![\"\"](\"https:\/\/www.paloaltonetworks.com\/blog\/wp-content\/uploads\/2024\/12\/detection-chart_1200x628-2-230x120.jpg\")
<\/span><\/div><\/p>\n<\/a>Cortex XDR\uff1a\u5728 MITRE ATT&CK \u7b2c\u516d\u8f6e\u8bc4\u4f30\u4e2d\u83b7\u5f97\u4e1a\u754c\u6700\u4f73\u7684\u7aef\u70b9\u5b89\u5168\u8868\u73b0<\/h3>\nCortex XDR \u5728\u68c0\u6d4b\u548c\u9884\u9632\u4e24\u4e2a\u8bc4\u4f30\u573a\u666f\u4e2d\u5747\u8868\u73b0\u4f18\u5f02\uff0c\u4e3a\u7aef\u70b9\u5b89\u5168\u8bbe\u5b9a\u4e86\u65b0\u7684\u57fa\u51c6\uff0c\u91cd\u65b0\u5b9a\u4e49\u4e86\u4f01\u4e1a\u5bf9\u7f51\u7edc\u5b89\u5168\u89e3\u51b3\u65b9\u6848\u7684\u671f\u671b\u3002<\/p>\n
\u5728\u4e09\u4e2a\u68c0\u6d4b\u573a\u666f\u4e2d\uff0cCortex XDR \u521b\u9020\u4e86\u5386\u53f2\uff0c\u9996\u6b21\u5b9e\u73b0\u4e86\u5bf9\u6240\u6709\u6a21\u62df\u653b\u51fb\u6b65\u9aa4\u7684 100% \u6280\u6cd5\u7ea7\u68c0\u6d4b\u7387\uff0c\u800c\u4e14\u6ca1\u6709\u914d\u7f6e\u66f4\u6539\u6216\u5ef6\u8fdf\u68c0\u6d4b\u3002\u8fd9\u4e9b\u7ed3\u679c\u518d\u6b21\u5370\u8bc1\u4e86\u6211\u4eec\u4e3a Windows\u3001macOS \u548c Linux \u7b49\u4e3b\u6d41\u64cd\u4f5c\u7cfb\u7edf\u63d0\u4f9b\u6700\u5168\u9762\u9632\u5fa1\u7684\u627f\u8bfa\u3002<\/p>\n
MITRE ATT&CK \u8bc4\u4f30\u8fd8\u6d4b\u8bd5\u4e86\u9884\u9632\u80fd\u529b\uff0c\u8bc4\u4f30\u4e86\u89e3\u51b3\u65b9\u6848\u5728\u653b\u51fb\u53ef\u80fd\u9020\u6210\u7834\u574f\u4e4b\u524d\u963b\u6b62\u8fd9\u4e9b\u653b\u51fb\u7684\u80fd\u529b\u3002\u8fd9\u662f\u771f\u5b9e\u4e16\u754c\u7aef\u70b9\u5b89\u5168\u7684\u7cbe\u9ad3\u6240\u5728 - \u5c3d\u4e00\u5207\u52aa\u529b\u9884\u9632\uff0c\u7136\u540e\u5feb\u901f\u51c6\u786e\u5730\u68c0\u6d4b\u51fa\u5176\u4ed6\u4e00\u5207\u3002<\/p>\n
\u5728\u7b2c 6 \u8f6e\u6d4b\u8bd5\u4e2d\uff0cCortex XDR \u963b\u6b62\u4e86 10 \u4e2a\u653b\u51fb\u6b65\u9aa4\u4e2d\u7684 8 \u4e2a\uff0c\u540c\u65f6\u4fdd\u6301\u96f6\u8bef\u62a5\u3002\u9884\u9632\u9636\u6bb5\u7684\u8bef\u62a5\u53ef\u80fd\u4f1a\u7834\u574f\u5173\u952e\u7684\u4e1a\u52a1\u8fd0\u8425\uff0c\u9020\u6210\u91cd\u5927\u7ecf\u6d4e\u635f\u5931\u3002Cortex XDR \u80fd\u591f\u5c06\u65e0\u4e0e\u4f26\u6bd4\u7684\u9884\u9632\u51c6\u786e\u6027\u4e0e\u96f6\u5e72\u6270\u7ed3\u5408\u8d77\u6765\uff0c\u8fd9\u4f7f\u5b83\u6210\u4e3a\u5168\u7403\u89c4\u6a21\u6700\u5927\u3001\u8981\u6c42\u6700\u9ad8\u7684\u4f01\u4e1a\u68a6\u5bd0\u4ee5\u6c42\u7684\u7aef\u70b9\u5b89\u5168\u89e3\u51b3\u65b9\u6848\u3002<\/p>\n
\u867d\u7136\u5728\u9884\u9632\u6d4b\u8bd5\u4e2d\u6709\u4e24\u4e2a\u653b\u51fb\u6b65\u9aa4\u4e0d\u7b26\u5408 MITRE \u89c6\u4e3a\u62e6\u622a\u7684\u6807\u51c6\uff0c\u4f46\u6211\u4eec\u5728\u8fd9\u4e9b\u6b65\u9aa4\u4e2d\u91c7\u53d6\u7684\u5b9e\u9645\u884c\u52a8\u5c06\u4f1a\u4fdd\u62a4\u6211\u4eec\u7684\u5ba2\u6237\u5e76\u963b\u6b62\u6cc4\u9732\u7684\u53d1\u751f\u3002<\/p>\n
\n- \u5728\u7b2c\u4e09\u6b65\u4e2d\uff0c\u653b\u51fb\u8bd5\u56fe\u4e00\u4e2a\u53ef\u7591\u7684\u4e3b\u673a\u8fdb\u884c SSH \u8fde\u63a5\uff0c\u800c MITRE \u7684\u653b\u51fb\u6b65\u9aa4\u5e94\u8be5\u7d27\u968f\u5176\u540e\u3002\u6211\u4eec\u62e6\u622a\u4e86\u53ef\u7591\u7684 SSH \u8fde\u63a5\uff0c\u5728\u8f83\u65e9\u9636\u6bb5\u5c31\u963b\u6b62\u4e86\u653b\u51fb\u3002<\/li>\n
- \u5728\u7b2c\u4e94\u6b65\u4e2d\uff0c\u653b\u51fb\u8bd5\u56fe\u52a0\u5bc6\u6570\u636e\uff0c\u800c Cortex XDR \u4ee3\u7406\u7acb\u5373\u53cd\u8f6c\u4e86\u52a0\u5bc6\u64cd\u4f5c\u3002\u6211\u4eec\u963b\u6b62\u4e86\u653b\u51fb\uff0c\u53d6\u5f97\u4e86\u552f\u4e00\u91cd\u8981\u7684\u6210\u679c\uff0c\u4e5f\u5c31\u662f\u4fdd\u8bc1\u4e86\u5ba2\u6237\u7684\u5b89\u5168\u3002<\/li>\n<\/ul>\n
![\"\"]()
