{"id":100904,"date":"2026-09-05T15:57:04","date_gmt":"2026-09-05T07:57:04","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/100904.html"},"modified":"2026-09-05T15:57:04","modified_gmt":"2026-09-05T07:57:04","slug":"%e6%9c%a8%e9%a9%ac%e9%80%9a%e4%bf%a1%e5%88%86%e6%9e%90-c2-%e5%8d%8f%e8%ae%ae%e3%80%81dga%e3%80%81%e5%9f%9f%e5%90%8d%e7%94%9f%e6%88%90%e7%ae%97%e6%b3%95","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/100904.html","title":{"rendered":"\u6728\u9a6c\u901a\u4fe1\u5206\u6790\u2014\u2014C2 \u534f\u8bae\u3001DGA\u3001\u57df\u540d\u751f\u6210\u7b97\u6cd5"},"content":{"rendered":"

\u5f15\u8a00：\u6293\u4f4f C2，\u5c31\u6293\u4f4f\u4e86\u653b\u51fb\u8005\u7684\u547d\u95e8<\/h3>\n

\u5728\u73b0\u4ee3\u5165\u4fb5\u4e8b\u4ef6\u4e2d，C2（Command and Control，\u547d\u4ee4\u4e0e\u63a7\u5236）\u662f\u653b\u51fb\u8005\u7684"\u751f\u547d\u7ebf"\u2014\u2014\u5b83\u662f\u690d\u5165\u4f53\u63a5\u6536\u6307\u4ee4\u3001\u56de\u4f20\u6570\u636e\u3001\u4e0b\u8f7d\u8f7d\u8377\u7684\u552f\u4e00\u901a\u9053\u3002\u65e0\u8bba\u653b\u51fb\u8005\u5728\u4e3b\u673a\u4fa7\u505a\u4e86\u591a\u6df1\u7684\u514d\u6740，\u53ea\u8981 C2 \u901a\u4fe1\u88ab\u8bc6\u522b\u5e76\u963b\u65ad，\u653b\u51fb\u5c31\u5ba3\u544a\u65ad\u94fe\u3002\u636e Sekoia 2023 \u5e74\u7edf\u8ba1，\u5168\u7403\u6d3b\u8dc3 C2 \u76f8\u5173 IP \u6570\u91cf\u5df2\u7a81\u7834 8.5 \u4e07，\u6bd4\u4e0a\u4e00\u5e74\u589e\u957f 30%；Cobalt Strike \u7684\u7834\u89e3\u7248\u4ece 2020 \u5e74\u8d77\u5c31\u5728\u9ed1\u4ea7\u751f\u6001\u4e2d\u81ea\u7531\u6d41\u901a，\u8fd9\u610f\u5473\u7740\u4f60\u9762\u5bf9\u7684 C2 \u6d41\u91cf，\u7edd\u5927\u591a\u6570\u90fd\u662f\u53ef\u4ee5\u7279\u5f81\u5316\u3001\u53ef\u4ee5\u6307\u7eb9\u5316\u7684"\u6807\u51c6\u6b66\u5668"\u3002<\/p>\n

C2 \u5206\u6790\u7684\u5b9e\u6218\u4ef7\u503c\u4f53\u73b0\u5728\u4e09\u4e2a\u5c42\u9762：\u9632\u5fa1（\u5728\u8fb9\u754c\u963b\u65ad\u5916\u8054）\u3001\u68c0\u6d4b（\u5728\u6d41\u91cf\u4e2d\u8bc6\u522b\u5fc3\u8df3）\u3001\u6eaf\u6e90（\u901a\u8fc7\u57fa\u7840\u8bbe\u65bd\u5173\u8054\u653b\u51fb\u7ec4\u7ec7）\u3002\u672c\u7bc7\u535a\u5ba2\u6309"\u8bc6\u522b\u5fc3\u8df3 \u2192 \u8fd8\u539f\u534f\u8bae \u2192 \u9884\u6d4b DGA \u2192 \u5bf9\u6297\u9ad8\u7ea7\u9690\u853d"\u7684\u4e3b\u7ebf\u5c55\u5f00，\u4f9d\u6b21\u8986\u76d6 C2 \u534f\u8bae\u539f\u7406\u4e0e\u9759\u9ed8\u7279\u5f81\u3001Beacon \u5fc3\u8df3\u884c\u4e3a\u68c0\u6d4b\u3001DGA \u57df\u540d\u751f\u6210\u7b97\u6cd5\u4e0e\u9884\u6d4b\u3001\u57df\u524d\u7f6e\/DoH\/\u4e91\u5b58\u50a8 C2 \u7b49\u65b0\u578b\u901a\u9053\u3001\u4ee5\u53ca\u5b8c\u6574 SOC \u68c0\u6d4b\u4f53\u7cfb\u3002\u76ee\u6807\u662f\u8ba9\u8bfb\u8005\u8bfb\u5b8c\u4e4b\u540e，\u80fd\u9762\u5bf9\u4e00\u4efd Zeek \u65e5\u5fd7\u6216\u4e00\u5f20 pcap，\u5728 30 \u5206\u949f\u5185\u5b8c\u6210"C2 \u5b9a\u6027\u3001\u5bb6\u65cf\u6307\u7eb9\u3001\u57df\u540d\u9884\u6d4b"\u4e09\u4ef6\u4e8b\u3002<\/p>\n

\u7b2c\u4e00\u7ae0：C2 \u901a\u4fe1\u7684\u672c\u8d28\u2014\u2014"\u5408\u7fa4"\u6bd4"\u9690\u853d"\u66f4\u91cd\u8981<\/h3>\n

1.1 C2 \u901a\u4fe1\u7684\u5e95\u5c42\u9700\u6c42<\/h4>\n

\u4e00\u4e2a\u690d\u5165\u4f53（Beacon\u3001Implant\u3001Agent）\u4e0e C2 \u670d\u52a1\u5668\u4e4b\u95f4\u7684\u901a\u4fe1，\u9700\u8981\u540c\u65f6\u6ee1\u8db3\u56db\u4e2a\u770b\u4f3c\u77db\u76fe\u7684\u9700\u6c42：<\/p>\n\n\u9700\u6c42\u542b\u4e49\u653b\u51fb\u8005\u7684\u5b9e\u73b0\u65b9\u5f0f<\/tr>\n\n\n\n\n\n\n
\u53ef\u8fbe\u6027<\/td>\n\u5fc5\u987b\u80fd\u7a7f\u900f\u76ee\u6807\u7f51\u7edc\u7684\u51fa\u7ad9\u7b56\u7565<\/td>\n\u4f2a\u88c5\u6210 443 \u7aef\u53e3 HTTPS\u3001DNS 53 \u7aef\u53e3\u3001\u90ae\u4ef6\u7aef\u53e3 25<\/td>\n<\/tr>\n
\u9690\u853d\u6027<\/td>\n\u5fc5\u987b\u6df7\u5165\u6d77\u91cf\u6b63\u5e38\u6d41\u91cf<\/td>\n\u52a0\u5bc6（TLS）\u3001\u4f2a\u88c5（Host \u5934\u4f2a\u9020）\u3001\u4f4e\u9891（\u957f Sleep）<\/td>\n<\/tr>\n
\u53ef\u63a7\u6027<\/td>\n\u5fc5\u987b\u80fd\u63a5\u6536\u6307\u4ee4\u3001\u56de\u4f20\u6570\u636e<\/td>\n\u8bf7\u6c42\u4f53\/\u54cd\u5e94\u4f53\u643a\u5e26\u6307\u4ee4\u6570\u636e\u3001Cookie \u643a\u5e26\u5143\u6570\u636e<\/td>\n<\/tr>\n
\u9c81\u68d2\u6027<\/td>\n\u5fc5\u987b\u80fd\u5e94\u5bf9 C2 \u88ab\u5c01\u7981<\/td>\n\u591a C2 \u5907\u7528\u3001DGA\u3001CDN \u524d\u7f6e<\/td>\n<\/tr>\n
\u6838\u5fc3\u8ba4\u77e5：C2 \u6d41\u91cf\u5728\u6280\u672f\u4e0a\u548c\u6b63\u5e38 HTTPS \u6ca1\u6709\u4efb\u4f55\u672c\u8d28\u533a\u522b\u3002\u540c\u6837\u662f TCP 443 \u7aef\u53e3\u3001\u540c\u6837\u7684 TLS \u63e1\u624b\u3001\u540c\u6837\u53ef\u80fd\u4f7f\u7528\u6709\u6548\u8bc1\u4e66\u2014\u2014\u533a\u522b\u4e0d\u5728\u4e8e"\u534f\u8bae"，\u800c\u5728\u4e8e"\u884c\u4e3a\u6a21\u5f0f"\u3002\u8fd9\u5c31\u662f\u4e3a\u4ec0\u4e48 C2 \u68c0\u6d4b\u672c\u8d28\u662f\u4e00\u95e8"\u884c\u4e3a\u5206\u6790\u5b66"，\u800c\u4e0d\u662f"\u7279\u5f81\u5339\u914d\u5b66"\u3002<\/td>\n<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

1.2 \u4e3b\u6d41 C2 \u6846\u67b6\u7684"\u6307\u7eb9"\u4e0e"\u53cd\u6307\u7eb9"<\/h4>\n

\u7406\u89e3\u4e3b\u6d41 C2 \u6846\u67b6\u7684\u884c\u4e3a\u7279\u5f81，\u662f C2 \u5206\u6790\u7684\u7b2c\u4e00\u8bfe\u3002\u4e0b\u8868\u6c47\u603b\u5f53\u524d\u6700\u5e38\u89c1\u7684\u6846\u67b6\u53ca\u5176\u9ed8\u8ba4\u6307\u7eb9：<\/p>\n\n\u6846\u67b6\u9ed8\u8ba4\u534f\u8bae\u9ed8\u8ba4\u8bc1\u4e66\/\u6307\u7eb9\u5173\u952e\u7279\u5f81\u68c0\u6d4b\u96be\u5ea6<\/tr>\n\n\n\n\n\n\n\n\n\n\n
Cobalt Strike<\/td>\nHTTP\/HTTPS\/DNS<\/td>\n\u81ea\u7b7e\u540d\u8bc1\u4e66：C=Earth\u3001OU=…\u3001CN=Major Cobalt Strike（\u65e0\u6548\u56fd\u5bb6\u4ee3\u7801）；Java TLS \u6808（JSSE）\u4ea7\u751f\u7279\u5f81 JA3S<\/td>\n2018 \u5e74\u524d\u54cd\u5e94\u4f53\u6709\u7279\u6b8a\u7a7a\u683c（Fox-IT \u53d1\u73b0）<\/td>\n\u4f4e（\u672a\u6539\u914d\u7f6e）\/\u9ad8（Malleable \u5b9a\u5236\u540e）<\/td>\n<\/tr>\n
Sliver<\/td>\nHTTP\/HTTPS<\/td>\nGo \u8bed\u8a00\u7684 crypto\/tls \u5e93\u4ea7\u751f\u72ec\u7279 JA3（\u4e0e\u6d4f\u89c8\u5668\u4e0d\u540c）<\/td>\n\u9ed8\u8ba4 certificate \u7279\u5f81\u3001Cloudflare tunnel \u4e2d\u8f6c\u5e38\u89c1<\/td>\n\u4e2d（Go \u6307\u7eb9\u53ef\u8bc6\u522b）<\/td>\n<\/tr>\n
Metasploit<\/td>\nReverse TCP\/HTTP<\/td>\nMeterpreter \u9ed8\u8ba4\u8bc1\u4e66<\/td>\nreverse_tcp \u7aef\u53e3\u5e38\u89c1 4444<\/td>\n\u4f4e（\u9ed8\u8ba4）<\/td>\n<\/tr>\n
Empire \/ Starkiller<\/td>\nHTTP\/HTTPS<\/td>\nPowerShell \u901a\u4fe1\u7279\u5f81<\/td>\n\u7279\u5b9a URI \u8def\u5f84\u6a21\u5f0f<\/td>\n\u4e2d<\/td>\n<\/tr>\n
Mythic<\/td>\n\u591a\u534f\u8bae\u53ef\u5b9a\u5236<\/td>\n\u9ed8\u8ba4 Apollo agent<\/td>\n\u5b9a\u5236\u5ea6\u9ad8<\/td>\n\u9ad8<\/td>\n<\/tr>\n
Havoc \/ Brute Ratel<\/td>\nHTTPS<\/td>\n\u81ea\u5b9a\u4e49\u6307\u7eb9，\u6587\u6863\u5316\u8f83\u5168<\/td>\n\u9ed8\u8ba4\u914d\u7f6e\u53ef\u68c0\u6d4b<\/td>\n\u4e2d<\/td>\n<\/tr>\n
Pupy \/ Merlin<\/td>\nTCP\/HTTP<\/td>\nPython\/Go \u901a\u4fe1<\/td>\n\u7279\u5b9a UA<\/td>\n\u4e2d<\/td>\n<\/tr>\n
Cobalt Strike \u662f"\u4e8b\u5b9e\u6807\u51c6"\u3002\u636e DFIR Report \u7684\u7edf\u8ba1，\u7edd\u5927\u591a\u6570\u52d2\u7d22\u8f6f\u4ef6\u5165\u4fb5\u4e8b\u4ef6\u90fd\u4ee5 Cobalt Strike \u4f5c\u4e3a C2\u2014\u2014\u8fd9\u610f\u5473\u7740\u7814\u7a76 Cobalt Strike \u7684\u68c0\u6d4b\u89c4\u5219，\u53ef\u4ee5\u8986\u76d6\u4e00\u534a\u4ee5\u4e0a\u7684\u771f\u5b9e\u5165\u4fb5\u6d41\u91cf\u3002<\/td>\n<\/td>\n<\/td>\n<\/td>\n<\/td>\n<\/tr>\n
Malleable C2 Profile \u7684\u5f3a\u5927\u4e4b\u5904\u5728\u4e8e\u5b83\u8ba9 Cobalt Strike \u53ef\u4ee5\u4f2a\u88c5\u6210\u4efb\u4f55\u6b63\u5e38\u6d41\u91cf：<\/td>\n<\/td>\n<\/td>\n<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

