanexe.png\"><div style=\"max-width:100%\" data-width=\"1999\"><span class=\"ar-custom\" style=\"padding-bottom:37.77%;\"><img loading=\"lazy\" decoding=\"async\"  class=\"wp-image-112089 size-full lozad\"  data-src=\"https:\/\/www.paloaltonetworks.com\/blog\/wp-content\/uploads\/2020\/05\/utilmanexe.png\" alt=\"\u5f71\u97ff\u3092\u53d7\u3051\u305f\u30e9\u30c3\u30d7\u30c8\u30c3\u30d7\u3092\u793a\u3059\u3001Cortex XDR\u306e\u6839\u672c\u539f\u56e0\u5206\u6790\u753b\u9762\" width=\"1999\" height=\"755\" \/><\/span><\/div><\/a><figcaption id=\"caption-attachment-112089\" class=\"wp-caption-text\">\u5f71\u97ff\u3092\u53d7\u3051\u305f\u30e9\u30c3\u30d7\u30c8\u30c3\u30d7\u3092\u793a\u3059\u3001Cortex XDR\u306e\u6839\u672c\u539f\u56e0\u5206\u6790\u753b\u9762<\/figcaption><\/figure>\n<p>\u9867\u5ba2\u306eSOC\u30a2\u30ca\u30ea\u30b9\u30c8\u306f\u3059\u3050\u306b\u30b3\u30fc\u30d2\u30fc\u3092\u7f6e\u3044\u3066\u8896\u3092\u307e\u304f\u308a\u3001\u30ad\u30fc\u30dc\u30fc\u30c9\u3092\u3064\u304b\u3093\u3067Alicia\u306e\u5206\u6790\u3092\u78ba\u8a8d\u3057\u307e\u3057\u305f\u3002\u6570\u5206\u5f8c\u3001\u8105\u5a01\u306e\u6027\u8cea\u304a\u3088\u3073\u63a8\u5968\u3055\u308c\u308b\u8efd\u6e1b\u30b9\u30c6\u30c3\u30d7\u304c\u8a18\u8f09\u3055\u308c\u305f\u96fb\u5b50\u30e1\u30fc\u30eb\u3092Alicia\u304b\u3089\u53d7\u4fe1\u3057\u307e\u3057\u305f\u3002\u4ee5\u4e0b\u306b\u3001\u5b9f\u969b\u306e\u8fd4\u4fe1\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3092\u793a\u3057\u307e\u3059\u3002<\/p>\n<p><a href=\"https:\/\/www.paloaltonetworks.com\/blog\/wp-content\/uploads\/2020\/05\/morning.png\"><div style=\"max-width:100%\" data-width=\"1999\"><span class=\"ar-custom\" style=\"padding-bottom:37.57%;\"><img loading=\"lazy\" decoding=\"async\"  class=\"aligncenter size-full wp-image-112102 lozad\"  data-src=\"https:\/\/www.paloaltonetworks.com\/blog\/wp-content\/uploads\/2020\/05\/morning.png\" alt=\"This screenshot of an email reads: Thanks for getting back to me with the details, which confirmed what I was seeing. I'm just going to share with you some of my thoughts and recommendations being that I understand the Windows ecosystem and the technique. Utilman.exe is a Windows protected file and the only way to overwrite it would be to first disable windows system file checker. To achieve this one would need to be logged in ot the PC and typically is performed manually. The modification is done in the registry or direct calls into [obscured]. From the activity I would treat the host as fully compromised and from the commands issued assume that local creds were taken. Hopefully the local creds aren't domain creds? Recommend changing the users account information. Attackers typically do this as a 2nd stage access to a network in the event their initial access is lost. Thanks for the help and please let me know if you have any questions. [Name obscured]\" width=\"1999\" height=\"751\" \/><\/span><\/div><\/a><\/p>\n<p>\u7ba1\u7406\u8005\u306e\u8a8d\u8a3c\u60c5\u5831\u3092\u53ce\u96c6\u3057\u305f\u75d5\u8de1\u3092\u63a2\u3059\u969b\u3001\u300c\u56fa\u5b9a\u30ad\u30fc\u300d\u6280\u6cd5\u304cMTH\u30c1\u30fc\u30e0\u306e\u6ce8\u610f\u3092\u5f15\u304d\u307e\u3057\u305f\u3002Utilman.exe\u306fWindows\u306e\u4fdd\u8b77\u3055\u308c\u3066\u3044\u308b\u30d5\u30a1\u30a4\u30eb\u3067\u3059\u3002\u3053\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u4e0a\u66f8\u304d\u3059\u308b\u552f\u4e00\u306e\u65b9\u6cd5\u306f\u3001\u6700\u521d\u306bWindows\u30b7\u30b9\u30c6\u30e0 \u30d5\u30a1\u30a4\u30eb \u30c1\u30a7\u30c3\u30ab\u30fc\u3092\u7121\u52b9\u306b\u3059\u308b\u304b\u3001\u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0\u30b7\u30b9\u30c6\u30e0\u3092\u7a3c\u50cd\u3055\u305b\u305a\u306b\u884c\u3046\u3053\u3068\u3067\u3059\u3002<\/p>\n<h3>\u6b8b\u5ff5\u306a\u3053\u3068\u306b\u2026<\/h3>\n<p>\u5f93\u696d\u54e1\u306f\u3059\u3067\u306b\u30ed\u30fc\u30ab\u30eb\u7ba1\u7406\u8005\u306e\u8a8d\u8a3c\u60c5\u5831\u3092\u53d6\u5f97\u3057\u3001\u30b3\u30de\u30f3\u30c9\u30b7\u30a7\u30eb\u3092\u4ecb\u3057\u3066\u653b\u6483\u3092\u7d9a\u884c\u3057\u3066\u3044\u307e\u3059\u3002\u73fe\u6642\u70b9\u3067\u306e\u7591\u554f\u306f\u3053\u3046\u3067\u3059\u3002\u300c\u53d6\u5f97\u3057\u305f\u8a8d\u8a3c\u60c5\u5831\u3092\u4f7f\u7528\u3057\u3066\u3001\u5f93\u696d\u54e1\u306f\u4f55\u3092\u884c\u3063\u305f\u304b?