<\/span><\/div><\/p>\n<\/a>\u4ec0\u4e48\u662f MITRE ATT&CK \u8bc4\u4f30\uff1f<\/h2>\nMITRE ATT&CK \u8bc4\u4f30\u662f\u7f51\u7edc\u5b89\u5168\u9886\u57df\u6700\u4e25\u683c\u7684\u6d4b\u8bd5\uff0c\u65e8\u5728\u8861\u91cf\u7aef\u70b9\u5b89\u5168\u89e3\u51b3\u65b9\u6848\u68c0\u6d4b\u548c\u9884\u9632\u771f\u5b9e\u4e16\u754c\u5a01\u80c1\u7684\u80fd\u529b\u3002MITRE ATT&CK \u8bc4\u4f30\u7814\u7a76\u548c\u6a21\u62df\u4e86\u8001\u7ec3\u7684\u5bf9\u624b\u53d1\u8d77\u7684\u653b\u51fb<\/a>\uff0c\u4f7f\u5176\u6210\u4e3a\u5b89\u5168\u6709\u6548\u6027\u7684\u771f\u6b63\u57fa\u51c6\u3002<\/p>\n\u4eca\u5e74\u7684\u4f01\u4e1a 2024 \u8bc4\u4f30\u91cd\u70b9\u5173\u6ce8\u4e86\u4e24\u4e2a\u622a\u7136\u4e0d\u540c\u4f46\u53c8\u9ad8\u5ea6\u76f8\u5173\u7684\u653b\u51fb\u6e90\uff1a<\/p>\n
\n- \u52d2\u7d22\u8f6f\u4ef6<\/strong>\uff1a\u63a2\u7d22\u52d2\u7d22\u8f6f\u4ef6\u6d3b\u52a8\u4e2d\u5e38\u89c1\u7684\u884c\u4e3a\uff0c\u6bd4\u5982\u6ee5\u7528\u5408\u6cd5\u5de5\u5177\u3001\u52a0\u5bc6\u6570\u636e\u548c\u7981\u7528\u5173\u952e\u7684\u670d\u52a1\u6216\u8fdb\u7a0b\u3002MITRE \u9009\u62e9\u6a21\u4eff CLOP<\/a> \u548c LockBit<\/a> \u8fd9\u4e24\u4e2a\u81ed\u540d\u662d\u8457\u7684\u52d2\u7d22\u8f6f\u4ef6\u5373\u670d\u52a1\u5a01\u80c1\u56e2\u4f19\u7684\u6280\u6cd5\u3002<\/li>\n
- \u671d\u9c9c (DPRK)<\/strong>\uff1a\u6a21\u62df\u5bf9 macOS \u7cfb\u7edf\u7684\u653b\u51fb\uff0c\u7075\u611f\u6765\u81ea\u671d\u9c9c\u4f7f\u7528\u6a21\u5757\u5316\u6076\u610f\u8f6f\u4ef6\u63d0\u5347\u6743\u9650\u4ee5\u53ca\u7784\u51c6\u51ed\u636e\u3002<\/li>\n<\/ul>\n
<\/a>Palo Alto Networks \u5982\u4f55\u76d1\u63a7\u52d2\u7d22\u8f6f\u4ef6\u548c\u671d\u9c9c\u4e4b\u7c7b\u98ce\u53e3\u6d6a\u5c16\u7684\u5a01\u80c1\uff1f<\/h3>\n\u4f5c\u4e3a Unit 42 \u7684\u5ef6\u4f38\uff0cPalo Alto Networks Cortex \u5a01\u80c1\u7814\u7a76\u56e2\u961f\u76d1\u63a7\u4e0d\u65ad\u53d8\u5316\u7684\u5a01\u80c1\u73af\u5883\uff0c\u5c06\u5176\u53d1\u73b0\u7ed3\u679c\u8f6c\u5316\u4e3a\u5207\u5b9e\u53ef\u884c\u7684\u60c5\u62a5\uff0c\u76f4\u63a5\u589e\u5f3a Cortex XDR \u7684\u68c0\u6d4b\u548c\u9632\u5fa1\u80fd\u529b\u3002<\/p>\n
\u5728\u8fc7\u53bb\u7684\u4e00\u5e74\u91cc\uff0c\u5728\u7814\u7a76\u5a01\u80c1\u884c\u4e3a\u8005\u7684\u6218\u672f\u3001\u6280\u6cd5\u548c\u7a0b\u5e8f (TTP) \u7684\u65e5\u5e38\u5de5\u4f5c\u671f\u95f4\uff0c\u56e2\u961f\u9501\u5b9a\u4e86\u4e0e\u671d\u9c9c\u6709\u5173\u8054\u7684 APT \u56e2\u4f19\uff0c\u53d1\u73b0\u4e86\u7528\u4e8e\u6e17\u900f\u5168\u7403\u4f01\u4e1a\u7684\u65b0\u7684\u6d3b\u52a8\u548c\u6076\u610f\u8f6f\u4ef6\u3002<\/p>\n
\u671d\u9c9c\u4ee5\u5176\u53cc\u7ba1\u9f50\u4e0b\u7684\u7f51\u7edc\u6218\u6218\u7565\u800c\u95fb\u540d\uff0c\u5176\u6838\u5fc3\u662f\u95f4\u8c0d\u6d3b\u52a8\u548c\u5927\u89c4\u6a21\u7684\u7f51\u7edc\u72af\u7f6a\u6d3b\u52a8\uff0c\u65e8\u5728\u4e3a\u671d\u9c9c\u653f\u6743\u521b\u9020\u6536\u5165\u3002\u6211\u4eec\u7684\u7814\u7a76\u5f3a\u8c03\uff0c\u671d\u9c9c\u8d8a\u6765\u8d8a\u91cd\u89c6\u4ee5 macOS \u7528\u6237\u548c\u7aef\u70b9\u4e3a\u76ee\u6807\uff0c\u540c\u65f6\u6301\u7eed\u52aa\u529b\u4ece\u5168\u7403\u5404\u884c\u5404\u4e1a\u7684\u4f01\u4e1a\u7a83\u53d6\u52a0\u5bc6\u8d27\u5e01\u548c\u654f\u611f\u4fe1\u606f\u3002<\/p>\n
\u56e2\u961f\u7684\u7814\u7a76\u4eae\u70b9\u5df2\u7ecf\u4e0e\u793e\u533a\u5206\u4eab\uff0c\u6b22\u8fce\u5728 Unit 42 \u5a01\u80c1\u7814\u7a76\u4e2d\u5fc3<\/a>\u67e5\u9605\uff0c\u5176\u4e2d\u5305\u62ec\u4ee5\u4e0b\u7814\u7a76\u6587\u7ae0\uff1a<\/p>\n\n- \u5a01\u80c1\u8bc4\u4f30\uff1a\u671d\u9c9c\u5a01\u80c1\u56e2\u4f19<\/a><\/li>\n
- Contagious Interview\uff1a\u671d\u9c9c\u5a01\u80c1\u884c\u4e3a\u8005\u8bf1\u9a97\u79d1\u6280\u884c\u4e1a\u6c42\u804c\u8005\u5b89\u88c5 BeaverTail \u548c InvisibleFerret \u6076\u610f\u8f6f\u4ef6\u7684\u65b0\u53d8\u4f53<\/a><\/li>\n
- Gleaming Pisces \u4e2d\u6bd2\u7684 Python \u8f6f\u4ef6\u5305\u6d3b\u52a8\u4f20\u64ad PondRAT Linux \u548c MacOS \u540e\u95e8<\/a><\/li>\n