# \u4e00\u4e2a\u4f2a\u88c5 jQuery \u8bf7\u6c42\u7684 Malleable Profile \u7247\u6bb5
\nhttp-get {
\n set uri "\/jquery-3.3.1.min.js";
\n client {
\n header "Accept" "text\/html,application\/xhtml+xml,…";
\n header "Referer" "http:\/\/code.jquery.com\/";
\n metadata {
\n base64url;
\n prepend "__cfduid="; # Cookie \u524d\u7f00\u4f2a\u88c5 Cloudflare
\n header "Cookie";
\n }
\n }
\n server {
\n header "Server" "NetDNA-cache\/2.2"; # \u6a21\u62df CDN \u54cd\u5e94
\n header "Content-Type" "application\/javascript; charset=utf-8";
\n output {
\n mask;
\n base64url;
\n prepend "\/*! jQuery v3.3.1 | (c) JS Foundation *\/";
\n }
\n }
\n}<\/p>\n

\u8fd9\u5e26\u6765\u7684\u9632\u5fa1\u542b\u4e49：\u9759\u6001\u7279\u5f81\u4f1a\u5931\u6548\u2014\u2014\u653b\u51fb\u8005\u53ef\u4ee5\u628a UA\u3001URI\u3001Header \u5168\u90e8\u6539\u6210\u6b63\u5e38\u6d4f\u89c8\u5668\u7684\u6837\u5b50\u3002\u4f46\u6709\u4e9b\u4e1c\u897f\u6539\u4e0d\u6389：\u5fc3\u8df3\u7684\u65f6\u95f4\u89c4\u5f8b\u3001TLS \u534f\u8bae\u6808\u6307\u7eb9（Java vs OpenSSL）\u3001JA3 \u54c8\u5e0c\u3001ServerHello \u7684 JA3S \u503c\u3002\u8fd9\u5c31\u662f"\u884c\u4e3a\u6307\u7eb9"\u548c"\u534f\u8bae\u6307\u7eb9"\u68c0\u6d4b\u7684\u5fc5\u8981\u6027\u3002<\/p>\n

\u7b2c\u4e8c\u7ae0：Beacon \u5fc3\u8df3\u68c0\u6d4b\u2014\u2014\u4ece\u65f6\u95f4\u5e8f\u5217\u91cc\u8bfb\u51fa\u653b\u51fb\u8005<\/h3>\n

2.1 \u4ec0\u4e48\u662f"\u5fc3\u8df3"，\u4e3a\u4ec0\u4e48\u5b83\u5fc5\u7136\u5b58\u5728<\/h4>\n

Beacon（\u4fe1\u6807）\u662f\u690d\u5165\u4f53\u5b9a\u671f\u5411 C2 \u62a5\u5230\u3001\u83b7\u53d6\u6307\u4ee4\u7684\u884c\u4e3a\u3002\u5c31\u50cf\u7279\u5de5\u5b9a\u65f6\u5411\u603b\u90e8\u53d1\u5bc6\u62a5\u2014\u2014\u6ca1\u6709\u62a5\u5230，\u5c31\u6ca1\u6709\u63a7\u5236\u3002
\n\u4e3a\u4ec0\u4e48"\u5fc3\u8df3"\u5fc5\u7136\u5b58\u5728？\u56e0\u4e3a\u690d\u5165\u4f53\u5fc5\u987b\u77e5\u9053 C2 \u7684\u5b58\u5728，\u5fc5\u987b\u5b9a\u671f\u68c0\u67e5\u662f\u5426\u6709\u65b0\u6307\u4ee4\u3002\u653b\u51fb\u8005\u65e0\u6cd5\u6446\u8131\u8fd9\u4e2a\u5faa\u73af，\u53ea\u80fd\u8ba9\u5b83"\u770b\u8d77\u6765\u50cf\u6b63\u5e38"\u3002
\n\u5fc3\u8df3\u7684\u6570\u5b66\u7279\u5f81：<\/p>\n

ideal: t0, t0+60s, t0+120s, t0+180s, … (\u5b8c\u7f8e\u5468\u671f)
\nreal: t0, t0+58s, t0+125s, t0+181s, … (\u5e26 Jitter)<\/p>\n

**Jitter（\u6296\u52a8）**\u662f\u653b\u51fb\u8005\u4e3a\u5bf9\u6297\u7b80\u5355\u5468\u671f\u6027\u68c0\u6d4b\u5f15\u5165\u7684\u968f\u673a\u6027\u3002Cobalt Strike \u9ed8\u8ba4 jitter 0，\u53ef\u8bbe\u4e3a 0~99：<\/p>\n

actual_sleep = base_ms \u00b1 (base_ms * jitter_pct \/ 100)
\n# \u793a\u4f8b：60 \u79d2\u57fa\u51c6 + 25% jitter \u2192 \u5b9e\u9645\u95f4\u9694 45~75 \u79d2\u4e4b\u95f4\u968f\u673a<\/p>\n

\u5173\u952e\u6d1e\u5bdf：Jitter \u53ea\u80fd\u6270\u4e71"\u5b8c\u5168\u5468\u671f\u6027"\u68c0\u6d4b，\u65e0\u6cd5\u6270\u4e71"\u7edf\u8ba1\u89c4\u5f8b\u6027"\u68c0\u6d4b\u300260 \u79d2 \u00b1 25% \u7684\u95f4\u9694，\u4ecd\u7136\u662f\u56f4\u7ed5 60 \u79d2\u7684\u7a84\u5206\u5e03\u2014\u2014\u8fd9\u4e2a\u5206\u5e03\u7684"\u6807\u51c6\u5dee\/\u5747\u503c"（CV, Coefficient of Variation）\u4f1a\u5f88\u5c0f，\u800c\u6b63\u5e38\u6d41\u91cf\u662f\u957f\u5c3e\u5206\u5e03，CV \u5f88\u5927\u3002<\/p>\n

2.2 \u5fc3\u8df3\u68c0\u6d4b\u7684\u6838\u5fc3\u7b97\u6cd5：CV \u548c\u5e8f\u5217\u5206\u6790<\/h4>\n

CV（Coefficient of Variation，\u53d8\u5f02\u7cfb\u6570）= \u6807\u51c6\u5dee \/ \u5747\u503c
\n\u8fd9\u4e2a\u6570\u5b57\u662f\u5fc3\u8df3\u68c0\u6d4b\u6700\u6709\u6548\u7684\u5355\u4e00\u6307\u6807：<\/p>\n\nCV \u8303\u56f4\u5224\u8bfb<\/tr>\n\n\n\n\n\n\n\n\n
< 0.1<\/td>\n\u5f3a\u5fc3\u8df3\u5019\u9009，\u51e0\u4e4e\u80af\u5b9a<\/td>\n<\/tr>\n
0.1~0.2<\/td>\n\u5f3a\u5acc\u7591，\u4f18\u5148\u8c03\u67e5<\/td>\n<\/tr>\n
0.2~0.5<\/td>\n\u4e2d\u7b49\u5acc\u7591，\u9700\u7ed3\u5408\u5176\u4ed6\u6307\u6807<\/td>\n<\/tr>\n
> 0.5<\/td>\n\u901a\u5e38\u4e3a\u6b63\u5e38\u6d41\u91cf<\/td>\n<\/tr>\n
> 1.0<\/td>\n\u957f\u5c3e\u5206\u5e03，\u6b63\u5e38\u4e1a\u52a1\u7279\u5f81<\/td>\n<\/tr>\n
\u4e3a\u4ec0\u4e48 CV \u6709\u6548：\u6b63\u5e38\u6d4f\u89c8\u5668\u6d41\u91cf\u662f"\u7a81\u53d1\u5f0f"\u7684\u2014\u2014\u7528\u6237\u6253\u5f00\u9875\u9762，\u52a0\u8f7d\u51e0\u5341\u4e2a\u8d44\u6e90，\u7136\u540e\u957f\u65f6\u95f4\u4e0d\u52a8；\u518d\u6b21\u8bbf\u95ee\u53c8\u662f\u65b0\u4e00\u8f6e\u3002\u800c Beacon \u662f\u5b9a\u65f6\u5b9a\u70b9\u7684，\u5373\u4f7f\u5e26 jitter，\u95f4\u9694\u4e5f\u5728\u4e00\u4e2a\u7a84\u533a\u95f4\u3002<\/td>\n<\/td>\n<\/tr>\n
\u7528 Zeek + Python \u5b9e\u73b0 CV \u68c0\u6d4b：<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

import<\/span> pandas as<\/span> pd
\nimport<\/span> numpy as<\/span> np
\ndef<\/span> load_zeek<\/span>(<\/span>path)<\/span>:<\/span>
\n # \u8bfb\u53d6 Zeek conn.log<\/span>
\n cols =<\/span> None<\/span>
\n with<\/span> open<\/span>(<\/span>path)<\/span> as<\/span> f:<\/span>
\n for<\/span> line in<\/span> f:<\/span>
\n if<\/span> line.<\/span>startswith(<\/span>"#fields"<\/span>)<\/span>:<\/span>
\n cols =<\/span> line.<\/span>strip(<\/span>)<\/span>.<\/span>split(<\/span>"\\\\t"<\/span>)<\/span>[<\/span>1<\/span>:<\/span>]<\/span>
\n break<\/span>
\n df =<\/span> pd.<\/span>read_csv(<\/span>path,<\/span> sep=<\/span>"\\\\t"<\/span>,<\/span> comment=<\/span>"#"<\/span>,<\/span> names=<\/span>cols)<\/span>
\n return<\/span> df
\nconn =<\/span> load_zeek(<\/span>"conn.log"<\/span>)<\/span>
\nconn[<\/span>"ts"<\/span>]<\/span> =<\/span> conn[<\/span>"ts"<\/span>]<\/span>.<\/span>astype(<\/span>float<\/span>)<\/span>
\ndef<\/span> beacon_stats<\/span>(<\/span>group)<\/span>:<\/span>
\n ts =<\/span> np.<\/span>sort(<\/span>group[<\/span>"ts"<\/span>]<\/span>.<\/span>values)<\/span>
\n if<\/span> len<\/span>(<\/span>ts)<\/span> <<\/span> 10<\/span>:<\/span> return<\/span> None<\/span>
\n gaps =<\/span> np.<\/span>diff(<\/span>ts)<\/span>
\n if<\/span> gaps.<\/span>mean(<\/span>)<\/span> ==<\/span> 0<\/span>:<\/span> return<\/span> None<\/span>
\n cv =<\/span> gaps.<\/span>std(<\/span>)<\/span> \/<\/span> gaps.<\/span>mean(<\/span>)<\/span>
\n return<\/span> pd.<\/span>Series(<\/span>{<\/span>
\n "count"<\/span>:<\/span> len<\/span>(<\/span>ts)<\/span>,<\/span>
\n "mean_interval"<\/span>:<\/span> gaps.<\/span>mean(<\/span>)<\/span>,<\/span>
\n "cv"<\/span>:<\/span> cv,<\/span>
\n "min"<\/span>:<\/span> gaps.<\/span>min<\/span>(<\/span>)<\/span>,<\/span>
\n "max"<\/span>:<\/span> gaps.<\/span>max<\/span>(<\/span>)<\/span>
\n }<\/span>)<\/span>
\n# \u6309 (\u6e90IP, \u76ee\u7684IP, \u76ee\u7684\u7aef\u53e3) \u5206\u7ec4<\/span>
\nresults =<\/span> (<\/span>conn.<\/span>groupby(<\/span>[<\/span>"id.orig_h"<\/span>,<\/span> "id.resp_h"<\/span>,<\/span> "id.resp_p"<\/span>]<\/span>)<\/span>
\n .<\/span>apply<\/span>(<\/span>beacon_stats)<\/span>
\n .<\/span>dropna(<\/span>)<\/span>
\n .<\/span>sort_values(<\/span>"cv"<\/span>)<\/span>)<\/span>
\n# CV < 0.2 \u4e14\u8fde\u63a5\u6570 > 50 \u2192 \u5f3a\u5fc3\u8df3\u5019\u9009<\/span>
\nsuspects =<\/span> results[<\/span>(<\/span>results[<\/span>"cv"<\/span>]<\/span> <<\/span> 0.2<\/span>)<\/span> &<\/span> (<\/span>results[<\/span>"count"<\/span>]<\/span> ><\/span> 50<\/span>)<\/span>]<\/span>
\nprint<\/span>(<\/span>suspects)<\/span><\/p>\n