\u300d\u305d\u306e\u5834\u3067\u4f55\u304c\u8d77\u304d\u305f\u304b\u3092\u77e5\u308b\u524d\u306b\u3001\u3072\u3068\u4f11\u307f\u3057\u3066Alicia\u306b\u3064\u3044\u3066\u8aac\u660e\u3057\u307e\u3057\u3087\u3046\u3002<\/p>\n<h3>Alicia\u3068\u306f\u8ab0\u304b?<\/h3>\n<p>Alicia\u306f\u8105\u5a01\u306e\u63a2\u7d22\u304a\u3088\u3073\u53ce\u96c6\u3001\u304a\u3088\u3073\u30b3\u30fc\u30c9\u5206\u6790\u3092\u4f7f\u7528\u3057\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u30ea\u30d0\u30fc\u30b9\u30a8\u30f3\u30b8\u30cb\u30a2\u30ea\u30f3\u30b0\u306e\u5c02\u9580\u5bb6\u3067\u3059\u3002\u5f7c\u5973\u306e\u30c1\u30fc\u30e0\u306f\u7dbf\u5bc6\u306a\u8abf\u67fb\u3092\u884c\u3063\u3066\u3001\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u304c\u7d44\u7e54\u5168\u4f53\u3092\u5371\u967a\u306b\u3055\u3089\u3059\u305f\u3081\u306b\u4f7f\u7528\u3059\u308b\u6280\u6cd5\u306b\u95a2\u3059\u308b\u77e5\u898b\u3092\u5f97\u307e\u3059\u3002\u5f7c\u5973\u306e\u76ee\u6a19\u306f\u3001\u72b6\u6cc1\u3092\u660e\u3089\u304b\u306b\u3057\u3001\u653b\u6483\u306e\u4ed5\u7d44\u307f\u3001\u5b9f\u884c\u8005\u304a\u3088\u3073\u7406\u7531\u3092\u793a\u3059\u3053\u3068\u3067\u3059\u3002Alicia\u304c\u3084\u308d\u3046\u3068\u3057\u3066\u3044\u308b\u3053\u3068\u306f\u3001SOC\u3092\u5f37\u5316\u3057\u3066\u4eca\u307e\u3067\u4ee5\u4e0a\u306b\u4f1a\u793e\u3092\u5b88\u308b\u3053\u3068\u3067\u3059\u3002<\/p>\n<h3>\u30cf\u30c3\u30ad\u30f3\u30b0<\/h3>\n<p>\u4e8b\u4f8b\u306b\u623b\u308a\u307e\u3059\u3002Cortex XDR\u306e\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8 \u30a8\u30fc\u30b8\u30a7\u30f3\u30c8 \u30ed\u30b0\u306b\u3088\u308a\u3001\u5f93\u696d\u54e1\u304c\u7ba1\u7406\u8005\u306e\u8a8d\u8a3c\u60c5\u5831\u3092\u81ea\u5206\u306e\u30e9\u30c3\u30d7\u30c8\u30c3\u30d7\u306b\u53d6\u5f97\u3057\u305f\u3053\u3068\u304c\u901a\u77e5\u3055\u308c\u307e\u3057\u305f(\u4f1a\u793e\u306e\u8a31\u53ef\u306a\u3057\u306b\u767a\u751f\u3057\u305f\u30ec\u30b3\u30fc\u30c9)\u3002\u5f93\u696d\u54e1\u304c\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u4e0a\u306eutilman.exe\u3092Windows\u306e\u30b3\u30de\u30f3\u30c9\u30b7\u30a7\u30eb\u3067\u3042\u308bcmd.exe\u306b\u7f6e\u304d\u63db\u3048\u305f\u3053\u3068\u306b\u3088\u308a\u3001\u30a2\u30e9\u30fc\u30c8\u304c\u30c8\u30ea\u30ac\u30fc\u3055\u308c\u307e\u3057\u305f\u3002Alicia\u306f\u30a2\u30e9\u30fc\u30c8\u3092\u53d7\u4fe1\u3057\u3066\u3001\u5f93\u696d\u54e1\u304c\u76f4\u5f8c\u306b\u5b9f\u884c\u3057\u305f\u3044\u304f\u3064\u304b\u306e\u30b3\u30de\u30f3\u30c9\u306b\u7d50\u3073\u4ed8\u3051\u307e\u3057\u305f\u3002Alicia\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u304c\u5230\u7740\u3059\u308b\u307e\u3067\u3001\u9867\u5ba2\u306eSOC\u30a2\u30ca\u30ea\u30b9\u30c8\u306f\u72b6\u6cc1\u306b\u6c17\u3065\u304d\u307e\u305b\u3093\u3067\u3057\u305f\u3002Managed Threat Hunting\u30b5\u30fc\u30d3\u30b9\u304c\u306a\u3051\u308c\u3070\u3001\u95a2\u9023\u306e\u306a\u3044\u8907\u6570\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306e\u3088\u3046\u306b\u898b\u3048\u3066\u3001\u653b\u6483\u3092\u898b\u9003\u3059\u3068\u3053\u308d\u3067\u3057\u305f\u3002<\/p>\n<h3>\u3057\u304b\u3057\u3001\u306a\u305c?