- \u63ed\u79d8 Sparkling Pisces \u7684\u5de5\u5177\u7bb1\uff1a KLogEXE \u548c FPSpy<\/a><\/li>\n<\/ul>\n
\u56e2\u961f\u8fd8\u53d1\u8868\u4e86\u51e0\u7bc7\u5173\u4e8e 2024 \u5e74\u6700\u7316\u7357\u7684\u52d2\u7d22\u8f6f\u4ef6\u56e2\u4f19\u7684\u7814\u7a76\u6587\u7ae0\u3002\u8fd9\u4e9b\u7814\u7a76\u5f3a\u8c03\u4e86\u8fd9\u4e9b\u56e2\u4f19\u7684\u6f14\u53d8\uff0c\u5c55\u793a\u4e86\u5176\u65e5\u76ca\u589e\u5f3a\u7684\u590d\u6742\u6027\u548c\u4fb5\u7565\u6027\u3002\u7814\u7a76\u8fdb\u4e00\u6b65\u5c55\u793a\u4e86 Cortex XDR \u7684\u68c0\u6d4b\u548c\u9884\u9632\u80fd\u529b\u5982\u4f55\u81ea\u52a8\u7834\u574f\u8fd9\u4e9b\u884c\u52a8\u5e76\u963b\u6b62\u654f\u611f\u4fe1\u606f\u7684\u52a0\u5bc6\u3002<\/p>\n
\u8981\u4e86\u89e3\u6709\u5173\u8fd9\u4e9b\u52d2\u7d22\u8f6f\u4ef6\u56e2\u4f19\u7684\u66f4\u591a\u4fe1\u606f\uff0c\u8bf7\u53c2\u9605\u4ee5\u4e0b\u6587\u7ae0\uff1a<\/p>\n
\n- \u5a01\u80c1\u8bc4\u4f30\uff1aHowling Scorpius\uff08Akira \u52d2\u7d22\u8f6f\u4ef6\uff09<\/a><\/li>\n
- \u4ece RA \u56e2\u4f19\u5230 RA \u4e16\u754c\uff1a\u52d2\u7d22\u8f6f\u4ef6\u56e2\u4f19\u7684\u6f14\u53d8<\/a><\/li>\n
- \u5a01\u80c1\u8bc4\u4f30\uff1a BianLian<\/a><\/li>\n<\/ul>\n
<\/a>\u4eca\u5e74\u7684\u6d4b\u8bd5\u6709\u4ec0\u4e48\u53d8\u5316\uff1f<\/h3>\n\u4eca\u5e74\u7684 MITRE ATT&CK \u8bc4\u4f30\u5f15\u5165\u4e86\u91cd\u5927\u53d8\u5316\uff0c\u53cd\u6620\u4e86\u4e0d\u65ad\u53d8\u5316\u7684\u5a01\u80c1\u5f62\u52bf\uff0c\u66f4\u597d\u5730\u8861\u91cf\u4e86\u7aef\u70b9\u5b89\u5168\u7684\u6709\u6548\u6027\u3002<\/p>\n
\n- \u6269\u5927\u4e86\u7aef\u70b9\u8986\u76d6\u8303\u56f4<\/strong>\uff1a\u6d4b\u8bd5\u9996\u6b21\u6db5\u76d6\u4e86\u66f4\u5e7f\u6cdb\u7684\u7aef\u70b9\u5e73\u53f0\uff0c\u7784\u51c6\u4e86 Windows\u3001Linux \u548c macOS \u73af\u5883\u3002\u8303\u56f4\u7684\u6269\u5927\u786e\u4fdd\u4e86\u9488\u5bf9\u4e0d\u540c\u64cd\u4f5c\u7cfb\u7edf\u6d4b\u8bd5\u89e3\u51b3\u65b9\u6848\uff0c\u4ece\u800c\u66f4\u5168\u9762\u5730\u4e86\u89e3\u9632\u5fa1\u80fd\u529b\u3002<\/li>\n
- \u7eb3\u5165\u8bef\u62a5<\/strong>\uff1a\u53e6\u4e00\u4e2a\u91cd\u8981\u8865\u5145\u662f\u7eb3\u5165\u8bef\u62a5\u8ddf\u8e2a\uff0c\u8fd9\u662f\u771f\u5b9e\u4e16\u754c\u90e8\u7f72\u4e2d\u7684\u4e00\u4e2a\u5173\u952e\u56e0\u7d20\u3002\u5bf9\u4f9b\u5e94\u5546\u7684\u8bc4\u4f30\u4e0d\u4ec5\u8981\u770b\u68c0\u6d4b\u5a01\u80c1\u7684\u80fd\u529b\uff0c\u8fd8\u8981\u770b\u662f\u5426\u80fd\u907f\u514d\u4e0d\u51c6\u786e\u7684\u68c0\u6d4b\uff0c\u56e0\u4e3a\u4e0d\u51c6\u786e\u7684\u68c0\u6d4b\u53ef\u80fd\u4f1a\u4f7f\u5b89\u5168\u56e2\u961f\u4e0d\u77e5\u6240\u63aa\u6216\u6270\u4e71\u5173\u952e\u4e1a\u52a1\u6d41\u7a0b\u3002<\/li>\n<\/ul>\n
\u901a\u8fc7\u7eb3\u5165\u8fd9\u4e9b\u53d8\u5316\uff0cMITRE \u6267\u884c\u4e86\u8fc4\u4eca\u4e3a\u6b62\u6700\u5177\u6311\u6218\u6027\u548c\u73b0\u5b9e\u6027\u7684\u8bc4\u4f30\u3002<\/p>\n
<\/a>\u4e00\u81f4\u6027\u81f3\u5173\u91cd\u8981 \u2014 Cortex XDR \u5e74\u590d\u4e00\u5e74\u5b9e\u73b0\u5353\u8d8a\u7684\u7ed3\u679c<\/h3>\nPalo Alto Networks \u81f4\u529b\u4e8e\u4e3a\u5ba2\u6237\u63d0\u4f9b\u6700\u9ad8\u8d28\u91cf\u7684\u7f51\u7edc\u5b89\u5168\u6280\u672f\uff0c\u8fd9\u9700\u8981\u5353\u8d8a\u7684\u4eba\u624d\u4ee5\u53ca\u5728\u7814\u7a76\u548c\u5de5\u7a0b\u65b9\u9762\u7684\u6295\u8d44\u3002\u6211\u4eec\u7684\u56e2\u961f\u5e74\u590d\u4e00\u5e74\u901a\u8fc7\u4e86 MITRE ATT&CK \u8bc4\u4f30\u7684\u4e25\u683c\u8003\u9a8c\uff0c\u5411\u5168\u4e16\u754c\u5c55\u793a\u4e86\u6211\u4eec\u8f9b\u52e4\u5de5\u4f5c\u7684\u6210\u679c\uff0c\u5bf9\u6b64\u6211\u4eec\u6df1\u611f\u81ea\u8c6a\u3002<\/p>\n