\u5b9e\u6218\u9608\u503c（RITA \u548c AC-Hunter \u7684\u7ecf\u9a8c）：<\/p>\n

    \n
  • count \u2265 50（\u81f3\u5c11 50 \u6b21\u8fde\u63a5，\u907f\u514d\u5c0f\u6837\u672c\u8bef\u5dee）<\/li>\n
  • mean_interval \u5728 30 \u79d2\u5230 24 \u5c0f\u65f6\u4e4b\u95f4（\u6b63\u5e38\u4e1a\u52a1\u4e0d\u4f1a\u5728 1 \u79d2\u5185\u591a\u6b21\u8fde\u63a5\u540c\u4e00\u76ee\u6807）<\/li>\n
  • CV < 0.2（\u5f3a\u5fc3\u8df3\u4fe1\u53f7）<\/li>\n
  • RITA \u7684 beacon score > 0.8（RITA \u8f93\u51fa 0~1 \u5206\u6570，0.8 \u4ee5\u4e0a\u4f18\u5148\u8c03\u67e5）<\/li>\n<\/ul>\n

    2.3 RITA：\u4ece\u547d\u4ee4\u884c\u5feb\u901f\u72e9\u730e<\/h4>\n

    **RITA（Real Intelligence Threat Analytics）**\u662f Active Countermeasures \u5f00\u6e90\u7684\u884c\u4e3a\u5206\u6790\u6846\u67b6，\u8f93\u5165 Zeek \u65e5\u5fd7，\u81ea\u52a8\u8f93\u51fa\u5fc3\u8df3\u3001DNS \u96a7\u9053\u3001\u9ed1\u540d\u5355\u547d\u4e2d\u7ed3\u679c\u3002<\/p>\n

    # \u5b89\u88c5 RITA（Ubuntu\/Debian）<\/span>
    \nsudo<\/span> .\/install.sh
    \n# \u5bfc\u5165 Zeek \u65e5\u5fd7<\/span>
    \nrita import<\/span> \/path\/to\/zeek\/logs my_dataset
    \n# \u663e\u793a\u5fc3\u8df3（\u6838\u5fc3\u547d\u4ee4）<\/span>
    \nrita show-beacons my_dataset
    \n# \u8f93\u51fa\u5217：Score（\u5fc3\u8df3\u5206 0~1）\u3001Source\u3001Destination\u3001Count\u3001Avg Interval\u3001Top Level Domain<\/span>
    \n# \u663e\u793a\u957f\u8fde\u63a5（\u6f5c\u5728\u7684\u4ea4\u4e92\u5f0f shell）<\/span>
    \nrita show-long-connections my_dataset
    \n# DNS \u96a7\u9053\u68c0\u6d4b<\/span>
    \nrita show-dns-hijack my_dataset
    \n# \u9ed1\u540d\u5355\u5339\u914d<\/span>
    \nrita show-blacklisted my_dataset<\/p>\n

    RITA \u7684\u5b9e\u6218\u4ef7\u503c：\u4e00\u6761\u547d\u4ee4\u5c31\u80fd\u4ece\u6570\u5341 GB \u65e5\u5fd7\u91cc\u635e\u51fa\u6700\u53ef\u7591\u7684 5~10 \u6761\u8fde\u63a5，\u8fd9\u8ba9 SOC \u5206\u6790\u5e08\u4ece"\u5927\u6d77\u635e\u9488"\u53d8\u6210"\u987a\u85e4\u6478\u74dc"\u3002<\/p>\n

    2.4 Beacon \u68c0\u6d4b\u7684\u8fdb\u9636\u4fe1\u53f7：\u4e0d\u53ea\u6709"\u65f6\u95f4"<\/h4>\n

    \u65f6\u95f4\u5e8f\u5217\u662f\u5fc3\u8df3\u68c0\u6d4b\u7684\u6838\u5fc3，\u4f46\u4e0d\u662f\u552f\u4e00\u3002\u591a\u4e2a\u5f31\u4fe1\u53f7\u53e0\u52a0，\u6bd4\u5355\u4e2a\u5f3a\u4fe1\u53f7\u66f4\u53ef\u9760：
    \n\u4fe1\u53f7 1：\u8bf7\u6c42\/\u54cd\u5e94\u5927\u5c0f\u5f02\u5e38\u7a33\u5b9a\u3002Beacon \u7684\u6bcf\u6b21"\u62c9\u4efb\u52a1"\u5f80\u8fd4\u7684\u6570\u636e\u91cf\u5f88\u7a33\u5b9a（\u6bd4\u5982 orig_bytes=350, resp_bytes=1200），\u56e0\u4e3a\u6307\u4ee4\u5305\u901a\u5e38\u56fa\u5b9a\u957f\u5ea6；\u6b63\u5e38\u4e1a\u52a1\u6d41\u91cf\u7684\u5b57\u8282\u5206\u5e03\u662f\u957f\u5c3e\u7684\u3002
    \n\u4fe1\u53f7 2：URI \u8def\u5f84\u6a21\u5f0f\u3002Cobalt Strike \u9ed8\u8ba4 URI \u5f62\u5982 \/<random-4-chars>\/<random-8-chars>.js（\u5e26\u4e00\u4e2a \/），\u5373\u4f7f\u662f Malleable Profile，URI \u7ed3\u6784\u4e5f\u4fdd\u6301\u56fa\u5b9a\u6a21\u677f\u2014\u2014\u7528\u6b63\u5219\u5339\u914d\u53ef\u8bc6\u522b：<\/p>\n

    # CS \u9ed8\u8ba4 URI \u6a21\u5f0f
    \n\/[\\\\w]{4}\/[\\\\w]{8}.js
    \n# CS Malleable jQuery Profile
    \n\/jquery-[\\\\d.]+\\\\.min\\\\.js
    \n# Sliver \u5e38\u89c1
    \n\/api\/[\\\\w]+<\/p>\n

    \u4fe1\u53f7 3：User-Agent \u5f02\u5e38\u3002Cobalt Strike \u9ed8\u8ba4 UA \u5305\u542b Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 5.1)\u2014\u2014\u8fd9\u4e2a UA \u5728 2026 \u5e74\u51e0\u4e4e\u7edd\u8ff9\u4e8e\u5408\u6cd5\u4e1a\u52a1\u3002Malleable Profile \u53ef\u4ee5\u6539\u6210\u4efb\u610f UA，\u4f46\u653b\u51fb\u8005\u901a\u5e38\u61d2\u5f97\u6539\u3002
    \n\u4fe1\u53f7 4：JA3\/JA3S \u6307\u7eb9\u3002TLS ClientHello \u7684\u54c8\u5e0c\u503c\u3002\u4e0d\u540c TLS \u5e93\u7684 JA3 \u4e0d\u540c：<\/p>\n

    # Cobalt Strike ServerHello（Java JSSE）
    \nJA3S: b27cb1a1f5dbfeec79be89360b0c6a91 # \u7279\u5f81\u503c
    \n# Sliver（Go crypto\/tls）
    \nJA3: \u4e0e\u6d4f\u89c8\u5668\u663e\u8457\u4e0d\u540c
    \n# Chrome \/ Firefox
    \nJA3: \u4e0e\u6240\u6709 C2 \u6846\u67b6\u4e0d\u540c<\/p>\n

    \u90e8\u7f72\u65b9\u5f0f：\u5728 Zeek \u7684 ssl.log \u4e2d\u63d0\u53d6 JA3\/JA3S，\u4e0e\u5df2\u77e5\u6307\u7eb9\u5e93（\u5982 ja3er.com\u3001\u516c\u53f8\u5185\u90e8\u5e93）\u6bd4\u5bf9，JA3S \u5339\u914d Cobalt Strike \u6307\u7eb9\u7684\u8fde\u63a5，\u7f6e\u4fe1\u5ea6\u6781\u9ad8\u3002
    \n\u4fe1\u53f7 5：HTTP \u54cd\u5e94\u5934\u5f02\u5e38\u3002Cobalt Strike \u9ed8\u8ba4 server header \u662f Apache \u4f46\u7f3a\u5c11 Date\u3001Content-Length \u7b49\u5e38\u89c1\u5b57\u6bb5\u2014\u2014\u53ef\u4ee5\u7528 curl -I \u5bf9\u5916\u63a2\u6d4b C2 \u670d\u52a1\u5668\u7684\u6307\u7eb9\u3002<\/p>\n

    2.5 \u4e00\u6761\u5b9e\u6218Sigma\u89c4\u5219：\u68c0\u6d4b Cobalt Strike \u9ed8\u8ba4\u5fc3\u8df3<\/h4>\n

    title<\/span>:<\/span> Cobalt Strike Beacon Default Heartbeat
    \nid<\/span>:<\/span> c0b1d1e2–<\/span>3f4a–<\/span>5b6c–<\/span>7d8e–<\/span>9f0a1b2c3d4e
    \nstatus<\/span>:<\/span> experimental
    \ndescription<\/span>:<\/span> \u68c0\u6d4b Cobalt Strike \u9ed8\u8ba4\u7684 Beacon HTTP C2 \u884c\u4e3a
    \nauthor<\/span>:<\/span> your_name
    \ndate<\/span>:<\/span> 2026\/09\/03
    \nreferences<\/span>:<\/span>
    \n –<\/span> https:<\/span>\/\/thedfirreport.com\/2022\/01\/24\/cobalt–<\/span>strike–<\/span>a–<\/span>defenders–<\/span>guide–<\/span>part–<\/span>2<\/span>
    \nlogsource<\/span>:<\/span>
    \n category<\/span>:<\/span> proxy
    \ndetection<\/span>:<\/span>
    \n selection_ua<\/span>:<\/span>
    \n c-useragent<\/span>:<\/span>
    \n –<\/span> 'Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 5.1)'<\/span>
    \n –<\/span> 'Mozilla\/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident\/5.0)'<\/span>
    \n selection_uri<\/span>:<\/span>
    \n c-uri|re<\/span>:<\/span> '\/[a-zA-Z0-9]{4}\/[a-zA-Z0-9]{8}\\\\.js'<\/span>
    \n selection_post<\/span>:<\/span>
    \n c-method<\/span>:<\/span> 'POST'<\/span>
    \n c-uri|contains<\/span>:<\/span> '\/submit.php'<\/span>
    \n condition<\/span>:<\/span> 1 of selection_*
    \nfalsepositives<\/span>:<\/span>
    \n –<\/span> \u6781\u5c11，\u9700\u8981\u7ed3\u5408\u6e90 IP \u767d\u540d\u5355
    \nlevel<\/span>:<\/span> high
    \ntags<\/span>:<\/span>
    \n –<\/span> attack.command_and_control
    \n –<\/span> attack.t1071.001
    \n –<\/span> attack.s0154<\/p>\n

    \u7b2c\u4e09\u7ae0：DGA \u57df\u540d\u751f\u6210\u7b97\u6cd5\u2014\u2014\u201c\u653b\u51fb\u8005\u7684\u57df\u540d\u6c60\u201d<\/h3>\n