<\/h3>\n<p>MTH\u30c1\u30fc\u30e0\u306f\u5f15\u304d\u7d9a\u304dCortex XDR\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30ed\u30b0\u3068\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8\u30ed\u30b0\u3092\u8abf\u67fb\u3057\u3001\u5f93\u696d\u54e1\u304c\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u3066\u30ed\u30fc\u30ab\u30eb\u7ba1\u7406\u8005\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u30ea\u30bb\u30c3\u30c8\u3057\u3001\u524d\u306b\u5f7c\u306e\u30e9\u30c3\u30d7\u30c8\u30c3\u30d7\u306b\u30ed\u30b0\u30a4\u30f3\u3057\u305f\u30ed\u30fc\u30ab\u30eb \u30e6\u30fc\u30b6\u30fc \u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u30ea\u30b9\u30c8\u3092\u8868\u793a\u3057\u305f\u3053\u3068\u3092\u7a81\u304d\u6b62\u3081\u307e\u3057\u305f\u3002<\/p>\n<p>Alicia\u306f\u3001\u653b\u6483\u8005\u306f\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u30ea\u30bb\u30c3\u30c8\u3092\u4f7f\u7528\u3057\u3066\u30a2\u30ab\u30a6\u30f3\u30c8\u306b\u30a2\u30af\u30bb\u30b9\u3067\u304d\u308b\u3053\u3068\u3092\u8aac\u660e\u3057\u307e\u3057\u305f\u3002\u653b\u6483\u306e\u5b9f\u884c\u4e2d\u306b\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3078\u306e\u30a2\u30af\u30bb\u30b9\u304c\u5931\u308f\u308c\u305f\u5834\u5408\u3001\u653b\u6483\u8005\u306f\u3053\u306e\u64cd\u4f5c\u3092\u884c\u3063\u3066\u518d\u3073\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u306b\u30a2\u30af\u30bb\u30b9\u3057\u307e\u3059\u3002\u5f93\u696d\u54e1\u306f\u3057\u3070\u3089\u304f\u306e\u9593\u3001\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u4e0a\u306b\u3044\u305f\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<p>\u6700\u826f\u306e\u30b7\u30ca\u30ea\u30aa\u3067\u306f\u3001\u5f93\u696d\u54e1\u306f\u696d\u52d9\u306b\u95a2\u4fc2\u306e\u3042\u308b\u60aa\u610f\u306e\u306a\u3044\u30bf\u30b9\u30af\u7528\u306b\u30e9\u30c3\u30d7\u30c8\u30c3\u30d7\u306e\u30ec\u30d9\u30eb\u3092\u4e0a\u3052\u308b\u305f\u3081\u306b\u306e\u307f\u30c0\u30fc\u30af\u30b5\u30a4\u30c9\u306b\u5815\u3061\u305f\u3068\u8003\u3048\u3089\u308c\u307e\u3059\u3002<\/p>\n<p>\u4e00\u65b9\u3001Alicia\u306f\u3001\u30ed\u30fc\u30ab\u30eb \u30e6\u30fc\u30b6\u30fc \u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u5217\u6319\u306f\u3001\u4ed6\u306e\u30e6\u30fc\u30b6\u30fc\u306e\u30a2\u30ab\u30a6\u30f3\u30c8\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3001\u3055\u3089\u306b\u3072\u3087\u3063\u3068\u3059\u308b\u3068\u30c9\u30e1\u30a4\u30f3\u7ba1\u7406\u8005\u306e\u8a8d\u8a3c\u60c5\u5831\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3092\u53d6\u5f97\u3057\u3088\u3046\u3068\u3059\u308b\u5146\u5019\u3067\u3042\u308b\u3068\u8aac\u660e\u3057\u307e\u3057\u305f\u3002\u524d\u8005\u306e\u5834\u5408\u306f\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u3084\u8ca9\u58f2\u5b9f\u7e3e\u306a\u3069\u306e\u6a5f\u5bc6\u60c5\u5831\u306b\u30a2\u30af\u30bb\u30b9\u3067\u304d\u3001\u5f8c\u8005\u306e\u5834\u5408\u306f\u4f1a\u793e\u306e\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3092\u30c0\u30a6\u30f3\u3055\u305b\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u30e6\u30fc\u30b6\u30fc\u304cPC\u306b\u30ed\u30b0\u30a4\u30f3\u3059\u308b\u3068\u3001\u30ed\u30b0\u30a4\u30f3\u8a8d\u8a3c\u60c5\u5831\u304cWinows\u306b\u30ad\u30e3\u30c3\u30b7\u30e5\u3055\u308c\u307e\u3059\u3002\u30ed\u30fc\u30ab\u30eb\u7ba1\u7406\u8005\u306e\u6a29\u9650\u304c\u3042\u308c\u3070\u3001\u653b\u6483\u8005\u306f\u305d\u306e\u30ad\u30e3\u30c3\u30b7\u30e5\u3092\u5217\u6319\u3057\u3001\u3055\u307e\u3056\u307e\u306a\u6280\u6cd5\u306b\u3088\u3063\u3066\u305d\u308c\u3089\u306e\u30a2\u30ab\u30a6\u30f3\u30c8(\u305d\u308c\u3069\u3053\u308d\u304b\u3001\u30c9\u30e1\u30a4\u30f3\u7ba1\u7406\u8005\u306e\u30a2\u30ab\u30a6\u30f3\u30c8)\u306e\u4ee3\u308f\u308a\u306b\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30ea\u30bd\u30fc\u30b9\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/p>\n<h3>\u305d\u308c\u3092\u3069\u3046\u3084\u3063\u3066\u901a\u5e38\u30e6\u30fc\u30b6\u30fc\u3068\u3057\u3066\u5b9f\u884c\u3067\u304d\u305f\u306e\u304b?