\u81ea 2022 \u5e74\u4ee5\u6765\uff0cCortex XDR \u5728 MITRE \u8bc4\u4f30\u4e2d\u7684\u68c0\u6d4b\u7ed3\u679c\u4e00\u76f4\u5904\u4e8e\u884c\u4e1a\u9886\u5148\u5730\u4f4d\u3002\u6211\u4eec\u76f8\u4fe1\uff0c\u6bcf\u5e74\u7684\u653b\u51fb\u6a21\u62df\u90fd\u80fd\u63d0\u4f9b\u72ec\u7279\u7684\u89c1\u89e3\uff0c\u8ba9\u6211\u4eec\u4e86\u89e3\u4e16\u754c\u4e0a\u7684\u5404\u79cd\u5a01\u80c1\u884c\u4e3a\u4f53\u4ee5\u53ca\u7f51\u7edc\u5b89\u5168\u884c\u4e1a\u5728\u9632\u5fa1\u8fd9\u4e9b\u5a01\u80c1\u884c\u4e3a\u4f53\u65b9\u9762\u7684\u7acb\u573a\u3002\u6709\u9274\u4e8e\u6b64\uff0c\u6211\u4eec\u5728\u4e92\u52a8\u5c55\u677f<\/a>\u4e2d\u516c\u5f00\u8bb0\u5f55\u4e86\u6240\u6709 MITRE ATT&CK \u8bc4\u4f30\u7ed3\u679c\uff0c\u4fbf\u4e8e\u9010\u5e74\u6bd4\u8f83\u3002<\/p>\n\u611f\u8c22 MITRE \u4ee5\u53ca\u6240\u6709\u4f7f\u7528 Cortex XDR \u4fdd\u62a4\u7aef\u70b9\u7684\u5ba2\u6237\u3002\u6211\u4eec\u5f88\u8363\u5e78\u6210\u4e3a\u60a8\u7684\u9996\u9009\u7f51\u7edc\u5b89\u5168\u5408\u4f5c\u4f19\u4f34\u3002<\/p>\n
![\"\"](\"https:\/\/www.paloaltonetworks.com\/blog\/wp-content\/uploads\/2024\/12\/prevention-chart_1200x628-1-1-230x120.jpg\")
<\/span><\/div><\/p>\n<\/a>\u4ec0\u4e48\u662f MITRE ATT&CK \u8bc4\u4f30\uff1f<\/h2>\nMITRE ATT&CK \u8bc4\u4f30\u662f\u7f51\u7edc\u5b89\u5168\u9886\u57df\u6700\u4e25\u683c\u7684\u6d4b\u8bd5\uff0c\u65e8\u5728\u8861\u91cf\u7aef\u70b9\u5b89\u5168\u89e3\u51b3\u65b9\u6848\u68c0\u6d4b\u548c\u9884\u9632\u771f\u5b9e\u4e16\u754c\u5a01\u80c1\u7684\u80fd\u529b\u3002MITRE ATT&CK \u8bc4\u4f30\u7814\u7a76\u548c\u6a21\u62df\u4e86\u8001\u7ec3\u7684\u5bf9\u624b\u53d1\u8d77\u7684\u653b\u51fb<\/a>\uff0c\u4f7f\u5176\u6210\u4e3a\u5b89\u5168\u6709\u6548\u6027\u7684\u771f\u6b63\u57fa\u51c6\u3002<\/p>\n\u4eca\u5e74\u7684\u4f01\u4e1a 2024 \u8bc4\u4f30\u91cd\u70b9\u5173\u6ce8\u4e86\u4e24\u4e2a\u622a\u7136\u4e0d\u540c\u4f46\u53c8\u9ad8\u5ea6\u76f8\u5173\u7684\u653b\u51fb\u6e90\uff1a<\/p>\n
\n- \u52d2\u7d22\u8f6f\u4ef6<\/strong>\uff1a\u63a2\u7d22\u52d2\u7d22\u8f6f\u4ef6\u6d3b\u52a8\u4e2d\u5e38\u89c1\u7684\u884c\u4e3a\uff0c\u6bd4\u5982\u6ee5\u7528\u5408\u6cd5\u5de5\u5177\u3001\u52a0\u5bc6\u6570\u636e\u548c\u7981\u7528\u5173\u952e\u7684\u670d\u52a1\u6216\u8fdb\u7a0b\u3002MITRE \u9009\u62e9\u6a21\u4eff CLOP<\/a> \u548c LockBit<\/a> \u8fd9\u4e24\u4e2a\u81ed\u540d\u662d\u8457\u7684\u52d2\u7d22\u8f6f\u4ef6\u5373\u670d\u52a1\u5a01\u80c1\u56e2\u4f19\u7684\u6280\u6cd5\u3002<\/li>\n
- \u671d\u9c9c (DPRK)<\/strong>\uff1a\u6a21\u62df\u5bf9 macOS \u7cfb\u7edf\u7684\u653b\u51fb\uff0c\u7075\u611f\u6765\u81ea\u671d\u9c9c\u4f7f\u7528\u6a21\u5757\u5316\u6076\u610f\u8f6f\u4ef6\u63d0\u5347\u6743\u9650\u4ee5\u53ca\u7784\u51c6\u51ed\u636e\u3002<\/li>\n<\/ul>\n
<\/a>Palo Alto Networks \u5982\u4f55\u76d1\u63a7\u52d2\u7d22\u8f6f\u4ef6\u548c\u671d\u9c9c\u4e4b\u7c7b\u98ce\u53e3\u6d6a\u5c16\u7684\u5a01\u80c1\uff1f<\/h3>\n\u4f5c\u4e3a Unit 42 \u7684\u5ef6\u4f38\uff0cPalo Alto Networks Cortex \u5a01\u80c1\u7814\u7a76\u56e2\u961f\u76d1\u63a7\u4e0d\u65ad\u53d8\u5316\u7684\u5a01\u80c1\u73af\u5883\uff0c\u5c06\u5176\u53d1\u73b0\u7ed3\u679c\u8f6c\u5316\u4e3a\u5207\u5b9e\u53ef\u884c\u7684\u60c5\u62a5\uff0c\u76f4\u63a5\u589e\u5f3a Cortex XDR \u7684\u68c0\u6d4b\u548c\u9632\u5fa1\u80fd\u529b\u3002<\/p>\n
\u5728\u8fc7\u53bb\u7684\u4e00\u5e74\u91cc\uff0c\u5728\u7814\u7a76\u5a01\u80c1\u884c\u4e3a\u8005\u7684\u6218\u672f\u3001\u6280\u6cd5\u548c\u7a0b\u5e8f (TTP) \u7684\u65e5\u5e38\u5de5\u4f5c\u671f\u95f4\uff0c\u56e2\u961f\u9501\u5b9a\u4e86\u4e0e\u671d\u9c9c\u6709\u5173\u8054\u7684 APT \u56e2\u4f19\uff0c\u53d1\u73b0\u4e86\u7528\u4e8e\u6e17\u900f\u5168\u7403\u4f01\u4e1a\u7684\u65b0\u7684\u6d3b\u52a8\u548c\u6076\u610f\u8f6f\u4ef6\u3002<\/p>\n