    3.1 \u4e3a\u4ec0\u4e48\u9700\u8981 DGA<\/h4>\n

    \u786c\u7f16\u7801 C2 \u57df\u540d\u7684\u95ee\u9898：\u4e00\u65e6\u88ab\u5a01\u80c1\u60c5\u62a5\u6536\u5f55\u5e76\u8fdb\u5165\u9ed1\u540d\u5355，\u6574\u4e2a\u50f5\u5c38\u7f51\u7edc\u5c31\u65ad\u94fe\u4e86\u3002
    \nDGA \u7684\u89e3\u6cd5：\u8ba9\u690d\u5165\u4f53\u5728\u8fd0\u884c\u65f6"\u81ea\u5df1\u7b97\u51fa"\u4eca\u5929\u7684 C2 \u57df\u540d\u2014\u2014\u653b\u51fb\u8005\u53ea\u9700\u8981\u63d0\u524d\u77e5\u9053\u7b97\u6cd5\u548c\u79cd\u5b50，\u5c31\u80fd\u9884\u6d4b\u6bcf\u5929\/\u6bcf\u5c0f\u65f6\u7684\u57df\u540d，\u53ea\u6ce8\u518c\u5176\u4e2d\u5c11\u6570\u51e0\u4e2a\u4f5c\u4e3a C2，\u5176\u4f59\u7684\u4efb\u7531\u690d\u5165\u4f53\u89e3\u6790\u5931\u8d25（NXDOMAIN）\u3002
    \n\u653b\u51fb\u8005\u7684\u6210\u672c：\u6ce8\u518c 5~10 \u4e2a\u57df\u540d\/\u5929，\u6bcf\u4e2a $1~$10，\u6bcf\u5929\u51e0\u5341\u5230\u51e0\u767e\u7f8e\u5143；
    \n\u9632\u5fa1\u8005\u7684\u6210\u672c：\u8981\u4e48\u5c01\u7981\u9ed1\u540d\u5355（\u6c38\u8fdc\u6ede\u540e），\u8981\u4e48\u9884\u6d4b DGA（\u9700\u8981\u9006\u5411\u7b97\u6cd5），\u8981\u4e48\u7528\u673a\u5668\u5b66\u4e60\u8bc6\u522b"\u7b97\u6cd5\u751f\u6210\u611f"\u3002
    \n\u8fd9\u5c31\u662f DGA \u7684"\u653b\u9632\u4e0d\u5bf9\u79f0"\u3002<\/p>\n

    3.2 DGA \u7684\u4e09\u5927\u5206\u7c7b<\/h4>\n

    \u6309\u57df\u540d\u5f62\u6001\u548c\u79cd\u5b50\u6765\u6e90\u4e24\u4e2a\u7ef4\u5ea6\u5206\u7c7b：
    \n\u6309\u57df\u540d\u5f62\u6001：<\/p>\n\n\u7c7b\u578b\u7279\u5f81\u4f8b\u5b50\u68c0\u6d4b\u96be\u5ea6<\/tr>\n\n\n\n\n\n\n\n\n\n\n\n
    \u5b57\u7b26\u578b<\/td>\n\u968f\u673a\u5b57\u6bcd\u6570\u5b57\u62fc\u63a5，\u65e0\u53ef\u8bfb\u6027<\/td>\nxqqjqfytpqiyolo.biz<\/td>\n\u4f4e（\u9ad8\u71b5\u8bc6\u522b）<\/td>\n<\/tr>\n
    \u5b57\u5178\u578b<\/td>\n\u4e24\u4e2a\u82f1\u6587\u5355\u8bcd\u62fc\u63a5<\/td>\nrealrays.kr\u3001telecommunications-pharmaceuticals.name<\/td>\n\u9ad8（\u50cf\u6b63\u5e38\u57df\u540d）<\/td>\n<\/tr>\n
    \u6df7\u5408\u578b<\/td>\n\u5355\u8bcd+\u6570\u5b57+\u7279\u6b8a\u5b57\u7b26<\/td>\nexchangework202102.xyz<\/td>\n\u4e2d<\/td>\n<\/tr>\n
    \u6309\u79cd\u5b50\u6765\u6e90：<\/td>\n<\/td>\n<\/td>\n<\/td>\n<\/tr>\n
    \u7c7b\u578b<\/td>\n\u79cd\u5b50<\/td>\n\u4f8b\u5b50<\/td>\n\u53ef\u9884\u6d4b\u6027<\/td>\n<\/tr>\n
    :-:<\/td>\n:-:<\/td>\n:-:<\/td>\n:-:<\/td>\n<\/tr>\n
    TID（\u65f6\u95f4\u65e0\u5173\u786e\u5b9a\u6027）<\/td>\n\u56fa\u5b9a\u5e38\u6570<\/td>\nConficker（\u65e9\u671f\u7248\u672c）<\/td>\n\u5b8c\u5168\u53ef\u9884\u6d4b<\/td>\n<\/tr>\n
    TDD（\u65f6\u95f4\u4f9d\u8d56\u786e\u5b9a\u6027）<\/td>\n\u5e74\u6708\u65e5<\/td>\nKraken\u3001Zeus\u3001Banjori<\/td>\n\u53ef\u9884\u6d4b（\u53ea\u9700\u77e5\u9053\u65e5\u671f）<\/td>\n<\/tr>\n
    TDN（\u65f6\u95f4\u4f9d\u8d56\u975e\u786e\u5b9a\u6027）<\/td>\n\u65f6\u95f4 + \u5916\u90e8\u6570\u636e<\/td>\nOrchard（\u7528\u6bd4\u7279\u5e01\u4ea4\u6613\u4fe1\u606f）<\/td>\n\u51e0\u4e4e\u4e0d\u53ef\u9884\u6d4b<\/td>\n<\/tr>\n
    \u6700\u65b0\u7684\u5bf9\u6297\u5347\u7ea7：Orchard \u5bb6\u65cf 2023 \u5e74\u4f7f\u7528\u6bd4\u7279\u5e01\u4e2d\u672c\u806a\u8d26\u6237\u7684\u4ea4\u6613\u4fe1\u606f\u4f5c\u4e3a DGA \u79cd\u5b50\u2014\u2014\u56e0\u4e3a\u6bd4\u7279\u5e01\u4ea4\u6613\u5185\u5bb9\u4e0d\u53ef\u9884\u6d4b，\u9632\u5fa1\u8005\u5373\u4f7f\u62ff\u5230\u7b97\u6cd5\u4e5f\u65e0\u6cd5\u63d0\u524d\u7b97\u51fa\u57df\u540d\u3002\u8fd9\u662f DGA \u6f14\u8fdb\u7684\u6700\u65b0\u65b9\u5411\u3002<\/td>\n<\/td>\n<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    3.3 DGA \u7b97\u6cd5\u9006\u5411：\u4ee5 CopperStealer \u4e3a\u4f8b<\/h4>\n

    \u4e00\u4e2a\u771f\u5b9e\u7684 DGA \u9006\u5411\u6848\u4f8b\u2014\u2014Proofpoint 2021 \u5e74\u62ab\u9732\u7684 CopperStealer \u5bb6\u65cf：
    \n\u7b97\u6cd5：MD5(seed + YYYYMMDD)，\u53d6\u4e2d\u95f4 16 \u5b57\u7b26\u4f5c\u4e3a\u4e8c\u7ea7\u57df\u540d\u3002
    \nPython \u5b9e\u73b0：<\/p>\n

    import<\/span> hashlib
    \nfrom<\/span> datetime import<\/span> date
    \ndef<\/span> copperstealer_dga<\/span>(<\/span>seed:<\/span> str<\/span>,<\/span> day:<\/span> date)<\/span> –<\/span>><\/span> list<\/span>:<\/span>
    \n """CopperStealer DGA \u590d\u73b0"""<\/span>
    \n domains =<\/span> [<\/span>]<\/span>
    \n date_str =<\/span> day.<\/span>strftime(<\/span>"%Y%m%d"<\/span>)<\/span>
    \n # \u591a\u4e2a\u79cd\u5b50\u5728\u5386\u53f2\u7248\u672c\u4e2d\u4f7f\u7528<\/span>
    \n for<\/span> s in<\/span> [<\/span>seed]<\/span>:<\/span>
    \n concat =<\/span> f"<\/span>{<\/span>s}<\/span><\/span>{<\/span>date_str}<\/span><\/span>"<\/span><\/span>
    \n md5 =<\/span> hashlib.<\/span>md5(<\/span>concat.<\/span>encode(<\/span>)<\/span>)<\/span>.<\/span>hexdigest(<\/span>)<\/span>
    \n # \u53d6\u4e2d\u95f4 16 \u5b57\u7b26<\/span>
    \n domain_2ld =<\/span> md5[<\/span>8<\/span>:<\/span>24<\/span>]<\/span> # 32 \u4f4d MD5 \u7684\u7b2c 9~24 \u4f4d<\/span>
    \n # \u62fc\u63a5 TLD（.xyz\u3001.com\u3001.top \u7b49）<\/span>
    \n for<\/span> tld in<\/span> [<\/span>".xyz"<\/span>,<\/span> ".com"<\/span>,<\/span> ".top"<\/span>,<\/span> ".info"<\/span>]<\/span>:<\/span>
    \n domains.<\/span>append(<\/span>domain_2ld +<\/span> tld)<\/span>
    \n return<\/span> domains
    \n# \u9a8c\u8bc1：Proofpoint \u62a5\u544a\u4e2d\u7684 2021-02-10 + seed "exchangework"<\/span>
    \nresult =<\/span> copperstealer_dga(<\/span>"exchangework"<\/span>,<\/span> date(<\/span>2021<\/span>,<\/span> 2<\/span>,<\/span> 10<\/span>)<\/span>)<\/span>
    \n# \u5e94\u8f93\u51fa "1cd81defbab5fc17.xyz" \u7b49<\/span><\/p>\n

    \u9006\u5411\u6d41\u7a0b：<\/p>\n

  • \u6293\u6837\u672c：\u4ece MalwareBazaar \u4e0b\u8f7d\u6837\u672c，\u9759\u6001\u5206\u6790\u627e\u786c\u7f16\u7801\u79cd\u5b50；<\/li>\n
  • \u8bc6\u522b\u7b97\u6cd5：\u5728 Ghidra \u4e2d\u5b9a\u4f4d MD5 \/ RtlRandomEx \/ LCG \u7b49\u52a0\u5bc6\u51fd\u6570；<\/li>\n
  • \u63d0\u53d6\u79cd\u5b50：\u901a\u8fc7 x64dbg \u5728 CryptAcquireContext \u6216 MD5Init \u65ad\u70b9\u67e5\u770b\u53c2\u6570；<\/li>\n
  • Python \u590d\u73b0：\u628a\u7b97\u6cd5\u7ffb\u8bd1\u6210 Python，\u9a8c\u8bc1\u80fd\u5426\u751f\u6210\u540c\u4e00\u5929\u7684\u771f\u5b9e\u57df\u540d（\u901a\u8fc7 VT \u6216 PDNS \u6bd4\u5bf9）；<\/li>\n
  • \u6ce8\u518c\u9884\u6d4b：\u9632\u5fa1\u8005\u9884\u6d4b\u51fa\u57df\u540d\u5217\u8868\u540e，\u53ef\u4ee5：a) \u63d0\u524d\u9632\u5fa1\u6027\u6ce8\u518c（\u62a2\u6ce8）；b) \u63d0\u524d\u5728 DNS Sinkhole \u62e6\u622a；c) \u63d0\u4ea4\u7ed9\u5a01\u80c1\u60c5\u62a5\u5e73\u53f0\u3002
    \n\u56fd\u5185\u8d44\u6e90：360 NetLab \u7ef4\u62a4\u5f00\u6e90 DGA \u7b97\u6cd5\u548c\u60c5\u62a5\u5e93，\u516c\u5f00\u5206\u4eab\u4e86\u4e0a\u767e\u4e2a\u5bb6\u65cf\u7684 DGA \u5b9e\u73b0，\u56fd\u5185 SOC \u5206\u6790\u5e08\u4f18\u5148\u53c2\u8003\u3002<\/li>\n

