{"id":2609,"date":"2023-05-09T13:28:58","date_gmt":"2023-05-09T04:28:58","guid":{"rendered":"https:\/\/techtalk.pcmatic.jp\/?p=2609"},"modified":"2025-09-08T14:34:01","modified_gmt":"2025-09-08T05:34:01","slug":"av-test-2023%e5%b9%b45%e6%9c%88%e7%99%ba%e8%a1%a8%e5%88%86%e3%83%a9%e3%83%b3%e3%82%b5%e3%83%a0%e3%82%a6%e3%82%a7%e3%82%a2%e9%98%b2%e5%be%a1%e8%a9%a6%e9%a8%93%e3%81%a7top%e3%82%b9%e3%82%b3%e3%82%a2","status":"publish","type":"post","link":"https:\/\/techtalk.pcmatic.jp\/?p=2609","title":{"rendered":"AV-TEST 2023\u5e745\u6708\u767a\u8868 \u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u9632\u5fa1\u8a66\u9a13\u3067TOP\u30b9\u30b3\u30a2\u7372\u5f97"},"content":{"rendered":"\n

2\uff5e3\u304b\u6708\u9593\u9694\u3067\u4e0d\u5b9a\u671f\u306b\u5b9f\u65bd\u3055\u308c\u308b\u4efb\u610f\u8a66\u9a13\u306e\u300c\u6700\u65b0\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u691c\u4f53\u9632\u5fa1\u8a66\u9a13\u300d\u306b\u3066\u3001\u307e\u305f\u3082PC Matic\u306e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30fb\u30db\u30ef\u30a4\u30c8\u30ea\u30b9\u30c6\u30a3\u30f3\u30b0\u65b9\u5f0f\u30a8\u30f3\u30b8\u30f3\u306f\u3001TOP\u30b9\u30b3\u30a2\u3092\u7372\u5f97\u3057\u307e\u3057\u305f\u3002\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u9632\u5fa1\u529b\u306b\u81ea\u4fe1\u306e\u3042\u308b24\u306eAV\u30a8\u30f3\u30b8\u30f3\u304c\u8a66\u9a13\u306b\u6311\u307f\u300113\u306eAV\u30a8\u30f3\u30b8\u30f3\u304c\u30c8\u30c3\u30d7\u30b9\u30b3\u30a2\u3092\u7372\u5f97\u3057\u307e\u3057\u305f\u3002<\/p>\n\n\n\n\n\n\n\n

\u4eca\u56de\u306f\u3001MITRE ATT&CK\u00ae\u306b\u767b\u9332\u30fb\u516c\u958b\u3055\u308c\u305f\uff11\uff10\u306e\u6700\u65b0\u306e\u653b\u6483\u30b7\u30ca\u30ea\u30aa\u306b\u3088\u3063\u3066\u8a66\u9a13\u304c\u5b9f\u65bd\u3055\u308c\u307e\u3057\u305f\u3002\u7279\u7b46\u3059\u3079\u304d\u306f\u3001\u300c.Net Reflective Assembly loading\u300d\u306a\u3069\u3001Cobalt Strike\u3001Cuba\u3001\u307e\u305f\u306f Lazarus \u304b\u3089\u306e\u653b\u6483\u3067\u57fa\u672c\u7684\u306a\u5f62\u3067\u4f7f\u7528\u3055\u308c\u308b\u624b\u6cd5\u304c\u8a66\u9a13\u3055\u308c\u305f\u3053\u3068\u3067\u3059\u3002\u300c.Net Dynamic P\/Invoke\u300d\u3084\u300cAMSI Bypass\u300d\u3068\u3044\u3046\u624b\u6cd5\u3082\u4eba\u6c17\u3067\u3059\u304c\u3001\u6700\u8fd1\u306e\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u306b\u3088\u308b\u653b\u6483\u306f\u3001\u4e00\u5ea6\u653b\u6483\u304c\u6210\u529f\u3059\u308b\u3068\u3001\u60c5\u5831\u30b9\u30c6\u30a3\u30fc\u30e9\u30fc\u578b\u306b\u3066\u60c5\u5831\u304c\u6f0f\u6d29\u3055\u308c\u305f\u5f8c\u306b\u30b7\u30b9\u30c6\u30e0\u306f\u6697\u53f7\u5316\u3055\u308c\u3001\u30d5\u30a1\u30a4\u30eb\u6697\u53f7\u5316\u306e\u5fa9\u5143\u306b\u6210\u529f\u3057\u3066\u3082APT\u30b0\u30eb\u30fc\u30d7\u306b\u3088\u308b\u30cd\u30c3\u30c8\u4e0a\u3067\u306e\u8105\u8feb\u884c\u70ba\u306f\u7d9a\u304d\u307e\u3059\u3002<\/p>\n\n\n\n