<\/h3>\n<p>\u5f93\u696d\u54e1\u306f\u901a\u5e38\u30e6\u30fc\u30b6\u30fc\u3067\u3042\u308a\u3001utilman.exe\u3092\u30b3\u30de\u30f3\u30c9\u30b7\u30a7\u30eb\u306b\u7f6e\u304d\u63db\u3048\u308b\u3053\u3068\u306f\u3067\u304d\u306a\u3044\u306f\u305a\u3067\u3057\u305f\u3002Windows\u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0\u30b7\u30b9\u30c6\u30e0\u306b\u306f\u3001\u3053\u306e\u60aa\u7528\u3092\u9632\u3050\u305f\u3081\u306b\u3001\u3044\u304f\u3064\u304b\u306e\u9632\u5fa1\u30e1\u30ab\u30cb\u30ba\u30e0\u304c\u5c0e\u5165\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u30e1\u30ab\u30cb\u30ba\u30e0\u306e1\u3064\u306f\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092System32\u30d5\u30a9\u30eb\u30c0\u30fc\u5185\u306b\u7f6e\u304b\u306a\u3051\u308c\u3070\u306a\u3089\u306a\u3044\u3053\u3068\u3067\u3059(\u3053\u308c\u304c\u3001\u4ed6\u306e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3067\u306f\u306a\u304fcmd.exe\u304c\u4f7f\u7528\u3055\u308c\u305f\u7406\u7531\u3067\u3059)\u3002\u3082\u30461\u3064\u306f\u3001\u7ba1\u7406\u8005\u306e\u307f\u304c\u5909\u66f4\u3092\u5b9f\u884c\u3067\u304d\u308b\u3053\u3068\u3067\u3059\u3002<\/p>\n<p>Alicia\u306f\u8abf\u67fb\u3092\u7d9a\u3051\u307e\u3057\u305f\u3002\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u30ed\u30b0\u3001\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30ed\u30b0\u3001\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8\u30ed\u30b0\u3092\u8abf\u3079\u3066\u3001\u30e6\u30fc\u30b6\u30fc\u304c\u3069\u306e\u3088\u3046\u306b\u3057\u3066\u81ea\u5206\u306e\u6a29\u9650\u3092\u7ba1\u7406\u8005\u306e\u6a29\u9650\u306b\u6607\u683c\u3055\u305b\u308b\u3053\u3068\u304c\u3067\u304d\u305f\u304b\u3092\u628a\u63e1\u3059\u308b\u306e\u306b\u5f79\u7acb\u3064\u624b\u304c\u304b\u308a\u3092\u63a2\u3057\u307e\u3057\u305f\u3002\u305d\u3057\u3066\u3001\u3064\u3044\u306b\u3001\u5f93\u696d\u54e1\u304cUSB\u30b9\u30c6\u30a3\u30c3\u30af\u3092\u7269\u7406\u7684\u306b\u30e9\u30c3\u30d7\u30c8\u30c3\u30d7\u306b\u633f\u5165\u3057\u3066\u3001\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u3092\u518d\u8d77\u52d5\u3057\u3001USB\u30b9\u30c6\u30a3\u30c3\u30af\u304b\u3089Linux\u30e9\u30a4\u30d6\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u3092\u8d77\u52d5\u3057\u3001Windows\u30d1\u30fc\u30c6\u30a3\u30b7\u30e7\u30f3\u3092\u30de\u30a6\u30f3\u30c8\u3057\u3066\u3001\u6700\u5f8c\u306bcmd.exe\u3092utilman.exe\u306b\u30b3\u30d4\u30fc\u3057\u3001Windows\u304c\u7a3c\u50cd\u3057\u3066\u3044\u306a\u3044\u9593\u306b\u3001Windows\u306e\u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0\u30b7\u30b9\u30c6\u30e0\u306e\u30d5\u30a1\u30a4\u30eb\u4fdd\u8b77\u3092\u30aa\u30fc\u30d0\u30fc\u30e9\u30a4\u30c9\u3057\u305f\u3053\u3068\u3092\u7a81\u304d\u6b62\u3081\u307e\u3057\u305f\u3002\u305d\u306e\u5f8c\u3001\u5f93\u696d\u54e1\u306f\u30b7\u30b9\u30c6\u30e0\u3092\u518d\u3073\u30ea\u30bb\u30c3\u30c8\u3057\u3001USB\u30b9\u30c6\u30a3\u30c3\u30af\u3092\u53d6\u308a\u5916\u3057\u3066\u3001Windows\u30d1\u30fc\u30c6\u30a3\u30b7\u30e7\u30f3\u3092\u8d77\u52d5\u3057\u3001\u30ed\u30b0\u30a4\u30f3\u753b\u9762\u3067WIndows + U\u3092\u62bc\u3057\u3066\u7a7a\u767d\u306e\u30b3\u30de\u30f3\u30c9\u30a6\u30a3\u30f3\u30c9\u30a6\u3092\u8868\u793a\u3057\u3001\u6700\u4e0a\u4f4d\u306e\u30ed\u30fc\u30ab\u30eb\u6a29\u9650\u306e\u4e0b\u3067\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3059\u308b\u6e96\u5099\u3092\u6574\u3048\u307e\u3057\u305f\u3002<\/p>\n<h4><a href=\"https:\/\/www.paloaltonetworks.com\/blog\/wp-content\/uploads\/2020\/05\/system32.png\"><div style=\"max-width:100%\" data-width=\"1999\"><span class=\"ar-custom\" style=\"padding-bottom:25.41%;\"><img loading=\"lazy\" decoding=\"async\"  class=\"aligncenter size-full wp-image-112115 lozad\"  data-src=\"https:\/\/www.paloaltonetworks.com\/blog\/wp-content\/uploads\/2020\/05\/system32.png\" alt=\"This screenshot shows a record of Utilman.exe being modified to allow escalated privileges. \" width=\"1999\" height=\"508\" \/><\/span><\/div><\/a><\/h4>\n<h3>\u6458\u767a<\/h3>\n<p>Alicia\u306e\u8abf\u67fb\u7d50\u679c\u3092\u805e\u3044\u305f\u5f8c\u3001\u9867\u5ba2\u306eSOC\u30a2\u30ca\u30ea\u30b9\u30c8\u306fCortex XDR Live