    3.4 DGA \u57df\u540d\u7684\u68c0\u6d4b\u65b9\u6cd5<\/h4>\n

    \u4e0d\u4f9d\u8d56\u9006\u5411，\u4ece\u7edf\u8ba1\u7279\u5f81\u5c31\u80fd\u8bc6\u522b DGA：
    \n\u65b9\u6cd5 1：\u57df\u540d\u71b5\u68c0\u6d4b\u3002\u968f\u673a\u5b57\u7b26\u62fc\u63a5\u7684\u57df\u540d，\u5b57\u7b26\u71b5\u9ad8（\u63a5\u8fd1 log2(26) \u2248 4.7 bit\/char），\u6b63\u5e38\u5355\u8bcd\u71b5\u8f83\u4f4e\u3002Python \u5b9e\u73b0：<\/p>\n

    import<\/span> math
    \nfrom<\/span> collections import<\/span> Counter
    \ndef<\/span> domain_entropy<\/span>(<\/span>domain:<\/span> str<\/span>)<\/span> –<\/span>><\/span> float<\/span>:<\/span>
    \n domain =<\/span> domain.<\/span>replace(<\/span>"."<\/span>,<\/span> ""<\/span>)<\/span> # \u53bb\u6389\u5206\u9694\u7b26<\/span>
    \n if<\/span> not<\/span> domain:<\/span> return<\/span> 0<\/span>
    \n counts =<\/span> Counter(<\/span>domain)<\/span>
    \n n =<\/span> len<\/span>(<\/span>domain)<\/span>
    \n return<\/span> –<\/span>sum<\/span>(<\/span>(<\/span>c\/<\/span>n)<\/span> *<\/span> math.<\/span>log2(<\/span>c\/<\/span>n)<\/span> for<\/span> c in<\/span> counts.<\/span>values(<\/span>)<\/span>)<\/span>
    \n# \u793a\u4f8b<\/span>
    \nprint<\/span>(<\/span>domain_entropy(<\/span>"xqqjqfytpqiyolo.biz"<\/span>)<\/span>)<\/span> # \u2248 3.9 (\u9ad8\u71b5)<\/span>
    \nprint<\/span>(<\/span>domain_entropy(<\/span>"google.com"<\/span>)<\/span>)<\/span> # \u2248 2.5 (\u4f4e\u71b5)<\/span>
    \nprint<\/span>(<\/span>domain_entropy(<\/span>"facebook.com"<\/span>)<\/span>)<\/span> # \u2248 2.8<\/span><\/p>\n

    \u9608\u503c：\u5355\u5b57\u7b26\u71b5 > 3.5 \u2192 \u5acc\u7591；\u7ed3\u5408\u5176\u4ed6\u4fe1\u53f7（\u5982\u57df\u9f84\u3001NXDOMAIN \u6bd4\u4f8b\u3001\u6ce8\u518c\u4eba）\u7efc\u5408\u5224\u65ad\u3002
    \n\u65b9\u6cd5 2：NXDOMAIN \u6bd4\u4f8b\u3002\u690d\u5165\u4f53\u5c1d\u8bd5\u89e3\u6790\u5927\u91cf DGA \u57df\u540d，\u5927\u90e8\u5206\u8fd4\u56de NXDOMAIN（\u56e0\u4e3a\u53ea\u6ce8\u518c\u4e86\u5c11\u6570）\u3002\u68c0\u6d4b\u89c4\u5219：<\/p>\n

    title<\/span>:<\/span> Suspicious High NXDOMAIN Ratio
    \ndetection<\/span>:<\/span>
    \n selection<\/span>:<\/span>
    \n dns.response_code<\/span>:<\/span> 'NXDOMAIN'<\/span>
    \n condition<\/span>:<\/span> selection |<\/span> count() by src_ip ><\/span> 50 |<\/span> where ratio_nx ><\/span> 0.8<\/p>\n

    \u6b63\u5e38\u7528\u6237\u7684 NXDOMAIN \u6bd4\u4f8b < 5%，\u690d\u5165\u4f53\u53ef\u8fbe 90%+\u2014\u2014\u8fd9\u662f\u5f3a\u4fe1\u53f7\u3002
    \n\u65b9\u6cd5 3：\u673a\u5668\u5b66\u4e60（LSTM）\u3002LSTM \u5728 DGA \u68c0\u6d4b\u4e0a\u8868\u73b0\u6700\u4f73，\u8bad\u7ec3\u96c6\u7528\u6b63\u5e38\u57df\u540d（\u5982 Alexa Top 1M）+ 360 NetLab \u6216 Bambenek \u7684 DGA \u57df\u540d\u5217\u8868\u3002Python \u5feb\u901f\u5b9e\u73b0：<\/p>\n

    # \u7b80\u5316\u7248：\u7528\u5b57\u7b26 n-gram + \u968f\u673a\u68ee\u6797<\/span>
    \nfrom<\/span> sklearn.<\/span>ensemble import<\/span> RandomForestClassifier
    \nfrom<\/span> sklearn.<\/span>feature_extraction.<\/span>text import<\/span> TfidfVectorizer
    \nimport<\/span> pandas as<\/span> pd
    \n# \u6570\u636e：\u6b63\u5e38\u57df\u540d + DGA \u57df\u540d<\/span>
    \nlegit =<\/span> pd.<\/span>read_csv(<\/span>"alexa_top_1m.csv"<\/span>)<\/span>[<\/span>"domain"<\/span>]<\/span>
    \ndga =<\/span> pd.<\/span>read_csv(<\/span>"netlab_dga.csv"<\/span>)<\/span>[<\/span>"domain"<\/span>]<\/span>
    \nX =<\/span> list<\/span>(<\/span>legit)<\/span> +<\/span> list<\/span>(<\/span>dga)<\/span>
    \ny =<\/span> [<\/span>0<\/span>]<\/span>*<\/span>len<\/span>(<\/span>legit)<\/span> +<\/span> [<\/span>1<\/span>]<\/span>*<\/span>len<\/span>(<\/span>dga)<\/span>
    \nvectorizer =<\/span> TfidfVectorizer(<\/span>analyzer=<\/span>'char'<\/span>,<\/span> ngram_range=<\/span>(<\/span>2<\/span>,<\/span> 4<\/span>)<\/span>)<\/span>
    \nX_vec =<\/span> vectorizer.<\/span>fit_transform(<\/span>X)<\/span>
    \nclf =<\/span> RandomForestClassifier(<\/span>n_estimators=<\/span>100<\/span>)<\/span>
    \nclf.<\/span>fit(<\/span>X_vec,<\/span> y)<\/span>
    \n# AUC \u901a\u5e38 > 0.95<\/span><\/p>\n

    \u751f\u4ea7\u7ea7\u65b9\u6848\u7528 LSTM \u6216 CNN，\u5b57\u7b26\u7f16\u7801\u540e\u80fd\u8bc6\u522b"\u5b57\u6bcd\u5206\u5e03\u5f02\u5e38"（\u5982 xjqzv \u7684\u9ad8\u9891\u51fa\u73b0）\u3002
    \n\u65b9\u6cd5 4：\u5b57\u5178\u578b DGA \u7684\u7279\u6b8a\u5904\u7406\u3002\u5b57\u5178\u578b DGA（\u5982 Nymaim \u7528\u4e24\u4e2a\u5355\u8bcd\u62fc\u63a5）\u770b\u8d77\u6765\u50cf\u6b63\u5e38\u57df\u540d，\u71b5\u68c0\u6d4b\u5931\u6548\u3002\u68c0\u6d4b\u601d\u8def：<\/p>\n

      \n
    • \u770b\u57df\u9f84：DGA \u57df\u540d\u51e0\u4e4e\u90fd\u662f\u65b0\u6ce8\u518c\u7684（< 30 \u5929），\u67e5 whois；<\/li>\n
    • \u770b NXDOMAIN \u6a21\u5f0f：\u4e00\u4e2a IP \u77ed\u65f6\u95f4\u5185\u89e3\u6790\u591a\u4e2a"\u770b\u8d77\u6765\u6b63\u5e38"\u7684\u65b0\u57df\u540d \u2192 \u690d\u5165\u4f53\u884c\u4e3a；<\/li>\n
    • \u770b TLD：DGA \u504f\u7231 .xyz\u3001.top\u3001.info\u3001.tk \u7b49\u5ec9\u4ef7\/\u4fbf\u5b9c TLD；<\/li>\n
    • \u7528 LSTM \u533a\u5206"\u5b57\u5178\u578b DGA"\u548c"\u6b63\u5e38\u57df\u540d"：\u5b57\u5178\u578b DGA \u7684\u5355\u8bcd\u7ec4\u5408\u6a21\u5f0f\u5f02\u5e38（\u5982 telecommunications-pharmaceuticals \u7684\u7ec4\u5408\u4e0d\u50cf\u4e1a\u52a1）\u3002<\/li>\n<\/ul>\n

      \u7b2c\u56db\u7ae0：\u9ad8\u7ea7 C2 \u9690\u853d\u6280\u672f\u2014\u2014\u57df\u524d\u7f6e\u3001DoH\u3001\u4e91\u5b58\u50a8<\/h3>\n

      4.1 \u57df\u524d\u7f6e：\u8ba9 C2 \u85cf\u5728 CDN \u91cc<\/h4>\n

      Domain Fronting（\u57df\u524d\u7f6e）\u662f\u6700\u9ad8\u7ea7\u7684 C2 \u9690\u853d\u6280\u672f\u4e4b\u4e00，\u5176\u539f\u7406\u662f\u5229\u7528 CDN \u7684\u8def\u7531\u673a\u5236：<\/p>\n

      \u653b\u51fb\u6d41\u91cf \u2192 TLS SNI = bing.com (\u5408\u6cd5\u57df\u540d，DNS \u89e3\u6790\u5230 CDN)
      \n \u2192 HTTP Host = attacker.evil.com (\u771f\u5b9e C2，\u85cf\u5728\u52a0\u5bc6\u5c42)
      \n \u2192 CDN \u68c0\u67e5 Host \u5934，\u8def\u7531\u5230\u653b\u51fb\u8005\u7684\u540e\u7aef\u670d\u52a1\u5668<\/p>\n

      \u4e3a\u4ec0\u4e48\u6709\u6548：<\/p>\n

        \n
      • \u7f51\u7edc\u76d1\u63a7\u53ea\u770b TLS SNI\u2014\u2014\u5b83\u6307\u5411\u5408\u6cd5\u5927\u5382\u57df\u540d（Microsoft\u3001Cloudflare\u3001Google）；<\/li>\n
      • \u771f\u5b9e C2 \u5728\u52a0\u5bc6\u7684 HTTP Host \u5934\u91cc，\u4e0d\u51fa\u7ad9\u76d1\u63a7\u65e0\u6cd5\u770b\u5230；<\/li>\n
      • \u963b\u65ad SNI = \u963b\u65ad\u5408\u6cd5\u57df\u540d，\u505a\u4e0d\u5230\u3002
        \n\u5b9e\u6218\u90e8\u7f72（\u653b\u51fb\u8005\u89c6\u89d2）：<\/li>\n
      • Cobalt Strike + Azure CDN：\u628a Team Server \u90e8\u7f72\u5230 Azure，\u7528 Azure CDN \u57df\u540d xxx.azureedge.net \u4f5c\u4e3a SNI，\u771f\u5b9e C2 \u57df\u540d\u4f5c\u4e3a Host；<\/li>\n
      • Sliver + Cloudflare Tunnel：\u628a C2 \u9690\u85cf\u5728 Cloudflare \u7684\u8fb9\u7f18\u8282\u70b9\u540e；<\/li>\n
      • Discord \/ GitHub \/ Dropbox：\u76f4\u63a5\u7528\u4e91\u670d\u52a1\u7684 API \u4f5c\u4e3a C2 \u540e\u7aef\u3002
        \n\u68c0\u6d4b\u65b9\u5f0f（\u9632\u5fa1\u8005\u89c6\u89d2）：
        \n\u6838\u5fc3\u68c0\u6d4b：SNI \u4e0e Host \u4e0d\u5339\u914d\u3002\u9700\u8981HTTPS \u89e3\u5bc6\u6216\u62e5\u6709 Host \u5934\u7684\u6d41\u91cf\u6e90（\u5982\u53cd\u5411\u4ee3\u7406\u3001SSL \u68c0\u67e5\u8bbe\u5907）：<\/li>\n<\/ul>\n

        # Elastic Security \u57df\u524d\u7f6e\u68c0\u6d4b\u89c4\u5219<\/span>
        \n–<\/span> eql<\/span>:<\/span> |<\/span>
        \n network where event.category == "network"
        \n and tls.client.server_name != http.request.headers.host
        \n and (tls.client.server_name like~ "*.azureedge.net"
        \n or tls.client.server_name like~ "*.cloudfront.net"
        \n or tls.client.server_name like~ "*.cloudflare.com")<\/span><\/p>\n