<\/p>\n\n\n\n

\u4eca\u56de\u306e\u8a66\u9a13\u3067\u63a1\u7528\u3055\u308c\u305f\u7279\u7b46\u3059\u3079\u304d\u6700\u65b0\u306e\u653b\u6483\u624b\u6cd5<\/h3>\n\n\n\n

.Net Reflective Assembly\u306e\u30ed\u30fc\u30c9\uff1a<\/strong> \u30de\u30eb\u30a6\u30a7\u30a2\u306e\u30b3\u30fc\u30c9\u3092\u96e3\u8aad\u5316\u3059\u308b\u305f\u3081\u306b\u3001\u5178\u578b\u7684\u306a\u624b\u6cd5\u3068\u3057\u3066\u3001\u5b9f\u884c\u6642\u306b\u53cd\u5c04\u7684\u306b\u8aad\u307f\u8fbc\u3080\u3053\u3068\u304c\u3042\u308a\u307e\u3059\u3002\u53cd\u5c04\u7684\u306b\u30ed\u30fc\u30c9\u3059\u308b\u3053\u3068\u3067\u3001\u30d7\u30ed\u30bb\u30b9\u306e\u30e1\u30e2\u30ea\u306b\u76f4\u63a5\u30da\u30a4\u30ed\u30fc\u30c9\uff08\u5b9f\u884c\u53ef\u80fd\u306a\u30de\u30eb\u30a6\u30a7\u30a2 \u30b3\u30fc\u30c9\uff09\u3092\u5272\u308a\u5f53\u3066\u3066\u5b9f\u884c\u3057\u305f\u308a\u3001\u30b9\u30ec\u30c3\u30c9\u3084\u30d7\u30ed\u30bb\u30b9\u3092\u4f5c\u6210\u3057\u305f\u308a\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002.Net\u3067\u306f\u3001Assembly.Load\u3092\u4f7f\u7528\u3057\u3066\u30a2\u30bb\u30f3\u30d6\u30ea\u3092\u30ed\u30fc\u30c9\u3059\u308b\u3053\u3068\u304c\u53ef\u80fd\u3067\u3059\u3002<\/p>\n\n\n\n

\u3053\u306e\u4f8b\u3067\u306f\u3001\u6697\u53f7\u5316\u3055\u308c\u305f\u30a2\u30bb\u30f3\u30d6\u30ea\u304c\u4fdd\u5b58\u3055\u308c\u3001\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u304c\u5b9f\u88c5\u3055\u308c\u3066\u3044\u307e\u3059\u3002 \u30cf\u30fc\u30c9\u30c9\u30e9\u30a4\u30d6\u306b\u30a4\u30e1\u30fc\u30b8\u3092\u4f5c\u6210\u3059\u308b\u3053\u3068\u306a\u304f\u3001\u5b9f\u884c\u6642\u306b\u5fa9\u53f7\u5316\u3001\u30ed\u30fc\u30c9\u3001\u304a\u3088\u3073\u5b9f\u884c\u3055\u308c\u307e\u3059\u3002<\/p>\n\n\n\n