Terminal\u3092\u4f7f\u7528\u3057\u3066\u30e9\u30c3\u30d7\u30c8\u30c3\u30d7\u306b\u63a5\u7d9a\u3057\u3001\u5f93\u696d\u54e1\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u78ba\u8a8d\u3057\u307e\u3057\u305f\u3002\u9867\u5ba2\u306eSOC\u30a2\u30ca\u30ea\u30b9\u30c8\u306f\u540c\u65e5\u4e2d\u306b\u30e9\u30c3\u30d7\u30c8\u30c3\u30d7\u3092\u64a4\u53bb\u3057\u3001\u5f93\u696d\u54e1\u306e\u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u7121\u52b9\u306b\u3057\u3066\u3001\u5fc5\u8981\u306a\u4eba\u4e8b\u63aa\u7f6e\u3092\u5b9f\u884c\u3057\u307e\u3057\u305f\u3002Alicia\u306f\u8105\u5a01\u3092\u691c\u51fa\u3057\u3001\u9867\u5ba2\u306eSOC\u30a2\u30ca\u30ea\u30b9\u30c8\u304c\u6839\u672c\u539f\u56e0\u3092\u898b\u3064\u3051\u308b\u306e\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3001\u7de9\u548c\u63aa\u7f6e\u3092\u63a8\u5968\u3057\u305f\u5f8c\u3001\u6b21\u306e\u8105\u5a01\u3092\u898b\u3064\u3051\u308b\u4f5c\u696d\u306b\u79fb\u308a\u307e\u3057\u305f\u3002\u9867\u5ba2\u306eSOC\u30a2\u30ca\u30ea\u30b9\u30c8\u306f\u65b0\u3057\u3044\u6280\u6cd5\u3092\u5b66\u3073\u3001\u5927\u60e8\u4e8b\u306b\u306a\u308b\u524d\u306b\u3053\u306e\u30c8\u30e9\u30d6\u30eb\u304b\u3089\u9003\u308c\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3057\u305f\u3002\u305d\u306e\u5f8c\u5f93\u696d\u54e1\u304c\u3069\u3046\u306a\u3063\u305f\u304b\u3084\u3001\u79c1\u305f\u3061\u304c\u6458\u767a\u3059\u308b\u524d\u306b\u4f55\u3092\u884c\u3063\u3066\u3044\u305f\u306e\u304b\u306f\u308f\u304b\u308a\u307e\u305b\u3093\u3002\u79c1\u305f\u3061\u304c\u628a\u63e1\u3057\u3066\u3044\u308b\u306e\u306f\u3001\u305d\u306e\u4eba\u3092\u65e9\u3044\u6bb5\u968e\u3067\u6458\u767a\u3067\u304d\u305f\u305f\u3081\u306b\u3001\u3053\u306e\u4e8b\u4f8b\u3092\u30c7\u30fc\u30bf\u4fb5\u5bb3\u3001\u9577\u3073\u304f\u696d\u52d9\u505c\u6b62\u3001\u8457\u4f5c\u6a29\u4fb5\u5bb3\u306a\u3069\u306e\u4e8b\u4f8b\u3068\u3057\u3066\u30cb\u30e5\u30fc\u30b9\u3067\u8aad\u3080\u3053\u3068\u304c\u306a\u304b\u3063\u305f\u3068\u3044\u3046\u3053\u3068\u3067\u3042\u308a\u3001\u305d\u308c\u304c\u91cd\u8981\u306a\u3053\u3068\u306a\u306e\u3067\u3059\u3002<\/p>\n<p>CSO\u306f\u3001\u7fcc\u65e5\u306e\u30c8\u30ea\u30a2\u30fc\u30b8\u3092\u300c\u5b8c\u74a7\u306a\u65e5\u300d\u3068\u3057\u3066\u899a\u3048\u3066\u304a\u308a\u3001SOC\u30c1\u30fc\u30e0\u3068Cortex XDR Managed Threat Hunting\u30c1\u30fc\u30e0\u304c\u4f1a\u793e\u3092\u5b88\u308b\u306e\u306b\u5f79\u7acb\u3063\u305f\u3053\u3068\u306b\u81ea\u4fe1\u3092\u6301\u3061\u307e\u3057\u305f\u3002<\/p>\n<h3>\u30a4\u30f3\u30b5\u30a4\u30c0\u30fc\u8105\u5a01\u306b\u5bfe\u3059\u308b\u9632\u5fa1\u306e\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9<\/h3>\n<p>\u30a4\u30f3\u30b5\u30a4\u30c0\u30fc\u306b\u3088\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u306f\u3001\u60aa\u610f\u306b\u3088\u308b\u3082\u306e\u304b\u904e\u5931\u306b\u3088\u308b\u3082\u306e\u304b\u3092\u554f\u308f\u305a\u7d44\u7e54\u306b\u5e83\u304f\u8513\u5ef6\u3057\u3066\u3044\u308b\u554f\u984c\u3067\u3001\u5f93\u696d\u54e1\u306e\u8077\u52d9\u9042\u884c\u6a5f\u80fd\u306e\u59a8\u3052\u3068\u306a\u3089\u305a\u306b\u3075\u305b\u3050\u306e\u306f\u56f0\u96e3\u3067\u3059\u3002<a href=\"https:\/\/cdw-prod.adobecqms.net\/content\/dam\/cdw\/on-domain-cdw\/brands\/proofpoint\/ponemon-global-cost-of-insider-threats-2020-report.pdf\" rel=\"nofollow,noopener\" >Ponemon Institute<\/a>\u306b\u3088\u308b\u3068\u3001\u30a4\u30f3\u30b5\u30a4\u30c0\u30fc\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u306e\u6bd4\u7387\u306f2018\u5e74\u304b\u308947%\u5897\u52a0\u3057\u3001\u30b3\u30b9\u30c8\u306f\u540c\u671f\u9593\u306731%\u5897\u52a0\u3057\u307e\u3057\u305f\u3002\u6b21\u306b\u3001\u4e0a\u8ff0\u306e\u3088\u3046\u306a\u30a4\u30f3\u30b5\u30a4\u30c0\u30fc\u8105\u5a01\u304c\u767a\u751f\u3059\u308b\u6a5f\u4f1a\u3092\u6700\u5c0f\u9650\u306b\u6291\u3048\u308b\u305f\u3081\u306b\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30fc\u30e0\u304c\u5b9f\u884c\u3067\u304d\u308b\u3044\u304f\u3064\u304