        \u65e0 TLS \u89e3\u5bc6\u65f6\u7684\u95f4\u63a5\u68c0\u6d4b：<\/p>\n

          \n
        • JA3 \u5339\u914d：\u5927\u5382\u5408\u6cd5\u670d\u52a1（Microsoft\u3001Cloudflare）\u7684 JA3 \u5df2\u77e5，Cobalt Strike \u7684 JA3 \u5373\u4f7f\u7ecf\u8fc7 CDN \u4e2d\u8f6c\u4e5f\u4e0d\u4f1a\u6539\u53d8\u2014\u2014JA3 \u4e0d\u5339\u914d SNI \u57df\u540d\u7684\u9884\u671f\u6307\u7eb9 \u2192 \u53ef\u7591；<\/li>\n
        • \u8bc1\u4e66\u900f\u660e\u5ea6：\u7528 crt.sh \u67e5\u8be2 SNI \u57df\u540d\u7684\u8bc1\u4e66\u7b7e\u53d1\u8bb0\u5f55，\u57df\u540d\u548c\u8bc1\u4e66\u9881\u53d1\u673a\u6784\u4e0d\u5339\u914d \u2192 \u53ef\u7591；<\/li>\n
        • CDN \u5173\u8054\u5206\u6790：\u4e00\u4e2a CDN \u5b50\u57df\u540d\u77ed\u65f6\u95f4\u5185\u89e3\u6790\u5230\u591a\u4e2a\u4e0d\u540c\u7684\u540e\u7aef IP，\u4e14\u8fd9\u4e9b IP \u6709\u6076\u610f\u4fe1\u8a89 \u2192 \u53ef\u7591\u3002<\/li>\n<\/ul>\n

          4.2 DoH\/DoT：\u52a0\u5bc6 DNS \u8ba9"DNS \u76d1\u63a7"\u5931\u6548<\/h4>\n

          DoH（DNS over HTTPS，443 \u7aef\u53e3）\u548c DoT（DNS over TLS，853 \u7aef\u53e3）\u662f\u4e3a\u9690\u79c1\u8bbe\u8ba1\u7684\u534f\u8bae，\u4f46\u5b83\u4eec\u628a DNS \u6d41\u91cf\u85cf\u8fdb\u4e86 TLS，\u8ba9\u4f20\u7edf"\u51fa\u7ad9 DNS \u76d1\u63a7"\u5931\u6548\u3002
          \n\u653b\u51fb\u8005\u89c6\u89d2：DoH \u8ba9 DGA \u57df\u540d\u7684 NXDOMAIN \u884c\u4e3a\u5b8c\u5168"\u9690\u5f62"\u2014\u2014\u9632\u5fa1\u8005\u770b\u4e0d\u5230 DNS \u67e5\u8be2，\u81ea\u7136\u770b\u4e0d\u5230\u9ad8\u9891 NXDOMAIN\u3002Cobalt Strike \u7684 DNS Beacon \u4e5f\u53ef\u4ee5\u901a\u8fc7 DoH \u9690\u853d\u8fd0\u884c\u3002
          \n\u68c0\u6d4b\u65b9\u5f0f：<\/p>\n

            \n
          • \u963b\u65ad\u975e\u6388\u6743 DoH：\u5728\u4f01\u4e1a\u8fb9\u754c\u5c01\u9501\u6240\u6709\u975e\u4f01\u4e1a DoH \u89e3\u6790\u5668（\u5982 8.8.8.8\u30011.1.1.1 \u7684 DoH \u7aef\u70b9），\u5f3a\u5236\u6240\u6709 DNS \u8d70\u4f01\u4e1a\u5185\u90e8\u89e3\u6790\u5668；<\/li>\n
          • \u8bc6\u522b DoH \u7aef\u70b9\u5217\u8868：\u7ef4\u62a4\u516c\u5f00 DoH \u670d\u52a1\u5668 IP \u5217\u8868（\u5982 GitHub \u4e0a\u7684 curl\/doh-servers），\u5728\u9632\u706b\u5899 block；<\/li>\n
          • \u6d4f\u89c8\u5668\u7b56\u7565：\u901a\u8fc7\u7ec4\u7b56\u7565\u7981\u7528 Chrome\/Firefox \u7684\u81ea\u52a8 DoH \u5347\u7ea7（DnsOverHttpsMode = off）；<\/li>\n
          • \u4ece"\u770b DNS"\u8f6c\u5411"\u770b\u884c\u4e3a"：\u5373\u4f7f\u770b\u4e0d\u5230 DNS \u5185\u5bb9，\u4ecd\u80fd\u901a\u8fc7\u8fde\u63a5\u884c\u4e3a\u7684\u5468\u671f\u6027\u8bc6\u522b\u5fc3\u8df3\u3002<\/li>\n<\/ul>\n

            4.3 DNS \u96a7\u9053：\u628a C2 \u6570\u636e\u585e\u8fdb\u57df\u540d\u91cc<\/h4>\n

            DNS \u96a7\u9053\u662f\u53e6\u4e00\u79cd"\u501f\u9053"\u65b9\u5f0f\u2014\u2014\u7528 DNS \u67e5\u8be2\u548c\u54cd\u5e94\u643a\u5e26 C2 \u6570\u636e：<\/p>\n

            \u690d\u5165\u4f53 \u2192 \u67e5\u8be2 aGVsbG8gd29ybGQ.example.com TXT (\u6570\u636e = Base64)
            \nDNS \u670d\u52a1\u5668 \u2192 \u54cd\u5e94 TXT "aW5zdHJ1Y3Rpb24=" (C2 \u6307\u4ee4 = Base64)<\/p>\n

            \u68c0\u6d4b\u7279\u5f81：<\/p>\n

              \n
            • \u8d85\u957f\u5b50\u57df\u540d：aGVsbG8gd29ybGQgdGhpcyBpcyBhIHRlc3Q.example.com（\u8fdc\u8d85\u6b63\u5e38\u7684 <20 \u5b57\u7b26）；<\/li>\n
            • \u9ad8\u71b5\u5b50\u57df\u540d：Base32\/Base64 \u7f16\u7801\u7684\u5b50\u57df\u540d\u71b5\u5f88\u9ad8；<\/li>\n
            • TXT\/NULL \u8bb0\u5f55\u6bd4\u4f8b\u5f02\u5e38：\u6b63\u5e38\u4e1a\u52a1\u51e0\u4e4e\u4e0d\u67e5 TXT，\u690d\u5165\u4f53\u5927\u91cf\u67e5 TXT；<\/li>\n
            • \u5355\u57df\u540d\u591a\u552f\u4e00\u5b50\u57df：1 \u5206\u949f\u5185\u5bf9\u540c\u4e00\u7236\u57df\u540d\u53d1\u8d77 50+ TXT \u67e5\u8be2（Sigma \u89c4\u5219）；<\/li>\n
            • \u7f13\u5b58\u547d\u4e2d\u7387\u6781\u4f4e：\u6bcf\u4e2a\u67e5\u8be2\u90fd\u662f\u65b0\u5b50\u57df，DNS \u7f13\u5b58\u65e0\u7528\u6b66\u4e4b\u5730\u3002
              \nSigma \u89c4\u5219：<\/li>\n<\/ul>\n

              title<\/span>:<\/span> High Volume TXT Records from Single Source
              \ndetection<\/span>:<\/span>
              \n selection<\/span>:<\/span>
              \n dns.query_type<\/span>:<\/span> 'TXT'<\/span>
              \n condition<\/span>:<\/span> selection |<\/span> count() by src_ip ><\/span> 50
              \n |<\/span> timeframe 1m
              \nlevel<\/span>:<\/span> high
              \ntags<\/span>:<\/span>
              \n –<\/span> attack.command_and_control
              \n –<\/span> attack.t1071.004<\/p>\n

              \u5de5\u5177\u8bc6\u522b：\u5e38\u89c1 DNS \u96a7\u9053\u5de5\u5177（dnscat2\u3001DNSExfiltrator\u3001iodine）\u90fd\u6709\u53ef\u8bc6\u522b\u7684\u6307\u7eb9\u2014\u2014\u5982 dnscat2 \u9ed8\u8ba4\u5b50\u57df\u540d\u4ee5 xxxx \u5f00\u5934\u3001iodine \u4f7f\u7528 NULL \u8bb0\u5f55\u3002<\/p>\n

              4.4 \u4e91\u5b58\u50a8 C2：\u628a Dropbox \u5f53 C2 \u7528<\/h4>\n

              \u6700\u9690\u853d\u7684 C2 \u901a\u9053\u662f\u628a\u4e91\u670d\u52a1 API \u5f53 C2：\u690d\u5165\u4f53\u628a\u6307\u4ee4\u5b58\u5230 OneDrive \u6587\u4ef6\u3001\u628a\u56de\u4f20\u7ed3\u679c\u4f5c\u4e3a\u65b0\u7248\u672c\u4e0a\u4f20，\u6d41\u91cf\u5b8c\u5168\u5c31\u662f\u5408\u6cd5\u7684\u4e91\u670d\u52a1\u8c03\u7528\u3002
              \n\u4e3a\u4ec0\u4e48\u96be\u9632：<\/p>\n

                \n
              • \u963b\u65ad = \u65ad\u4e1a\u52a1（\u4f01\u4e1a\u4e0d\u80fd\u5c01 OneDrive）；<\/li>\n
              • API \u8c03\u7528\u5408\u6cd5（\u662f\u771f\u5b9e OAuth token\u3001\u771f\u5b9e HTTPS）；<\/li>\n
              • \u6570\u636e\u5728"\u7b2c\u4e09\u65b9"，\u4f01\u4e1a\u770b\u4e0d\u5230\u3002
                \n\u68c0\u6d4b\u65b9\u5f0f：<\/li>\n
              • \u5e94\u7528\u8eab\u4efd\u9a8c\u8bc1\u5f02\u5e38：\u7528\u5408\u6cd5 OAuth token \u7684\u5e94\u7528\u5728\u975e\u9884\u671f\u65f6\u95f4\u3001\u975e\u9884\u671f\u9891\u7387\u8c03\u7528 API \u2192 \u53ef\u7591；<\/li>\n
              • \u6587\u4ef6\u540d\/\u8def\u5f84\u5f02\u5e38：C2 \u6587\u4ef6\u901a\u5e38\u6709\u7279\u6b8a\u547d\u540d（\u5982 config.dat\u3001sync.log\u3001\u968f\u673a\u5b57\u7b26\u4e32）；<\/li>\n
              • UA \u5f02\u5e38：\u4e91\u5b58\u50a8 API \u8c03\u7528\u5e94\u8be5\u6765\u81ea\u5b98\u65b9\u5ba2\u6237\u7aef\u7684 UA，curl\/python-requests \u7684 UA \u2192 \u53ef\u7591；<\/li>\n
              • \u7f51\u7edc\u4f1a\u8bdd\u957f\u5ea6\u5f02\u5e38：\u6b63\u5e38 OneDrive \u540c\u6b65\u662f"\u6279\u91cf+\u4f4e\u9891"，C2 \u662f"\u5c0f\u6570\u636e+\u9ad8\u9891"\u3002<\/li>\n<\/ul>\n

                \u7b2c\u4e94\u7ae0：\u5b8c\u6574 SOC \u68c0\u6d4b\u4f53\u7cfb\u2014\u2014\u4ece\u5355\u70b9\u89c4\u5219\u5230\u7eb5\u6df1\u9632\u5fa1<\/h3>\n

                \u5355\u4e2a\u68c0\u6d4b\u89c4\u5219\u5bb9\u6613\u7ed5\u8fc7，\u5b8c\u6574\u7684 SOC \u68c0\u6d4b\u4f53\u7cfb\u662f"\u591a\u5c42\u62e6\u622a"\u3002<\/p>\n