\u671d\u9c9c\u4ee5\u5176\u53cc\u7ba1\u9f50\u4e0b\u7684\u7f51\u7edc\u6218\u6218\u7565\u800c\u95fb\u540d\uff0c\u5176\u6838\u5fc3\u662f\u95f4\u8c0d\u6d3b\u52a8\u548c\u5927\u89c4\u6a21\u7684\u7f51\u7edc\u72af\u7f6a\u6d3b\u52a8\uff0c\u65e8\u5728\u4e3a\u671d\u9c9c\u653f\u6743\u521b\u9020\u6536\u5165\u3002\u6211\u4eec\u7684\u7814\u7a76\u5f3a\u8c03\uff0c\u671d\u9c9c\u8d8a\u6765\u8d8a\u91cd\u89c6\u4ee5 macOS \u7528\u6237\u548c\u7aef\u70b9\u4e3a\u76ee\u6807\uff0c\u540c\u65f6\u6301\u7eed\u52aa\u529b\u4ece\u5168\u7403\u5404\u884c\u5404\u4e1a\u7684\u4f01\u4e1a\u7a83\u53d6\u52a0\u5bc6\u8d27\u5e01\u548c\u654f\u611f\u4fe1\u606f\u3002<\/p>\n
\u56e2\u961f\u7684\u7814\u7a76\u4eae\u70b9\u5df2\u7ecf\u4e0e\u793e\u533a\u5206\u4eab\uff0c\u6b22\u8fce\u5728 Unit 42 \u5a01\u80c1\u7814\u7a76\u4e2d\u5fc3<\/a>\u67e5\u9605\uff0c\u5176\u4e2d\u5305\u62ec\u4ee5\u4e0b\u7814\u7a76\u6587\u7ae0\uff1a<\/p>\n\n- \u5a01\u80c1\u8bc4\u4f30\uff1a\u671d\u9c9c\u5a01\u80c1\u56e2\u4f19<\/a><\/li>\n
- Contagious Interview\uff1a\u671d\u9c9c\u5a01\u80c1\u884c\u4e3a\u8005\u8bf1\u9a97\u79d1\u6280\u884c\u4e1a\u6c42\u804c\u8005\u5b89\u88c5 BeaverTail \u548c InvisibleFerret \u6076\u610f\u8f6f\u4ef6\u7684\u65b0\u53d8\u4f53<\/a><\/li>\n
- Gleaming Pisces \u4e2d\u6bd2\u7684 Python \u8f6f\u4ef6\u5305\u6d3b\u52a8\u4f20\u64ad PondRAT Linux \u548c MacOS \u540e\u95e8<\/a><\/li>\n
- \u63ed\u79d8 Sparkling Pisces \u7684\u5de5\u5177\u7bb1\uff1a KLogEXE \u548c FPSpy<\/a><\/li>\n<\/ul>\n
\u56e2\u961f\u8fd8\u53d1\u8868\u4e86\u51e0\u7bc7\u5173\u4e8e 2024 \u5e74\u6700\u7316\u7357\u7684\u52d2\u7d22\u8f6f\u4ef6\u56e2\u4f19\u7684\u7814\u7a76\u6587\u7ae0\u3002\u8fd9\u4e9b\u7814\u7a76\u5f3a\u8c03\u4e86\u8fd9\u4e9b\u56e2\u4f19\u7684\u6f14\u53d8\uff0c\u5c55\u793a\u4e86\u5176\u65e5\u76ca\u589e\u5f3a\u7684\u590d\u6742\u6027\u548c\u4fb5\u7565\u6027\u3002\u7814\u7a76\u8fdb\u4e00\u6b65\u5c55\u793a\u4e86 Cortex XDR \u7684\u68c0\u6d4b\u548c\u9884\u9632\u80fd\u529b\u5982\u4f55\u81ea\u52a8\u7834\u574f\u8fd9\u4e9b\u884c\u52a8\u5e76\u963b\u6b62\u654f\u611f\u4fe1\u606f\u7684\u52a0\u5bc6\u3002<\/p>\n
\u8981\u4e86\u89e3\u6709\u5173\u8fd9\u4e9b\u52d2\u7d22\u8f6f\u4ef6\u56e2\u4f19\u7684\u66f4\u591a\u4fe1\u606f\uff0c\u8bf7\u53c2\u9605\u4ee5\u4e0b\u6587\u7ae0\uff1a<\/p>\n
\n- \u5a01\u80c1\u8bc4\u4f30\uff1aHowling Scorpius\uff08Akira \u52d2\u7d22\u8f6f\u4ef6\uff09<\/a><\/li>\n
- \u4ece RA \u56e2\u4f19\u5230 RA \u4e16\u754c\uff1a\u52d2\u7d22\u8f6f\u4ef6\u56e2\u4f19\u7684\u6f14\u53d8<\/a><\/li>\n
- \u5a01\u80c1\u8bc4\u4f30\uff1a BianLian<\/a><\/li>\n<\/ul>\n
<\/a>\u4eca\u5e74\u7684\u6d4b\u8bd5\u6709\u4ec0\u4e48\u53d8\u5316\uff1f<\/h3>\n\u4eca\u5e74\u7684 MITRE ATT&CK \u8bc4\u4f30\u5f15\u5165\u4e86\u91cd\u5927\u53d8\u5316\uff0c\u53cd\u6620\u4e86\u4e0d\u65ad\u53d8\u5316\u7684\u5a01\u80c1\u5f62\u52bf\uff0c\u66f4\u597d\u5730\u8861\u91cf\u4e86\u7aef\u70b9\u5b89\u5168\u7684\u6709\u6548\u6027\u3002<\/p>\n
\n- \u6269\u5927\u4e86\u7aef\u70b9\u8986\u76d6\u8303\u56f4<\/strong>\uff1a\u6d4b\u8bd5\u9996\u6b21\u6db5\u76d6\u4e86\u66f4\u5e7f\u6cdb\u7684\u7aef\u70b9\u5e73\u53f0\uff0c\u7784\u51c6\u4e86 Windows\u3001Linux \u548c macOS \u73af\u5883\u3002\u8303\u56f4\u7684\u6269\u5927\u786e\u4fdd\u4e86\u9488\u5bf9\u4e0d\u540c\u64cd\u4f5c\u7cfb\u7edf\u6d4b\u8bd5\u89e3\u51b3\u65b9\u6848\uff0c\u4ece\u800c\u66f4\u5168\u9762\u5730\u4e86\u89e3\u9632\u5fa1\u80fd\u529b\u3002<\/li>\n
- \u7eb3\u5165\u8bef\u62a5<\/strong>\uff1a\u53e6\u4e00\u4e2a\u91cd\u8981\u8865\u5145\u662f\u7eb3\u5165\u8bef\u62a5\u8ddf\u8e2a\uff0c\u8fd9\u662f\u771f\u5b9e\u4e16\u754c\u90e8\u7f72\u4e2d\u7684\u4e00\u4e2a\u5173\u952e\u56e0\u7d20\u3002\u5bf9\u4f9b\u5e94\u5546\u7684\u8bc4\u4f30\u4e0d\u4ec5\u8981\u770b\u68c0\u6d4b\u5a01\u80c1\u7684\u80fd\u529b\uff0c\u8fd8\u8981\u770b\u662f\u5426\u80fd\u907f\u514d\u4e0d\u51c6\u786e\u7684\u68c0\u6d4b\uff0c\u56e0\u4e3a\u4e0d\u51c6\u786e\u7684\u68c0\u6d4b\u53ef\u80fd\u4f1a\u4f7f\u5b89\u5168\u56e2\u961f\u4e0d\u77e5\u6240\u63aa\u6216\u6270\u4e71\u5173\u952e\u4e1a\u52a1\u6d41\u7a0b\u3002<\/li>\n<\/ul>\n