.Net Dynamic P\/Invoke\uff1a<\/strong> .Net\u306f\u30a2\u30f3\u30de\u30cd\u30fc\u30b8\u30b3\u30fc\u30c9\uff08.Net\u306b\u6307\u5b9a\u3055\u308c\u3066\u3044\u306a\u3044\u30b3\u30fc\u30c9\uff09\u3092\u5b9f\u884c\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u3001\u3053\u308c\u3092\u4f7f\u7528\u3057\u3066\u6a19\u6e96\u306eWindows API\u30b3\u30fc\u30eb\u3092\u958b\u59cb\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u3053\u308c\u306b\u3088\u308a\u3001.Net\u3067\u63d0\u4f9b\u3055\u308c\u3066\u3044\u306a\u3044\u7279\u5b9a\u306e\u52d5\u4f5c\u3092\u5b9f\u88c5\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u3053\u308c\u306f\u901a\u5e38\u3001\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u306eInvoke\uff08P\/Invoke\uff09\u3092\u4f7f\u7528\u3059\u308b\u3053\u3068\u3067\u5b9f\u73fe\u3055\u308c\u307e\u3059\u3002P\/Invoke \u304c\u9759\u7684\u306b\u4f7f\u7528\u3055\u308c\u306a\u3044\u5834\u5408\u3001\u30e9\u30a4\u30d6\u30e9\u30ea\u306f\u5b9f\u884c\u6642\u306b\u52d5\u7684\u306b\u30ed\u30fc\u30c9\u3055\u308c\u3001\u30e9\u30a4\u30d6\u30e9\u30ea\u306b\u542b\u307e\u308c\u308b\u95a2\u6570\u306f\u30e1\u30e2\u30ea \u30a2\u30c9\u30ec\u30b9\u3092\u4ecb\u3057\u3066\u547c\u3073\u51fa\u3055\u308c\u307e\u3059\u3002\u305d\u306e\u904e\u7a0b\u3067\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d7\u30ed\u30b0\u30e9\u30e0\u304b\u3089\u306e\u691c\u51fa\u3092\u56de\u907f\u3059\u308b\u305f\u3081\u3001\u305d\u306e\u4f7f\u7528\u306f\u96e3\u8aad\u5316\u3055\u308c\u307e\u3059\u3002<\/p>\n\n\n\n

\u3053\u306e\u4f8b\u3067\u306f\u3001Dynamic P\/Invoke\u3092\u4f7f\u7528\u3057\u3066API\u95a2\u6570\uff08VirtualAlloc\u3001CreateThread\uff09\u3092\u547c\u3073\u51fa\u3057\u3001\u6697\u53f7\u5316\u3055\u308c\u53cd\u5c04\u3059\u308b\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u3092\u30e1\u30e2\u30ea\u4e0a\u306b\u30ed\u30fc\u30c9\u3057\u3066\u5b9f\u884c\u3057\u307e\u3059\u3002<\/p>\n\n\n\n

AMSI \u30d0\u30a4\u30d1\u30b9\uff1a<\/strong> AMSI\uff08Antimalware Scan Interface\uff09\u306f\u3001Microsoft\u793e\u304c\u63d0\u4f9b\u3059\u308b\u30b9\u30ad\u30e3\u30f3API\u3067\u3001\u30a6\u30a4\u30eb\u30b9\u5bfe\u7b56\u30bd\u30ea\u30e5\u30fc\u30b7\u30e7\u30f3\u3067\u3082\u4f7f\u7528\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u305d\u306e\u30bf\u30b9\u30af\u306e\u4e00\u90e8\u306f\u3001\u30b9\u30af\u30ea\u30d7\u30c8 \u30a8\u30f3\u30b8\u30f3\u306b\u3088\u3063\u3066\u5b9f\u884c\u3055\u308c\u308b\u524d\u306b\u30b9\u30af\u30ea\u30d7\u30c8 \u30c7\u30fc\u30bf\u3092\u30b9\u30ad\u30e3\u30f3\u3059\u308b\u3053\u3068\u3067\u3059\u3002\u3057\u304b\u3057\u3001\u653b\u6483\u8005\u306f\u30d7\u30ed\u30bb\u30b9\u5185\u306e\u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30a4\u30b9\u6a5f\u80fd\u3092\u64cd\u4f5c\u3057\u3066\u3001AMSI \u6a5f\u80fd\u3092\u59a8\u5bb3\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n