                5.1 SOC C2 \u68c0\u6d4b\u6e05\u5355<\/h4>\n

                \u25a1 1. \u8fb9\u754c\u5c42
                \n \u25a1 \u90e8\u7f72\u4ee3\u7406\/PDNS，\u6240\u6709\u51fa\u7ad9\u6d41\u91cf\u7ecf\u8fc7\u4f01\u4e1a\u89e3\u6790\u5668
                \n \u25a1 \u5c01\u9501\u975e\u6388\u6743 DoH\/DoT \u7aef\u70b9
                \n \u25a1 \u7ef4\u62a4\u5a01\u80c1\u60c5\u62a5\u6e90（IP\/\u57df\u540d\u9ed1\u540d\u5355，\u81ea\u52a8\u66f4\u65b0）
                \n \u25a1 \u914d\u7f6e TLS \u68c0\u67e5（SNI vs Host \u4e00\u81f4\u6027\u6821\u9a8c）
                \n\u25a1 2. \u6d41\u91cf\u5c42
                \n \u25a1 Zeek \u90e8\u7f72\u5728\u6838\u5fc3\u4ea4\u6362，\u751f\u6210 conn.log\/dns.log\/ssl.log\/http.log
                \n \u25a1 RITA \u6216 AC-Hunter \u5206\u6790\u5fc3\u8df3
                \n \u25a1 JA3\/JA3S \u6307\u7eb9\u5e93（\u4e3b\u52a8+\u88ab\u52a8）
                \n \u25a1 JARM \u4e3b\u52a8\u63a2\u6d4b\u5df2\u77e5\u53ef\u7591\u57fa\u7840\u8bbe\u65bd
                \n\u25a1 3. \u7ec8\u7aef\u5c42
                \n \u25a1 EDR \u90e8\u7f72（Cobalt Strike \u8fdb\u7a0b\u6ce8\u5165\u3001GetSystem \u7b49\u884c\u4e3a\u68c0\u6d4b）
                \n \u25a1 Sysmon（Event ID 3 \u7f51\u7edc\u8fde\u63a5\u300122 DNS \u67e5\u8be2）
                \n \u25a1 \u4e3b\u673a\u7ea7 DNS \u4fe1\u4efb（\u5f3a\u5236\u4f01\u4e1a DNS）
                \n\u25a1 4. \u60c5\u62a5\u5c42
                \n \u25a1 \u8ba2\u9605\u5a01\u80c1\u60c5\u62a5\u6e90（AlienVault OTX\u3001MISP\u3001\u56fd\u5185\u5a01\u80c1\u60c5\u62a5\u5e73\u53f0）
                \n \u25a1 \u7ef4\u62a4\u5185\u90e8 IOC \u5e93
                \n \u25a1 DGA \u9884\u6d4b\u5de5\u5177（\u6709\u7b97\u6cd5\u9006\u5411\u80fd\u529b\u65f6\u4e3b\u52a8\u9884\u6ce8\u518c）
                \n\u25a1 5. \u5206\u6790\u5c42
                \n \u25a1 SIEM \u89c4\u5219\u96c6\u4e2d\u7ba1\u7406（Sigma \u8f6c SPL\/KQL\/EQL）
                \n \u25a1 \u5468\u671f\u6027\u5a01\u80c1\u72e9\u730e（beacon\u3001DGA\u3001DNS \u96a7\u9053\u4e13\u9879）
                \n \u25a1 \u6eaf\u6e90\u80fd\u529b（PDNS\u3001Whois\u3001Censys\/Shodan \u67e5\u8be2）
                \n\u25a1 6. \u54cd\u5e94\u5c42
                \n \u25a1 \u81ea\u52a8\u5c01\u7981 IP\/\u57df\u540d（API \u8054\u52a8\u9632\u706b\u5899）
                \n \u25a1 \u7ec8\u7aef\u9694\u79bb（EDR API）
                \n \u25a1 \u4e8b\u540e\u6eaf\u6e90\u6d41\u7a0b<\/p>\n

                5.2 \u5a01\u80c1\u72e9\u730e\u5b9e\u6218：\u4e00\u5957"\u4ece\u65e5\u5fd7\u5230 IOC"\u7684\u6d41\u7a0b<\/h4>\n

                \u5b9e\u6218\u573a\u666f：SOC \u6536\u5230\u4e00\u4efd 24 \u5c0f\u65f6\u7684 Zeek \u65e5\u5fd7，\u9700\u8981\u627e\u51fa\u662f\u5426\u6709 C2 \u884c\u4e3a\u3002
                \nStep 1：\u5fc3\u8df3\u521d\u7b5b（10 \u5206\u949f）<\/p>\n

                # \u5bfc\u5165 RITA<\/span>
                \nrita import<\/span> \/opt\/zeek\/logs current_24h
                \n# \u67e5\u770b\u5fc3\u8df3<\/span>
                \nrita show-beacons current_24h |<\/span> head<\/span> -30<\/span>
                \n# \u5173\u6ce8 Score > 0.8 \u7684\u8fde\u63a5<\/span><\/p>\n

                Step 2：DGA \u8bc6\u522b（10 \u5206\u949f）<\/p>\n

                # \u5bf9\u6240\u6709\u89e3\u6790\u8fc7\u7684\u57df\u540d，\u8ba1\u7b97\u71b5<\/span>
                \nimport<\/span> pandas as<\/span> pd
                \ndns =<\/span> pd.<\/span>read_csv(<\/span>"dns.log"<\/span>,<\/span> sep=<\/span>"\\\\t"<\/span>,<\/span> comment=<\/span>"#"<\/span>,<\/span> names=<\/span>[<\/span>.<\/span>.<\/span>.<\/span>]<\/span>)<\/span>
                \ndns[<\/span>"entropy"<\/span>]<\/span> =<\/span> dns[<\/span>"query"<\/span>]<\/span>.<\/span>apply<\/span>(<\/span>domain_entropy)<\/span>
                \nsuspects =<\/span> dns[<\/span>dns[<\/span>"entropy"<\/span>]<\/span> ><\/span> 3.5<\/span>]<\/span>.<\/span>drop_duplicates(<\/span>"query"<\/span>)<\/span><\/p>\n

                Step 3：JA3 \u6bd4\u5bf9（5 \u5206\u949f）<\/p>\n

                # \u4ece ssl.log \u63d0\u53d6 JA3<\/span>
                \ncat<\/span> ssl.log |<\/span> awk<\/span> '{print $23}'<\/span> |<\/span> sort<\/span> -u<\/span> |<\/span> grep<\/span> -v<\/span> "-"<\/span>
                \n# \u4e0e\u5df2\u77e5\u6076\u610f JA3 \u5e93\u6bd4\u5bf9<\/span><\/p>\n

                Step 4：\u5a01\u80c1\u60c5\u62a5\u786e\u8ba4（5 \u5206\u949f）<\/p>\n

                  \n
                • \u5fae\u6b65\u5728\u7ebf X \u5e73\u53f0 \/ \u5947\u5b89\u4fe1\u5a01\u80c1\u60c5\u62a5\u4e2d\u5fc3 \/ VirusTotal \u67e5\u8be2\u53ef\u7591\u57df\u540d\/IP；<\/li>\n
                • \u67e5\u8be2 whois：\u57df\u540d\u6ce8\u518c\u65f6\u95f4 < 30 \u5929 \u662f\u5f3a\u4fe1\u53f7；<\/li>\n
                • \u67e5\u8be2 PDNS：\u57df\u540d\u5386\u53f2\u89e3\u6790\u8bb0\u5f55\u662f\u5426\u66fe\u7ecf\u6307\u5411\u5df2\u77e5\u6076\u610f IP\u3002
                  \nStep 5：\u4e3b\u673a\u6eaf\u6e90（10 \u5206\u949f）<\/li>\n
                • \u7528\u53ef\u7591\u5916\u8054\u7684\u6e90 IP \u56de\u67e5 EDR \u4e8b\u4ef6：\u54ea\u4e2a\u8fdb\u7a0b\u53d1\u8d77\u7684\u8fde\u63a5？<\/li>\n
                • \u67e5 Sysmon Event ID 3：\u8fdb\u7a0b\u540d + \u547d\u4ee4\u884c；<\/li>\n
                • \u82e5\u4e3a rundll32.exe\u3001regsvr32.exe\u3001powershell.exe \u2192 \u5f3a\u70c8\u6076\u610f\u4fe1\u53f7\u3002
                  \nStep 6：IOC \u8f93\u51fa\u4e0e\u54cd\u5e94<\/li>\n
                • \u8f93\u51fa IOC \u6e05\u5355（IP\u3001\u57df\u540d\u3001JA3\u3001Mutex\u3001\u8fdb\u7a0b）；<\/li>\n
                • \u901a\u8fc7 EDR API \u9694\u79bb\u53d7\u611f\u67d3\u4e3b\u673a；<\/li>\n
                • \u5728\u9632\u706b\u5899 block C2 IP；<\/li>\n
                • \u628a IOC \u63d0\u4ea4\u5230\u5185\u90e8 MISP，\u4f9b\u5168\u7f51\u72e9\u730e\u3002<\/li>\n<\/ul>\n

                  \u7b2c\u516d\u7ae0：\u56fd\u5185\u5382\u5546\u89c6\u89d2\u4e0e"\u653b\u9632\u89c6\u89d2"\u8865\u5145<\/h3>\n

                  6.1 \u56fd\u5185\u5a01\u80c1\u60c5\u62a5\u751f\u6001<\/h4>\n

                  \u56fd\u5185 SOC \u5206\u6790\u5e08\u5e38\u7528\u7684\u5a01\u80c1\u60c5\u62a5\u5e73\u53f0：<\/p>\n

                    \n
                  • \u5fae\u6b65\u5728\u7ebf X（ThreatBook）：\u56fd\u5185\u5934\u90e8，\u8986\u76d6 APT \u548c\u9ed1\u4ea7\u60c5\u62a5，\u652f\u6301 DGA \u57df\u540d\u68c0\u6d4b API；<\/li>\n
                  • \u5947\u5b89\u4fe1\u5a01\u80c1\u60c5\u62a5\u4e2d\u5fc3：\u7ea2\u96e8\u6ef4\u56e2\u961f\u51fa\u54c1，APT \u62a5\u544a\u8d28\u91cf\u9ad8；<\/li>\n
                  • 360 NetLab：\u5f00\u6e90 DGA \u7b97\u6cd5\u548c\u60c5\u62a5\u5e93，\u56fd\u5185\u7814\u7a76 DGA \u5fc5\u770b；<\/li>\n
                  • VenusEye（\u542f\u660e\u661f\u8fb0）：\u4f01\u4e1a\u5a01\u80c1\u60c5\u62a5\u5e73\u53f0；<\/li>\n
                  • AlienVault OTX：\u514d\u8d39\u7684\u56fd\u9645\u5e73\u53f0，\u793e\u533a\u8d21\u732e\u4e30\u5bcc\u3002<\/li>\n<\/ul>\n

                    6.2 \u7ea2\u961f\u89c6\u89d2：\u7406\u89e3"\u4e3a\u4ec0\u4e48\u68c0\u6d4b\u96be"<\/h4>\n

                    \u4f5c\u4e3a\u5b89\u5168\u4ece\u4e1a\u8005，\u7406\u89e3\u653b\u51fb\u8005\u5982\u4f55"\u7ed5\u8fc7"\u68c0\u6d4b，\u6bd4\u53ea\u4f1a"\u4e0a\u89c4\u5219"\u66f4\u6709\u4ef7\u503c\u3002\u7ea2\u961f\u505a\u9690\u853d C2 \u7684\u6838\u5fc3\u601d\u8def：<\/p>\n

                      \n
                    • \u6539 Malleable Profile：\u628a CS \u7684 UA\u3001URI\u3001Header \u5168\u6539\u6210\u6b63\u5e38\u4e1a\u52a1\u7684\u6837\u5b50；<\/li>\n
                    • \u6362 C2 \u6846\u67b6：\u7528 Sliver \u66ff\u4ee3 Cobalt Strike（Go \u8bed\u8a00 TLS \u6307\u7eb9\u4e0d\u540c）；<\/li>\n
                    • \u591a\u5c42\u8df3\u677f：C2 \u2192 CDN \u2192 Domain Fronting \u2192 \u53d7\u5bb3\u8005，\u8ba9\u6eaf\u6e90\u96be\u4ee5\u8ffd\u6839；<\/li>\n
                    • \u4f4e\u9891\u5fc3\u8df3：Sleep 30 \u5206\u949f + 60% Jitter，\u8ba9 RITA \u9700\u8981 7 \u5929\u6570\u636e\u624d\u80fd\u8bc6\u522b；<\/li>\n
                    • \u96f6\u6d41\u91cf\u65f6\u6bb5：\u53ea\u5728\u5de5\u4f5c\u65f6\u95f4\u6d3b\u52a8，\u4e0e\u6b63\u5e38\u4e1a\u52a1\u6df7\u5728\u4e00\u8d77\u3002
                      \n\u5bf9\u5e94\u9632\u5fa1\u601d\u8def：<\/li>\n
                    • "\u4f4e\u9891\u5fc3\u8df3"\u5e94\u5bf9：\u5ef6\u957f\u5206\u6790\u7a97\u53e3\u5230 7~30 \u5929，\u7528\u66f4\u957f\u7684\u5e8f\u5217\u63d0\u5347 CV \u68c0\u6d4b\u7684\u7f6e\u4fe1\u5ea6；<\/li>\n
                    • "\u6df7\u5165\u4e1a\u52a1"\u5e94\u5bf9：\u6309\u4e1a\u52a1\u65f6\u6bb5\/\u4e3b\u673a\u7c7b\u578b\u5206\u7ec4\u2014\u2014\u4e00\u53f0\u670d\u52a1\u5668\u4e0d\u5e94\u5728\u4e1a\u52a1\u65f6\u6bb5\u5411\u964c\u751f\u57df\u540d\u53d1\u8d77\u89c4\u5f8b\u5fc3\u8df3；<\/li>\n
                    • "\u591a\u8df3\u677f"\u5e94\u5bf9：\u6293 TLS \u6307\u7eb9\u800c\u4e0d\u662f IP\u2014\u2014IP \u53ef\u4ee5\u53d8，JA3\/JARM \u6307\u7eb9\u7a33\u5b9a\u3002<\/li>\n<\/ul>\n