\u901a\u8fc7\u7eb3\u5165\u8fd9\u4e9b\u53d8\u5316\uff0cMITRE \u6267\u884c\u4e86\u8fc4\u4eca\u4e3a\u6b62\u6700\u5177\u6311\u6218\u6027\u548c\u73b0\u5b9e\u6027\u7684\u8bc4\u4f30\u3002<\/p>\n
<\/a>\u4e00\u81f4\u6027\u81f3\u5173\u91cd\u8981 \u2014 Cortex XDR \u5e74\u590d\u4e00\u5e74\u5b9e\u73b0\u5353\u8d8a\u7684\u7ed3\u679c<\/h3>\nPalo Alto Networks \u81f4\u529b\u4e8e\u4e3a\u5ba2\u6237\u63d0\u4f9b\u6700\u9ad8\u8d28\u91cf\u7684\u7f51\u7edc\u5b89\u5168\u6280\u672f\uff0c\u8fd9\u9700\u8981\u5353\u8d8a\u7684\u4eba\u624d\u4ee5\u53ca\u5728\u7814\u7a76\u548c\u5de5\u7a0b\u65b9\u9762\u7684\u6295\u8d44\u3002\u6211\u4eec\u7684\u56e2\u961f\u5e74\u590d\u4e00\u5e74\u901a\u8fc7\u4e86 MITRE ATT&CK \u8bc4\u4f30\u7684\u4e25\u683c\u8003\u9a8c\uff0c\u5411\u5168\u4e16\u754c\u5c55\u793a\u4e86\u6211\u4eec\u8f9b\u52e4\u5de5\u4f5c\u7684\u6210\u679c\uff0c\u5bf9\u6b64\u6211\u4eec\u6df1\u611f\u81ea\u8c6a\u3002<\/p>\n
\u81ea 2022 \u5e74\u4ee5\u6765\uff0cCortex XDR \u5728 MITRE \u8bc4\u4f30\u4e2d\u7684\u68c0\u6d4b\u7ed3\u679c\u4e00\u76f4\u5904\u4e8e\u884c\u4e1a\u9886\u5148\u5730\u4f4d\u3002\u6211\u4eec\u76f8\u4fe1\uff0c\u6bcf\u5e74\u7684\u653b\u51fb\u6a21\u62df\u90fd\u80fd\u63d0\u4f9b\u72ec\u7279\u7684\u89c1\u89e3\uff0c\u8ba9\u6211\u4eec\u4e86\u89e3\u4e16\u754c\u4e0a\u7684\u5404\u79cd\u5a01\u80c1\u884c\u4e3a\u4f53\u4ee5\u53ca\u7f51\u7edc\u5b89\u5168\u884c\u4e1a\u5728\u9632\u5fa1\u8fd9\u4e9b\u5a01\u80c1\u884c\u4e3a\u4f53\u65b9\u9762\u7684\u7acb\u573a\u3002\u6709\u9274\u4e8e\u6b64\uff0c\u6211\u4eec\u5728\u4e92\u52a8\u5c55\u677f<\/a>\u4e2d\u516c\u5f00\u8bb0\u5f55\u4e86\u6240\u6709 MITRE ATT&CK \u8bc4\u4f30\u7ed3\u679c\uff0c\u4fbf\u4e8e\u9010\u5e74\u6bd4\u8f83\u3002<\/p>\n\u611f\u8c22 MITRE \u4ee5\u53ca\u6240\u6709\u4f7f\u7528 Cortex XDR \u4fdd\u62a4\u7aef\u70b9\u7684\u5ba2\u6237\u3002\u6211\u4eec\u5f88\u8363\u5e78\u6210\u4e3a\u60a8\u7684\u9996\u9009\u7f51\u7edc\u5b89\u5168\u5408\u4f5c\u4f19\u4f34\u3002<\/p>\n
\u4eca\u5e74\u7684\u4f01\u4e1a 2024 \u8bc4\u4f30\u91cd\u70b9\u5173\u6ce8\u4e86\u4e24\u4e2a\u622a\u7136\u4e0d\u540c\u4f46\u53c8\u9ad8\u5ea6\u76f8\u5173\u7684\u653b\u51fb\u6e90\uff1a<\/p>\n
- \n
- \u52d2\u7d22\u8f6f\u4ef6<\/strong>\uff1a\u63a2\u7d22\u52d2\u7d22\u8f6f\u4ef6\u6d3b\u52a8\u4e2d\u5e38\u89c1\u7684\u884c\u4e3a\uff0c\u6bd4\u5982\u6ee5\u7528\u5408\u6cd5\u5de5\u5177\u3001\u52a0\u5bc6\u6570\u636e\u548c\u7981\u7528\u5173\u952e\u7684\u670d\u52a1\u6216\u8fdb\u7a0b\u3002MITRE \u9009\u62e9\u6a21\u4eff CLOP<\/a> \u548c LockBit<\/a> \u8fd9\u4e24\u4e2a\u81ed\u540d\u662d\u8457\u7684\u52d2\u7d22\u8f6f\u4ef6\u5373\u670d\u52a1\u5a01\u80c1\u56e2\u4f19\u7684\u6280\u6cd5\u3002<\/li>\n
- \u671d\u9c9c (DPRK)<\/strong>\uff1a\u6a21\u62df\u5bf9 macOS \u7cfb\u7edf\u7684\u653b\u51fb\uff0c\u7075\u611f\u6765\u81ea\u671d\u9c9c\u4f7f\u7528\u6a21\u5757\u5316\u6076\u610f\u8f6f\u4ef6\u63d0\u5347\u6743\u9650\u4ee5\u53ca\u7784\u51c6\u51ed\u636e\u3002<\/li>\n<\/ul>\n
<\/a>Palo Alto Networks \u5982\u4f55\u76d1\u63a7\u52d2\u7d22\u8f6f\u4ef6\u548c\u671d\u9c9c\u4e4b\u7c7b\u98ce\u53e3\u6d6a\u5c16\u7684\u5a01\u80c1\uff1f<\/h3>\n
\u4f5c\u4e3a Unit 42 \u7684\u5ef6\u4f38\uff0cPalo Alto Networks Cortex \u5a01\u80c1\u7814\u7a76\u56e2\u961f\u76d1\u63a7\u4e0d\u65ad\u53d8\u5316\u7684\u5a01\u80c1\u73af\u5883\uff0c\u5c06\u5176\u53d1\u73b0\u7ed3\u679c\u8f6c\u5316\u4e3a\u5207\u5b9e\u53ef\u884c\u7684\u60c5\u62a5\uff0c\u76f4\u63a5\u589e\u5f3a Cortex XDR \u7684\u68c0\u6d4b\u548c\u9632\u5fa1\u80fd\u529b\u3002<\/p>\n