\"AV-TEST\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a22023\u5e745\u6708\u30b9\u30b3\u30a2\"<\/a>
AV-TEST\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a22023\u5e745\u6708\u30b9\u30b3\u30a2<\/a><\/figcaption><\/figure>\n\n\n\n

\u539f\u6587:Fending off Ransomware even Against State-of-the-art Attack Techniques<\/a> (2023\/5\/2\u767a\u8868)<\/p>\n\n\n\n

\u7d50\u8ad6<\/h3>\n\n\n\n

\u3053\u308c\u3089\u306e\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u691c\u4f53\u306f\u3001\u6700\u65b0\u3068\u3044\u3063\u3066\u3082\uff11\uff10\u65e5\uff5e\u6570\u9031\u9593\u7d4c\u904e\u3057\u305f\u691c\u4f53\u30c7\u30fc\u30bf\u3067\u3059\u3002\u30d6\u30e9\u30c3\u30af\u30ea\u30b9\u30c8\uff0b\u30d2\u30e5\u30fc\u30ea\u30b9\u30c6\u30a3\u30c3\u30af\u65b9\u5f0f\u306e\u30a8\u30f3\u30b8\u30f3\u3067\u3042\u3063\u3066\u3082\u3001\u696d\u754c\u5185\u3067\u65e2\u77e5\u3067\u3042\u308b\u305f\u3081\u9632\u5fa1\u3067\u304d\u306a\u3044\u306e\u306f\u5c11\u3057\u554f\u984c\u3067\u306f\u306a\u3044\u3067\u3057\u3087\u3046\u304b\u3002AMSI\u306e\u56de\u907f\u3092\u8a31\u3057\u3066\u3057\u307e\u3046\u306e\u306f\u672c\u5f53\u306b\u6b8b\u5ff5\u3067\u3059\u3002<\/p>\n\n\n\n

2022\u5e74\u306f\u30011460\u5104\u500b\u3082\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u691c\u51fa<\/a>\u3055\u308c\u3001\uff19\u5272\u4ee5\u4e0a\u304c24\u6642\u9593\u4ee5\u5185\u306b\u518d\u691c\u51fa\u3055\u308c\u306a\u3044\u6642\u4ee3\u3067\u3059\u3002\u8fc5\u901f\u306b\u30b7\u30b0\u30cd\u30c1\u30e3\u30fc\u66f4\u65b0\u3092\u3057\u306a\u3051\u308c\u3070\u30de\u30eb\u30a6\u30a7\u30a2\u306b\u5bfe\u3059\u308b\u9632\u5fa1\u306f\u56f0\u96e3\u3067\u3059\u3002\u3059\u3079\u3066\u306eAV\u30a8\u30f3\u30b8\u30f3\u304c100%\u691c\u51fa\u3055\u308c\u308b\u6642\u4ee3\u304c\u8a2a\u308c\u308b\u3053\u3068\u306f\u3001\u30e2\u30b0\u30e9\u305f\u305f\u304d\u578b\u306e\u30d6\u30e9\u30c3\u30af\u30ea\u30b9\u30c8\u65b9\u5f0f\u3067\u306f\u65e2\u306b\u9650\u754c\u3067\u3059\u3002EDR\u306b\u3088\u3063\u3066\u5fa9\u5143\u529b\u304c\u3042\u3063\u3066\u3082\u3001\u60c5\u5831\u30b9\u30c6\u30a3\u30fc\u30e9\u30fc\uff0b\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u304c\u7d44\u307f\u5408\u308f\u305b\u3089\u308c\u305f\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u304c\u4e3b\u6d41\u3068\u306a\u3063\u305f\u4eca\u3001\u793e\u5185\u30b7\u30b9\u30c6\u30e0\u3092\u5fa9\u65e7\u3057\u305f\u3068\u3053\u308d\u3067\u76d7\u307e\u308c\u305f\u60c5\u5831\u306b\u3088\u308b\u6050\u559d\u306f\u7d9a\u304d\u307e\u3059\u3002<\/p>\n\n\n\n