                      \u7ed3\u8bed：\u884c\u4e3a\u6307\u7eb9\u80dc\u8fc7\u4e00\u5207\u9759\u6001\u7279\u5f81<\/h3>\n

                      \u56de\u987e\u672c\u7bc7，C2 \u68c0\u6d4b\u7684\u672c\u8d28\u89c4\u5f8b\u53ef\u4ee5\u6d53\u7f29\u4e3a\u4e00\u53e5\u8bdd：\u653b\u51fb\u8005\u53ef\u4ee5\u6539\u53d8\u4e00\u5207"\u9759\u6001\u7279\u5f81"\u2014\u2014\u57df\u540d\u3001IP\u3001\u534f\u8bae\u3001UA\u3001URI\u3001\u8bc1\u4e66\u2014\u2014\u4f46\u6c38\u8fdc\u65e0\u6cd5\u6539\u53d8"\u5fc5\u987b\u5b9a\u671f\u62a5\u5230"\u8fd9\u4e00\u884c\u4e3a\u672c\u8d28\u3002Beacon \u5fc3\u8df3\u7684\u65f6\u95f4\u5e8f\u5217\u89c4\u5f8b\u3001DGA \u57df\u540d\u7684\u71b5\u503c\u7279\u5f81\u3001DNS \u96a7\u9053\u7684\u67e5\u8be2\u6a21\u5f0f\u3001\u4e91\u5b58\u50a8 C2 \u7684 API \u8c03\u7528\u8282\u594f\u2014\u2014\u8fd9\u4e9b"\u884c\u4e3a\u6307\u7eb9"\u662f\u653b\u51fb\u8005\u7684\u7ed3\u6784\u6027\u7ea6\u675f，\u7ed5\u4e0d\u5f00\u3001\u85cf\u4e0d\u4f4f\u3002<\/p>\n

                      \u4f5c\u4e3a\u9632\u5fa1\u8005，\u4e0d\u8981\u628a\u5b9d\u62bc\u5728\u4efb\u4f55\u4e00\u4e2a\u5177\u4f53\u6307\u6807\u4e0a\u2014\u2014UA \u4f1a\u53d8\u3001JA3 \u4f1a\u7ed5\u3001IP \u4f1a\u8f6e\u6362\u3002\u771f\u6b63\u7684\u7eb5\u6df1\u9632\u5fa1\u662f"\u591a\u5c42\u5f31\u4fe1\u53f7\u53e0\u52a0"：CV \u5fc3\u8df3\u68c0\u6d4b + JA3\/JARM \u6307\u7eb9 + DGA \u71b5\u503c + DNS \u884c\u4e3a\u5f02\u5e38 + \u7ec8\u7aef\u8fdb\u7a0b\u94fe + \u5a01\u80c1\u60c5\u62a5\u5339\u914d\u2014\u2014\u516d\u4e2a\u7ef4\u5ea6\u4e2d\u4efb\u610f\u4e09\u4e2a\u540c\u65f6\u547d\u4e2d，\u5c31\u53ef\u4ee5\u5b9a\u6027 C2\u3002<\/p>\n

                      \u4f5c\u4e3a\u7814\u7a76\u8005，\u7406\u89e3\u653b\u51fb\u8005\u7684"\u8bbe\u8ba1\u54f2\u5b66"\u6bd4\u8bb0\u4f4f\u5177\u4f53\u7279\u5f81\u66f4\u91cd\u8981\u3002\u5f53\u4f60\u80fd\u7ad9\u5728\u7ea2\u961f\u89c6\u89d2\u601d\u8003"\u5982\u679c\u6211\u662f\u653b\u51fb\u8005，\u6211\u4f1a\u600e\u4e48\u8ba9\u6d41\u91cf\u770b\u8d77\u6765\u6b63\u5e38"，\u4f60\u5c31\u80fd\u9884\u6d4b\u51fa\u6240\u6709\u53ef\u80fd\u7684\u5bf9\u6297\u8def\u5f84，\u4ece\u800c\u8bbe\u8ba1\u51fa\u771f\u6b63\u9c81\u68d2\u7684\u68c0\u6d4b\u3002
                      \n\u6700\u540e\u4e00\u53e5\u8bdd\u9001\u7ed9\u5165\u95e8\u8005：C2 \u5206\u6790\u662f\u4e00\u95e8"\u8bfb\u65f6\u95f4\u5e8f\u5217"\u7684\u827a\u672f，\u662f\u4e00\u95e8"\u4ece\u566a\u97f3\u4e2d\u542c\u51fa\u8282\u62cd"\u7684\u827a\u672f\u3002\u5f53\u4f60\u80fd\u5728\u6570\u5341\u4e07\u6761\u8fde\u63a5\u65e5\u5fd7\u91cc，\u4e00\u773c\u770b\u5230\u90a3\u6761\u6bcf 60 \u79d2\u8df3\u4e00\u6b21\u7684"\u5fc3\u8df3"，\u4f60\u5c31\u5df2\u7ecf\u62e5\u6709\u4e86 SOC \u5206\u6790\u5e08\u6700\u6838\u5fc3\u7684\u80fd\u529b\u2014\u2014\u4ece\u6570\u636e\u91cc\u770b\u89c1\u653b\u51fb\u8005\u7684\u547c\u5438\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"

                      \u5f15\u8a00：\u6293\u4f4f C2，\u5c31\u6293\u4f4f\u4e86\u653b\u51fb\u8005\u7684\u547d\u95e8
                      \n\u5728\u73b0\u4ee3\u5165\u4fb5\u4e8b\u4ef6\u4e2d，C2（Command and Control，\u547d\u4ee4\u4e0e\u63a7\u5236）\u662f\u653b\u51fb\u8005\u7684\\”\u751f\u547d\u7ebf\\”\u2014\u2014\u5b83\u662f\u690d\u5165\u4f53\u63a5\u6536\u6307\u4ee4\u3001\u56de\u4f20\u6570\u636e\u3001\u4e0b\u8f7d\u8f7d\u8377\u7684\u552f\u4e00\u901a\u9053\u3002\u65e0\u8bba\u653b\u51fb\u8005\u5728\u4e3b\u673a\u4fa7\u505a\u4e86\u591a\u6df1\u7684\u514d\u6740，\u53ea\u8981 C2 \u901a\u4fe1\u88ab\u8bc6\u522b\u5e76\u963b\u65ad，\u653b\u51fb\u5c31\u5ba3\u544a\u65ad\u94fe\u3002\u636e Sekoia 2023 \u5e74\u7edf\u8ba1，\u5168\u7403\u6d3b\u8dc3 C2 \u76f8\u5173 IP \u6570\u91cf\u5df2\u7a81\u7834 8.5 <\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[61,43,427,78,122],"topic":[],"class_list":["post-100904","post","type-post","status-publish","format-standard","hentry","category-server","tag-61","tag-43","tag-427","tag-78","tag-122"],"yoast_head":"\n\u6728\u9a6c\u901a\u4fe1\u5206\u6790\u2014\u2014C2 \u534f\u8bae\u3001DGA\u3001\u57df\u540d\u751f\u6210\u7b97\u6cd5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/100904.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u6728\u9a6c\u901a\u4fe1\u5206\u6790\u2014\u2014C2 \u534f\u8bae\u3001DGA\u3001\u57df\u540d\u751f\u6210\u7b97\u6cd5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u5f15\u8a00：\u6293\u4f4f C2，\u5c31\u6293\u4f4f\u4e86\u653b\u51fb\u8005\u7684\u547d\u95e8 \u5728\u73b0\u4ee3\u5165\u4fb5\u4e8b\u4ef6\u4e2d，C2（Command and Control，\u547d\u4ee4\u4e0e\u63a7\u5236）\u662f\u653b\u51fb\u8005\u7684"\u751f\u547d\u7ebf"\u2014\u2014\u5b83\u662f\u690d\u5165\u4f53\u63a5\u6536\u6307\u4ee4\u3001\u56de\u4f20\u6570\u636e\u3001\u4e0b\u8f7d\u8f7d\u8377\u7684\u552f\u4e00\u901a\u9053\u3002\u65e0\u8bba\u653b\u51fb\u8005\u5728\u4e3b\u673a\u4fa7\u505a\u4e86\u591a\u6df1\u7684\u514d\u6740，\u53ea\u8981 C2 \u901a\u4fe1\u88ab\u8bc6\u522b\u5e76\u963b\u65ad，\u653b\u51fb\u5c31\u5ba3\u544a\u65ad\u94fe\u3002\u636e Sekoia 2023 \u5e74\u7edf\u8ba1，\u5168\u7403\u6d3b\u8dc3 C2 \u76f8\u5173 IP \u6570\u91cf\u5df2\u7a81\u7834 8.5\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/100904.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-05T07:57:04+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/100904.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/100904.html\",\"name\":\"\u6728\u9a6c\u901a\u4fe1\u5206\u6790\u2014\u2014C2 \u534f\u8bae\u3001DGA\u3001\u57df\u540d\u751f\u6210\u7b97\u6cd5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-09-05T07:57:04+00:00\",\"dateModified\":\"2026-09-05T07:57:04+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/100904.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/100904.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/100904.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u6728\u9a6c\u901a\u4fe1\u5206\u6790\u2014\u2014C2 \u534f\u8bae\u3001DGA\u3001\u57df\u540d\u751f\u6210\u7b97\u6cd5\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u6728\u9a6c\u901a\u4fe1\u5206\u6790\u2014\u2014C2 \u534f\u8bae\u3001DGA\u3001\u57df\u540d\u751f\u6210\u7b97\u6cd5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/100904.html","og_locale":"zh_CN","og_type":"article","og_title":"\u6728\u9a6c\u901a\u4fe1\u5206\u6790\u2014\u2014C2 \u534f\u8bae\u3001DGA\u3001\u57df\u540d\u751f\u6210\u7b97\u6cd5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u5f15\u8a00：\u6293\u4f4f C2，\u5c31\u6293\u4f4f\u4e86\u653b\u51fb\u8005\u7684\u547d\u95e8 \u5728\u73b0\u4ee3\u5165\u4fb5\u4e8b\u4ef6\u4e2d，C2（Command and Control，\u547d\u4ee4\u4e0e\u63a7\u5236）\u662f\u653b\u51fb\u8005\u7684\"\u751f\u547d\u7ebf\"\u2014\u2014\u5b83\u662f\u690d\u5165\u4f53\u63a5\u6536\u6307\u4ee4\u3001\u56de\u4f20\u6570\u636e\u3001\u4e0b\u8f7d\u8f7d\u8377\u7684\u552f\u4e00\u901a\u9053\u3002\u65e0\u8bba\u653b\u51fb\u8005\u5728\u4e3b\u673a\u4fa7\u505a\u4e86\u591a\u6df1\u7684\u514d\u6740，\u53ea\u8981 C2 \u901a\u4fe1\u88ab\u8bc6\u522b\u5e76\u963b\u65ad，\u653b\u51fb\u5c31\u5ba3\u544a\u65ad\u94fe\u3002\u636e Sekoia 2023 \u5e74\u7edf\u8ba1，\u5168\u7403\u6d3b\u8dc3 C2 \u76f8\u5173 IP \u6570\u91cf\u5df2\u7a81\u7834 8.5","og_url":"https:\/\/www.wsisp.com\/helps\/100904.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-09-05T07:57:04+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"12 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/100904.html","url":"https:\/\/www.wsisp.com\/helps\/100904.html","name":"\u6728\u9a6c\u901a\u4fe1\u5206\u6790\u2014\u2014C2 \u534f\u8bae\u3001DGA\u3001\u57df\u540d\u751f\u6210\u7b97\u6cd5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-09-05T07:57:04+00:00","dateModified":"2026-09-05T07:57:04+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/100904.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/100904.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/100904.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"\u6728\u9a6c\u901a\u4fe1\u5206\u6790\u2014\u2014C2 \u534f\u8bae\u3001DGA\u3001\u57df\u540d\u751f\u6210\u7b97\u6cd5"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/100904","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=100904"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/100904\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=100904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=100904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=100904"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=100904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}