b\u306e\u624b\u9806\u3092\u793a\u3057\u307e\u3059\u3002<\/p>\n<ul>\n<li><strong>\u91cd\u8981\u306a\u8cc7\u7523\u307e\u305f\u306f\u6a5f\u5bc6\u6027\u306e\u9ad8\u3044\u8cc7\u7523\u3092\u8b58\u5225\u3057\u3001\u7ba1\u7406\u3059\u308b<\/strong>\u3002\u30ef\u30fc\u30af\u30b9\u30da\u30fc\u30b9\u30c6\u30af\u30ce\u30ed\u30b8\u306e\u9032\u6b69\u306b\u3088\u308a\u3001\u8fc5\u901f\u306a\u30b3\u30e9\u30dc\u30ec\u30fc\u30b7\u30e7\u30f3\u304a\u3088\u3073\u60c5\u5831\u3078\u306e\u30a2\u30af\u30bb\u30b9\u304c\u53ef\u80fd\u306b\u306a\u308a\u307e\u3057\u305f\u304c\u3001\u3053\u308c\u3089\u306e\u8cc7\u7523\u3092\u3088\u308a\u7c21\u5358\u306b\u5f15\u304d\u51fa\u3059\u3053\u3068\u3082\u53ef\u80fd\u306b\u306a\u308a\u307e\u3057\u305f\u3002\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30fc\u30e0\u306f\u3001\u7d44\u7e54\u306e\u8cc7\u7523\u304a\u3088\u3073\u30a2\u30af\u30bb\u30b9\u7ba1\u7406\u30c4\u30fc\u30eb\u3001\u304a\u3088\u3073\u30a4\u30f3\u30b5\u30a4\u30c0\u30fc\u8105\u5a01\u304b\u3089\u5b88\u308b\u305f\u3081\u306e\u30dd\u30ea\u30b7\u30fc\u3092\u5b8c\u5168\u306b\u628a\u63e1\u3057\u3066\u3044\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/li>\n<li><strong>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30dd\u30ea\u30b7\u30fc\u3092\u6587\u66f8\u5316\u3057\u3001\u9069\u7528\u3059\u308b<\/strong>\u3002\u6642\u3068\u3057\u3066\u3001\u7d44\u7e54\u306e\u8cc7\u7523\u306b\u95a2\u3059\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30dd\u30ea\u30b7\u30fc\u304c\u4e0d\u660e\u78ba\u307e\u305f\u306f\u4e00\u8cab\u6027\u304c\u306a\u3044\u305f\u3081\u306b\u3001\u5f93\u696d\u54e1\u304c\u610f\u56f3\u305b\u305a\u306b\u30a4\u30f3\u30b5\u30a4\u30c0\u30fc\u8105\u5a01\u306b\u306a\u308b\u3053\u3068\u304c\u3042\u308a\u307e\u3059\u3002\u8a31\u5bb9\u3067\u304d\u308b\u8cc7\u7523\u306e\u4f7f\u7528\u3001\u6a29\u9650\u4ed8\u304d\u306e\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u4f7f\u7528\u3001\u77e5\u7684\u8ca1\u7523\u306e\u6240\u6709\u6a29\u3001\u304a\u3088\u3073\u540c\u69d8\u306e\u30c8\u30d4\u30c3\u30af\u306b\u3064\u3044\u3066\u3001\u7d44\u7e54\u3067\u660e\u78ba\u306b\u307e\u3068\u3081\u3066\u304a\u304f\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002\u3053\u306e\u30dd\u30ea\u30b7\u30fc\u3068\u3068\u3082\u306b\u3001\u5404\u30dd\u30ea\u30b7\u30fc\u306e\u80cc\u5f8c\u306b\u3042\u308b\u6839\u62e0\u304a\u3088\u3073\u63a8\u8ad6\u3082\u660e\u78ba\u306b\u898f\u5b9a\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/li>\n<li><strong>\u30a4\u30f3\u30b5\u30a4\u30c0\u30fc\u8105\u5a01\u3078\u306e\u5bfe\u5fdc\u6226\u7565\u3092\u4f5c\u6210\u3059\u308b<\/strong>\u3002\u30a4\u30f3\u30b5\u30a4\u30c0\u30fc\u8105\u5a01\u3092\u5b8c\u5168\u306b\u6392\u9664\u3059\u308b\u3053\u3068\u306f\u3067\u304d\u306a\u3044\u304b\u3082\u3057\u308c\u307e\u305b\u3093\u304c\u3001\u30a4\u30f3\u30b5\u30a4\u30c0\u30fc\u8105\u5a01\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u306b\u8fc5\u901f\u306b\u5bfe\u5fdc\u3059\u308b\u305f\u3081\u306e\u6226\u7565\u3092\u7b56\u5b9a\u3057\u3001\u8105\u5a01\u304c\u767a\u751f\u3057\u305f\u5834\u5408\u306e\u7d44\u7e54\u3078\u306e\u30c0\u30e1\u30fc\u30b8\u3092\u6700\u5c0f\u9650\u306b\u6291\u3048\u308b\u3053\u3068\u306f\u3067\u304d\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u6226\u7565\u306b\u306f\u3001\u90e8\u9580\u3084\u6a5f\u80fd\u3092\u6a2a\u65ad\u3059\u308b\u30ef\u30fc\u30ad\u30f3\u30b0\u30b0\u30eb\u30fc\u30d7\u306e\u4f5c\u6210\u3001\u307e\u305f\u306f\u30a4\u30f3\u30b5\u30a4\u30c0\u30fc\u8105\u5a01\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u306b\u5bfe\u51e6\u3059\u308b\u5c02\u9580\u306e\u30e1\u30f3\u30d0\u30fc\u306e\u6307\u5b9a\u304c\u542b\u307e\u308c\u308b\u3053\u3068\u304c\u3042\u308a\u307e\u3059\u3002<\/li>\n<\/ul>\n<h3>\u8105\u5a01\u30cf\u30f3\u30c6\u30a3\u30f3\u30b0\u6280\u80fd\u306e\u5f37\u5316<\/h3>\n<p>6\u670823\u65e5\u3001\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u3067\u306f\u4e16\u754c\u4e2d\u306e\u8105\u5a01\u30cf\u30f3\u30bf\u30fc\u306e\u305f\u3081\u306e\u300c<a