\u5728\u8fc7\u53bb\u7684\u4e00\u5e74\u91cc\uff0c\u5728\u7814\u7a76\u5a01\u80c1\u884c\u4e3a\u8005\u7684\u6218\u672f\u3001\u6280\u6cd5\u548c\u7a0b\u5e8f (TTP) \u7684\u65e5\u5e38\u5de5\u4f5c\u671f\u95f4\uff0c\u56e2\u961f\u9501\u5b9a\u4e86\u4e0e\u671d\u9c9c\u6709\u5173\u8054\u7684 APT \u56e2\u4f19\uff0c\u53d1\u73b0\u4e86\u7528\u4e8e\u6e17\u900f\u5168\u7403\u4f01\u4e1a\u7684\u65b0\u7684\u6d3b\u52a8\u548c\u6076\u610f\u8f6f\u4ef6\u3002<\/p>\n
\u671d\u9c9c\u4ee5\u5176\u53cc\u7ba1\u9f50\u4e0b\u7684\u7f51\u7edc\u6218\u6218\u7565\u800c\u95fb\u540d\uff0c\u5176\u6838\u5fc3\u662f\u95f4\u8c0d\u6d3b\u52a8\u548c\u5927\u89c4\u6a21\u7684\u7f51\u7edc\u72af\u7f6a\u6d3b\u52a8\uff0c\u65e8\u5728\u4e3a\u671d\u9c9c\u653f\u6743\u521b\u9020\u6536\u5165\u3002\u6211\u4eec\u7684\u7814\u7a76\u5f3a\u8c03\uff0c\u671d\u9c9c\u8d8a\u6765\u8d8a\u91cd\u89c6\u4ee5 macOS \u7528\u6237\u548c\u7aef\u70b9\u4e3a\u76ee\u6807\uff0c\u540c\u65f6\u6301\u7eed\u52aa\u529b\u4ece\u5168\u7403\u5404\u884c\u5404\u4e1a\u7684\u4f01\u4e1a\u7a83\u53d6\u52a0\u5bc6\u8d27\u5e01\u548c\u654f\u611f\u4fe1\u606f\u3002<\/p>\n
\u56e2\u961f\u7684\u7814\u7a76\u4eae\u70b9\u5df2\u7ecf\u4e0e\u793e\u533a\u5206\u4eab\uff0c\u6b22\u8fce\u5728 Unit 42 \u5a01\u80c1\u7814\u7a76\u4e2d\u5fc3<\/a>\u67e5\u9605\uff0c\u5176\u4e2d\u5305\u62ec\u4ee5\u4e0b\u7814\u7a76\u6587\u7ae0\uff1a<\/p>\n
- \n
- \u5a01\u80c1\u8bc4\u4f30\uff1a\u671d\u9c9c\u5a01\u80c1\u56e2\u4f19<\/a><\/li>\n
- Contagious Interview\uff1a\u671d\u9c9c\u5a01\u80c1\u884c\u4e3a\u8005\u8bf1\u9a97\u79d1\u6280\u884c\u4e1a\u6c42\u804c\u8005\u5b89\u88c5 BeaverTail \u548c InvisibleFerret \u6076\u610f\u8f6f\u4ef6\u7684\u65b0\u53d8\u4f53<\/a><\/li>\n
- Gleaming Pisces \u4e2d\u6bd2\u7684 Python \u8f6f\u4ef6\u5305\u6d3b\u52a8\u4f20\u64ad PondRAT Linux \u548c MacOS \u540e\u95e8<\/a><\/li>\n
- \u63ed\u79d8 Sparkling Pisces \u7684\u5de5\u5177\u7bb1\uff1a KLogEXE \u548c FPSpy<\/a><\/li>\n<\/ul>\n
\u56e2\u961f\u8fd8\u53d1\u8868\u4e86\u51e0\u7bc7\u5173\u4e8e 2024 \u5e74\u6700\u7316\u7357\u7684\u52d2\u7d22\u8f6f\u4ef6\u56e2\u4f19\u7684\u7814\u7a76\u6587\u7ae0\u3002\u8fd9\u4e9b\u7814\u7a76\u5f3a\u8c03\u4e86\u8fd9\u4e9b\u56e2\u4f19\u7684\u6f14\u53d8\uff0c\u5c55\u793a\u4e86\u5176\u65e5\u76ca\u589e\u5f3a\u7684\u590d\u6742\u6027\u548c\u4fb5\u7565\u6027\u3002\u7814\u7a76\u8fdb\u4e00\u6b65\u5c55\u793a\u4e86 Cortex XDR \u7684\u68c0\u6d4b\u548c\u9884\u9632\u80fd\u529b\u5982\u4f55\u81ea\u52a8\u7834\u574f\u8fd9\u4e9b\u884c\u52a8\u5e76\u963b\u6b62\u654f\u611f\u4fe1\u606f\u7684\u52a0\u5bc6\u3002<\/p>\n
\u8981\u4e86\u89e3\u6709\u5173\u8fd9\u4e9b\u52d2\u7d22\u8f6f\u4ef6\u56e2\u4f19\u7684\u66f4\u591a\u4fe1\u606f\uff0c\u8bf7\u53c2\u9605\u4ee5\u4e0b\u6587\u7ae0\uff1a<\/p>\n
- \n
- \u5a01\u80c1\u8bc4\u4f30\uff1aHowling Scorpius\uff08Akira \u52d2\u7d22\u8f6f\u4ef6\uff09<\/a><\/li>\n
- \u4ece RA \u56e2\u4f19\u5230 RA \u4e16\u754c\uff1a\u52d2\u7d22\u8f6f\u4ef6\u56e2\u4f19\u7684\u6f14\u53d8<\/a><\/li>\n
- \u5a01\u80c1\u8bc4\u4f30\uff1a BianLian<\/a><\/li>\n<\/ul>\n
<\/a>\u4eca\u5e74\u7684\u6d4b\u8bd5\u6709\u4ec0\u4e48\u53d8\u5316\uff1f<\/h3>\n
\u4eca\u5e74\u7684 MITRE ATT&CK \u8bc4\u4f30\u5f15\u5165\u4e86\u91cd\u5927\u53d8\u5316\uff0c\u53cd\u6620\u4e86\u4e0d\u65ad\u53d8\u5316\u7684\u5a01\u80c1\u5f62\u52bf\uff0c\u66f4\u597d\u5730\u8861\u91cf\u4e86\u7aef\u70b9\u5b89\u5168\u7684\u6709\u6548\u6027\u3002<\/p>\n
- \n
- \u6269\u5927\u4e86\u7aef\u70b9\u8986\u76d6\u8303\u56f4<\/strong>\uff1a\u6d4b\u8bd5\u9996\u6b21\u6db5\u76d6\u4e86\u66f4\u5e7f\u6cdb\u7684\u7aef\u70b9\u5e73\u53f0\uff0c\u7784\u51c6\u4e86 Windows\u3001Linux \u548c macOS \u73af\u5883\u3002\u8303\u56f4\u7684\u6269\u5927\u786e\u4fdd\u4e86\u9488\u5bf9\u4e0d\u540c\u64cd\u4f5c\u7cfb\u7edf\u6d4b\u8bd5\u89e3\u51b3\u65b9\u6848\uff0c\u4ece\u800c\u66f4\u5168\u9762\u5730\u4e86\u89e3\u9632\u5fa1\u80fd\u529b\u3002<\/li>\n