\u53ef\u80fd\u306a\u9650\u308a\u76d7\u307e\u308c\u306a\u3044\u4ed5\u7d44\u307f\u3068\u3057\u3066\u3001\u30a2\u30e1\u30ea\u30ab\u5408\u8846\u56fd\u653f\u5e9c\u306f\u653f\u5e9c\u6a5f\u95a2\u5411\u3051\u306b\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30fb\u30db\u30ef\u30a4\u30c8\u30ea\u30b9\u30c6\u30a3\u30f3\u30b0\u65b9\u5f0f\u3092\u63a1\u7528\u3057\u3001\u793e\u4f1a\u30a4\u30f3\u30d5\u30e9\u3092\u652f\u3048\u308b\u6c11\u9593\u4f01\u696d\u3078\u3082\u63a1\u7528\u3092\u50cd\u304d\u304b\u3051\u3066\u3044\u307e\u3059\u3002\u30aa\u30fc\u30b9\u30c8\u30e9\u30ea\u30a2\u653f\u5e9c\u3082\u7c73\u56fd\u9023\u90a6\u653f\u5e9c\u3068\u540c\u3058\u57fa\u6e96\u3092\u63a1\u7528\u3057\u3066\u304a\u308a\u3001\u4eca\u5f8cNATO\u52a0\u76df\u56fd\u3067\u306f\u3001\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30fb\u30db\u30ef\u30a4\u30c8\u30ea\u30b9\u30c6\u30a3\u30f3\u30b0\u65b9\u5f0f\u304c\u653f\u5e9c\u6a5f\u95a2\u3067\u306e\u4fdd\u8b77\u65b9\u5f0f\u3068\u3057\u3066\u57fa\u6e96\u306b\u306a\u3063\u3066\u3044\u304f\u3068\u63a8\u6e2c\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"

2\uff5e3\u304b\u6708\u9593\u9694\u3067\u4e0d\u5b9a\u671f\u306b\u5b9f\u65bd\u3055\u308c\u308b\u4efb\u610f\u8a66\u9a13\u306e\u300c\u6700\u65b0\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u691c\u4f53\u9632\u5fa1\u8a66\u9a13\u300d\u306b\u3066\u3001\u307e\u305f\u3082PC Matic\u306e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30fb\u30db\u30ef\u30a4\u30c8\u30ea\u30b9\u30c6\u30a3\u30f3\u30b0\u65b9\u5f0f\u30a8\u30f3\u30b8\u30f3\u306f\u3001TOP\u30b9\u30b3\u30a2\u3092\u7372\u5f97\u3057\u307e\u3057\u305f\u3002\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u9632\u5fa1\u529b\u306b\u81ea\u4fe1\u306e\u3042 […]<\/p>\n","protected":false},"author":1,"featured_media":2610,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-2609","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/techtalk.pcmatic.jp\/index.php?rest_route=\/wp\/v2\/posts\/2609","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techtalk.pcmatic.jp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techtalk.pcmatic.jp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techtalk.pcmatic.jp\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/techtalk.pcmatic.jp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2609"}],"version-history":[{"count":5,"href":"https:\/\/techtalk.pcmatic.jp\/index.php?rest_route=\/wp\/v2\/posts\/2609\/revisions"}],"predecessor-version":[{"id":2615,"href":"https:\/\/techtalk.pcmatic.jp\/index.php?rest_route=\/wp\/v2\/posts\/2609\/revisions\/2615"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techtalk.pcmatic.jp\/index.php?rest_route=\/wp\/v2\/media\/2610"}],"wp:attachment":[{"href":"https:\/\/techtalk.pcmatic.jp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2609"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techtalk.pcmatic.jp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2609"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techtalk.pcmatic.jp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2609"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}