href=\"https:\/\/start.paloaltonetworks.com\/inside-the-hunt-virtual-summit?utm_source=MTHblog&amp;utm_medium=social&amp;utm_content=MTH_summit&amp;sfdcid=7010g000001JOCxAAO\">inside The Hunt<\/a>\u300d\u4eee\u60f3\u30b5\u30df\u30c3\u30c8\u3092\u958b\u50ac\u3057\u307e\u3059\u3002\u8105\u5a01\u30cf\u30f3\u30c6\u30a3\u30f3\u30b0\u6226\u7565\u3001\u6280\u6cd5\u3001\u8ab2\u984c\u3001\u6280\u8853\u306b\u95a2\u3059\u308b\u30d9\u30b9\u30c8\u30d7\u30e9\u30af\u30c6\u30a3\u30b9\u3092\u5171\u6709\u3059\u308b\u305f\u3081\u3001\u4e16\u754c\u4e2d\u304b\u3089\u6700\u9ad8\u306e\u8105\u5a01\u30cf\u30f3\u30bf\u30fc\u3068\u696d\u754c\u30a8\u30ad\u30b9\u30d1\u30fc\u30c8\u304c\u96c6\u307e\u308a\u307e\u3059\u3002\u7686\u3055\u3093\u306e\u8105\u5a01\u30cf\u30f3\u30c6\u30a3\u30f3\u30b0\u624b\u6cd5\u3092\u30b9\u30ad\u30eb\u30a2\u30c3\u30d7\u3059\u308b\u65b0\u3057\u3044\u30d2\u30f3\u30c8\u3092\u5b66\u3073\u3001\u30c8\u30ea\u30d3\u30a2\u306b\u53c2\u52a0\u3057\u3066\u8cde\u54c1\u3092\u7372\u5f97\u3057\u307e\u3057\u3087\u3046\u3002\u305c\u3072<a href=\"https:\/\/start.paloaltonetworks.com\/inside-the-hunt-virtual-summit?utm_source=MTHblog&amp;utm_medium=social&amp;utm_content=MTH_summit&amp;sfdcid=7010g000001JOCxAAO\">\u300cInside the Hunt\u300d\u306b\u767b\u9332\u3057\u3066\u304f\u3060\u3055\u3044(\u767b\u9332\u7121\u6599)\u3002<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u3042\u308b\u65e5\u3001SOC\u30a2\u30ca\u30ea\u30b9\u30c8\u304c\u30e2\u30fc\u30cb\u30f3\u30b0\u30b3\u30fc\u30d2\u30fc\u3092\u7247\u624b\u306b\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u306e\u524d\u306b\u5ea7\u308b\u3068\u3001\u30a4\u30f3\u30b5\u30a4\u30c0\u30fc\u8105\u5a01\u306e\u53ef\u80fd\u6027\u3092\u8b66\u544a\u3059\u308b\u6b21\u306e\u30e1\u30c3\u30bb\u30fc\u30b8\u304c\u8868\u793a\u3055\u308c\u307e\u3057\u305f\u3002 \u300c\u3053\u3093\u306b\u3061\u306f\u3002\u79c1\u306fCortex XDR Managed Threat Hunting (MTH)\u30c1\u30fc\u30e0\u306eAlicia\u3067\u3059\u3002\u3042\u306a\u305f\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u5185\u306e\u7591\u308f\u3057\u3044\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u8abf\u67fb\u3057\u3066\u304a\u308a\u3001\u8abf\u67fb\u306e\u304a\u624b\u4f1d\u3044\u3092\u3057\u3066\u3044\u305f\u3060\u304d\u305f\u3044\u306e\u3067\u3059\u304c\u3002\u4ee5\u4e0b\u3092\u78ba\u8a8d\u3057\u3066\u3044\u305f\u3060\u3051\u307e\u3059\u304b?\u300d \u4f55\u3060\u3053\u308c\u306f?! \u5351\u52a3\u306a\u30a4\u30f3\u30b5\u30a4\u30c0\u30fc\u653b\u6483\u304a\u3088\u3073\u305d\u308c\u3092\u691c\u51fa\u3057\u305f\u30b5\u30fc\u30d3\u30b9\u306b\u3064\u3044\u3066\u3001Cortex XDR Managed Threat Hunting\u30c1\u30fc\u30e0\u306b\u30b9\u30dd\u30c3\u30c8\u3092\u5f53\u3066\u305f\u300cBusted by Cortex XDR series (Cortex XDR\u306b\u3088\u308b\u6458\u767a\u30b7\u30ea\u30fc\u30ba)\u300d\u306e\u6700\u65b0\u306e\u4e8b\u4f8b\u3068\u3068\u3082\u306b\u3054\u89a7\u304f\u3060\u3055\u3044! \u3053\u306e\u5b9f\u969b\u306e\u9867\u5ba2\u4e8b\u4f8b\u306f\u3001EMEA\u3092\u62e0\u70b9\u3068\u3059\u308b\u30b3\u30f3\u30b5\u30eb\u30c6\u30a3\u30f3\u30b0\u30d5\u30a1\u30fc\u30e0\u3067COVID-19\u30d1\u30f3\u30c7\u30df\u30c3\u30af\u304c\u767a\u751f\u3059\u308b\u524d\u306e3\u6708\u306b\u8d77\u304d\u305f\u3082\u306e\u3067\u3001\u3042\u308b\u5f93\u696d\u54e1\u304c\u81ea\u5206\u306e\u30e9\u30c3\u30d7\u30c8\u30c3\u30d7\u3092\u30cf\u30c3\u30ad\u30f3\u30b0\u3057\u3001\u300c\u56fa\u5b9a\u30ad\u30fc\u300d\u3068\u3044\u3046\u6280\u6cd5\u3092\u4f7f\u7528\u3057\u3066\u30ed\u30fc\u30ab\u30eb\u7ba1\u7406\u8005\u306e\u8a8d\u8a3c\u60c5\u5831\u3092\u53d6\u5f97\u3059\u308b\u3053\u3068\u304b\u3089\u59cb\u307e\u308a\u307e\u3057\u305f\u3002\u6b21\u306b\u3001MTH\u30c1\u30fc\u30e0\u304c\u3069\u3046\u3084\u3063\u3066\u3053\u306e\u5f93\u696d\u54e1\u3092\u6355\u307e\u3048\u305f\u304b\u3001\u5f93\u696d\u54e1\u304c\u3069\u306e\u3088\u3046\u306b\u30cf\u30c3\u30ad\u30f3\u30b0\u3092\u5b66\u3093\u3067\u5b9f\u884c\u3057\u305f\u304b\u3001\u304a\u3088\u3073\u9867\u5ba2\u306eSOC\u30c1\u30fc\u30e0\u304c\u3069\u306e\u3088\u3046\u306b\u653b\u6483\u3092\u5c01\u3058\u8fbc\u3081\u305f\u304b\u3092\u793a\u3057\u307e\u3059\u3002 \u300c\u56fa\u5b9a\u30ad\u30fc\u300d\u3068\u306f? Windows\u306b\u306f\u3001\u30ed\u30b0\u30a4\u30f3\u753b\u9762\u3067\u306e\u30ad\u30fc\u306e\u7d44\u307f\u5408\u308f\u305b\u306b\u3088\u3063\u3066\u8d77\u52d5\u3067\u304d\u308b\u30a2\u30af\u30bb\u30b7\u30d3\u30ea\u30c6\u30a3\u6a5f\u80fd\u304c\u4ed8\u3044\u3066\u3044\u307e\u3059\u3002\u653b\u6483\u8005\u306f\u3053\u308c\u3089\u306e\u30d7\u30ed\u30b0\u30e9\u30e0\u3092\u7f6e\u304d\u63db\u3048\u3066\u3001\u30b3\u30de\u30f3\u30c9\u30d7\u30ed\u30f3\u30d7\u30c8\u3092\u8d77\u52d5\u3067\u304d\u307e\u3059\u3002\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u3001\u3053\u308c\u3089\u306e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306f\u3001\u7ba1\u7406\u8005\u306e\u8a8d\u8a3c\u60c5\u5831\u3092\u4f7f\u7528\u3057\u3066\u30b7\u30b9\u30c6\u30e0\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u4e0b\u3067\u5b9f\u884c\u3055\u308c\u307e\u3059\u3002 \u4e00\u822c\u7684\u306a\u30a2\u30af\u30bb\u30b7\u30d3\u30ea\u30c6\u30a3\u30d7\u30ed\u30b0\u30e9\u30e0\u306f\u6b21\u306e2\u3064\u3067\u3059\u3002 C:\\Windows\\System32\\sethc.exe\u3002Shift\u30ad\u30fc\u30925\u56de\u62bc\u3059\u3068\u8d77\u52d5\u3057\u307e\u3059(\u56fa\u5b9a\u30ad\u30fc) C:\\Windows\\System32\\utilman.exe\u3002\u30ed\u30b0\u30a4\u30f3\u753b\u9762\u3067Windows + U\u3092\u62bc\u3057\u3066\u4f7f\u7528\u3067\u304d\u308b\u62e1\u5927\u93e1\u3001\u30cf\u30a4 \u30b3\u30f3\u30c8\u30e9\u30b9\u30c8 \u30c6\u30fc\u30de\u3001\u97f3\u58f0\u6848\u5185\u3001\u30b9\u30af\u30ea\u30fc\u30f3\u30ad\u30fc\u30dc\u30fc\u30c9\u306a\u3069\u306e\u30a2\u30af\u30bb\u30b7\u30d3\u30ea\u30c6\u30a3\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u30e6\u30fc\u30b6\u30fc\u304c\u8a2d\u5b9a\u3059\u308b\u305f\u3081\u306b\u8a2d\u8a08\u3055\u308c\u305fWindows\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3067\u3059\u3002 \u9867\u5ba2\u306eSOC\u30a2\u30ca\u30ea\u30b9\u30c8\u304cAlicia\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u306eCortex XDR\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u30af\u30ea\u30c3\u30af\u3059\u308b\u3068\u3001Alicia\u304c\u8aac\u660e\u3057\u3066\u3044\u308b\u5185\u5bb9\u306e\u5168\u4f53\u50cf\u304c\u8868\u793a\u3055\u308c\u307e\u3057\u305f\u3002Cortex XDR\u306b\u3088\u308a\u3001\u7591\u308f\u3057\u3044\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u304c\u30b7\u30f3\u30d7\u30eb\u306b\u56f3\u793a\u3055\u308c\u307e\u3057\u305f\u3002 &hellip;<\/p>\n","protected":false},"author":636,"featured_media":112063,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6958],"tags":[6955,7142,7090],"coauthors":[6848],"class_list":["post-112433","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-secure-the-future-2","tag-cortex-xdr-ja","tag-managed-threat-hunting-ja","tag-threat-hunting-ja"],"jetpack_featured_media_url":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-content\/uploads\/2020\/05\/Cortex-sec-cam.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/112433","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/users\/636"}],"replies":[{"embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=112433"}],"version-history":[{"count":5,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/112433\/revisions"}],"predecessor-version":[{"id":159600,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/112433\/revisions\/159600"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media\/112063"}],"wp:attachment":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=112433"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=112433"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=112433"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/coauthors?post=112433"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}