- \u7eb3\u5165\u8bef\u62a5<\/strong>\uff1a\u53e6\u4e00\u4e2a\u91cd\u8981\u8865\u5145\u662f\u7eb3\u5165\u8bef\u62a5\u8ddf\u8e2a\uff0c\u8fd9\u662f\u771f\u5b9e\u4e16\u754c\u90e8\u7f72\u4e2d\u7684\u4e00\u4e2a\u5173\u952e\u56e0\u7d20\u3002\u5bf9\u4f9b\u5e94\u5546\u7684\u8bc4\u4f30\u4e0d\u4ec5\u8981\u770b\u68c0\u6d4b\u5a01\u80c1\u7684\u80fd\u529b\uff0c\u8fd8\u8981\u770b\u662f\u5426\u80fd\u907f\u514d\u4e0d\u51c6\u786e\u7684\u68c0\u6d4b\uff0c\u56e0\u4e3a\u4e0d\u51c6\u786e\u7684\u68c0\u6d4b\u53ef\u80fd\u4f1a\u4f7f\u5b89\u5168\u56e2\u961f\u4e0d\u77e5\u6240\u63aa\u6216\u6270\u4e71\u5173\u952e\u4e1a\u52a1\u6d41\u7a0b\u3002<\/li>\n<\/ul>\n
\u901a\u8fc7\u7eb3\u5165\u8fd9\u4e9b\u53d8\u5316\uff0cMITRE \u6267\u884c\u4e86\u8fc4\u4eca\u4e3a\u6b62\u6700\u5177\u6311\u6218\u6027\u548c\u73b0\u5b9e\u6027\u7684\u8bc4\u4f30\u3002<\/p>\n
<\/a>\u4e00\u81f4\u6027\u81f3\u5173\u91cd\u8981 \u2014 Cortex XDR \u5e74\u590d\u4e00\u5e74\u5b9e\u73b0\u5353\u8d8a\u7684\u7ed3\u679c<\/h3>\n
Palo Alto Networks \u81f4\u529b\u4e8e\u4e3a\u5ba2\u6237\u63d0\u4f9b\u6700\u9ad8\u8d28\u91cf\u7684\u7f51\u7edc\u5b89\u5168\u6280\u672f\uff0c\u8fd9\u9700\u8981\u5353\u8d8a\u7684\u4eba\u624d\u4ee5\u53ca\u5728\u7814\u7a76\u548c\u5de5\u7a0b\u65b9\u9762\u7684\u6295\u8d44\u3002\u6211\u4eec\u7684\u56e2\u961f\u5e74\u590d\u4e00\u5e74\u901a\u8fc7\u4e86 MITRE ATT&CK \u8bc4\u4f30\u7684\u4e25\u683c\u8003\u9a8c\uff0c\u5411\u5168\u4e16\u754c\u5c55\u793a\u4e86\u6211\u4eec\u8f9b\u52e4\u5de5\u4f5c\u7684\u6210\u679c\uff0c\u5bf9\u6b64\u6211\u4eec\u6df1\u611f\u81ea\u8c6a\u3002<\/p>\n
\u81ea 2022 \u5e74\u4ee5\u6765\uff0cCortex XDR \u5728 MITRE \u8bc4\u4f30\u4e2d\u7684\u68c0\u6d4b\u7ed3\u679c\u4e00\u76f4\u5904\u4e8e\u884c\u4e1a\u9886\u5148\u5730\u4f4d\u3002\u6211\u4eec\u76f8\u4fe1\uff0c\u6bcf\u5e74\u7684\u653b\u51fb\u6a21\u62df\u90fd\u80fd\u63d0\u4f9b\u72ec\u7279\u7684\u89c1\u89e3\uff0c\u8ba9\u6211\u4eec\u4e86\u89e3\u4e16\u754c\u4e0a\u7684\u5404\u79cd\u5a01\u80c1\u884c\u4e3a\u4f53\u4ee5\u53ca\u7f51\u7edc\u5b89\u5168\u884c\u4e1a\u5728\u9632\u5fa1\u8fd9\u4e9b\u5a01\u80c1\u884c\u4e3a\u4f53\u65b9\u9762\u7684\u7acb\u573a\u3002\u6709\u9274\u4e8e\u6b64\uff0c\u6211\u4eec\u5728\u4e92\u52a8\u5c55\u677f<\/a>\u4e2d\u516c\u5f00\u8bb0\u5f55\u4e86\u6240\u6709 MITRE ATT&CK \u8bc4\u4f30\u7ed3\u679c\uff0c\u4fbf\u4e8e\u9010\u5e74\u6bd4\u8f83\u3002<\/p>\n
\u611f\u8c22 MITRE \u4ee5\u53ca\u6240\u6709\u4f7f\u7528 Cortex XDR \u4fdd\u62a4\u7aef\u70b9\u7684\u5ba2\u6237\u3002\u6211\u4eec\u5f88\u8363\u5e78\u6210\u4e3a\u60a8\u7684\u9996\u9009\u7f51\u7edc\u5b89\u5168\u5408\u4f5c\u4f19\u4f34\u3002<\/p>\n
- \u7eb3\u5165\u8bef\u62a5<\/strong>\uff1a\u53e6\u4e00\u4e2a\u91cd\u8981\u8865\u5145\u662f\u7eb3\u5165\u8bef\u62a5\u8ddf\u8e2a\uff0c\u8fd9\u662f\u771f\u5b9e\u4e16\u754c\u90e8\u7f72\u4e2d\u7684\u4e00\u4e2a\u5173\u952e\u56e0\u7d20\u3002\u5bf9\u4f9b\u5e94\u5546\u7684\u8bc4\u4f30\u4e0d\u4ec5\u8981\u770b\u68c0\u6d4b\u5a01\u80c1\u7684\u80fd\u529b\uff0c\u8fd8\u8981\u770b\u662f\u5426\u80fd\u907f\u514d\u4e0d\u51c6\u786e\u7684\u68c0\u6d4b\uff0c\u56e0\u4e3a\u4e0d\u51c6\u786e\u7684\u68c0\u6d4b\u53ef\u80fd\u4f1a\u4f7f\u5b89\u5168\u56e2\u961f\u4e0d\u77e5\u6240\u63aa\u6216\u6270\u4e71\u5173\u952e\u4e1a\u52a1\u6d41\u7a0b\u3002<\/li>\n<\/ul>\n
- \u4ece RA \u56e2\u4f19\u5230 RA \u4e16\u754c\uff1a\u52d2\u7d22\u8f6f\u4ef6\u56e2\u4f19\u7684\u6f14\u53d8<\/a><\/li>\n
- Contagious Interview\uff1a\u671d\u9c9c\u5a01\u80c1\u884c\u4e3a\u8005\u8bf1\u9a97\u79d1\u6280\u884c\u4e1a\u6c42\u804c\u8005\u5b89\u88c5 BeaverTail \u548c InvisibleFerret \u6076\u610f\u8f6f\u4ef6\u7684\u65b0\u53d8\u4f53<\/a><\/li>\n
- \u671d\u9c9c (DPRK)<\/strong>\uff1a\u6a21\u62df\u5bf9 macOS \u7cfb\u7edf\u7684\u653b\u51fb\uff0c\u7075\u611f\u6765\u81ea\u671d\u9c9c\u4f7f\u7528\u6a21\u5757\u5316\u6076\u610f\u8f6f\u4ef6\u63d0\u5347\u6743\u9650\u4ee5\u53ca\u7784\u51c6\u51ed\u636e\u3002<\/li>\n<\/ul>\n