Pona Mahi Kua Taratahia e CrowdStrike/SentinelOne, Kua Maukati ranei e te Huka Whakamate VPN Kua pakaru I a Mahi Mamao¶

Ka oho ake i roto i te tari kaainga, te ruuma hotera, te mokowāmahi mamao ranei ki te mohio kei te whakaatu to rorohiko pona i tukuna e te kamupene "Hono, Kaore he Ipurangi" puta noa i nga whatunga Wi-Fi katoa, karekau e whakaae ki te uta i tetahi hotera, taunga rererangi ranei te wharangi urunga urunga mauhere, ka pakaru ranei i roto i te Mata Matapihi Matapihi mutunga kore o te Mate (BSOD) bootloop (PAGE_FAULT_IN_NONPAGED_AREA ranei SYSTEM_THREAD_EXCEPTION_NOT_HANDLED) he ohotata mahi mamao-nui. I roto i nga taiao hinonga hou, ko tenei kati katoa ka puta mai i nga wa katoa na tetahi o nga tikanga haumaru aunoa e toru: he Endpoint Detection and Response (EDR) Network Containment taratahi na te CrowdStrike Falcon, SentinelOne, Microsoft Defender ranei mo Endpoint, he whakahoutanga haumarutanga aratau kernel-momo ** kua pakaru, te aukati i te whakamohoatanga o te punaha haumarutanga o te kernel-mode (EDR) i nga wa katoa, ka aukati i te whakamohoatanga o te punaha haumarutanga o te kernel-mode (EDR) i nga wa katoa. Uru (ZTNA) Kill-Switch (Zscaler Client Connector, Cisco AnyConnect / Secure Client, Palo Alto GlobalProtect, Fortinet FortiClient ranei) e aukati ana i nga hokohoko DNS katoa me te DHCP o te rohe tae noa ki te whakaturanga o tetahi kohanga. Mena kei roto i to raka he whakaeke ransomware kaha, he tono tango ranei, whakapaa atu ki to Pokapū Whakahaere Haumarutanga (SOC) rangatōpū me te korero ki to rohe. tau ohorere mehemea ka pangia nga hanganga tino nui, nga punaha haumaru-ora ranei. Mo nga raruraru mahi-mamao e pa ana, tirohia o maatau kaiarahi mahi pona kua tahaetia, kua pakaru ranei i te wa e haere ana me te whakaora raka MDM, mahi mamao mai i te hotera, a ipurangi tārua me te hononga.

Na te mea ka whakapakeketia nga pito mutunga umanga ki nga kupuhipa whakamarumaru-whakararuraru, nga kaute kaiwhakamahi kore-whakahaere, me te Microsoft BitLocker, macOS FileVault ranei te whakamunatanga kōpae-katoa, ka rahua nga mahi tinihanga rapurongoā a nga kaihoko (pēnei i te whakauru ano i te Matapihi, te whakakore ranei i nga kōpaki papatono) ka taka, ka puta he matohi whakatumatuma-whakamatau nui i runga i to papatohu CISO. Heoi, ma te tirotiro mena kei te anga koe ki te EDR Host Isolation, he VPN Captive-Portal Deadlock, he Kernel Driver Bootloop, me te patai ki to IT Helpdesk or SecOps team mo te 48-mati BitLocker Recovery Key ranei One-Time Offline Maintenance / Uncontain Token ka taea e koe te whakahoki mai i to waea reo i roto i te 1 meneti i roto i te 5 meneti.

Mahia tenei inaianei¶

1. Kaua e ngana ki te muru, ki te tautuhi, ki te tarai ranei i te pona umanga mai i te Linux kore mana, i te rakau USB pakaru-kupuhipa ranei. Te whakaara i tetahi pona hinonga mai i tetahi haerenga puku USB o waho ** UEFI Secure Boot** me Trusted Platform Module (TPM 2.0) PCR tiro tika, ka mau tonu i te puku mārō ki muri i te 48-mati a te Matapihi Mataara a te kamupene whakaraeraetanga o te Pukamata me te whakamohiotanga o te kamupene BitLocker. te wa ka hono ano te pona.
2. Whakatauhia mena kua aukatihia to ipurangi e te EDR Quarantine vs. a VPN Kill-Switch Deadlock. Whakatuwheratia he Tohu Whakahau (cmd.exe) ranei te matapihi Terminal ka rere ping 8.8.8.8 a nslookup google.com. Mena ** ka rahua nga kete kotahi General failure ranei Transmit failed. Error code 1231** ahakoa e kii ana to tohu Wi-Fi "Hono," kei te whakahekehia e te taraiwa tātari papangaahi (ahakoa te EDR Network Containment, he VPN Kill-Switch ranei) nga paakete puta katoa i te Windows Filtering Platform (WFP) paparanga.
3. **Mena kei te hotera koe, te kawhe, te taunga rererangi ranei, ka aukatia e to VPN-Au tonu te wharangi takiuru Wi-Fi ("Captive Portal Chicken-and-Egg Deadlock"), honoa to pona ki te Wi-Fi Hotspot pūkoro o to waea atamai TUATAHI. tohu mai i te IT, a ka taea e koe te tono mo te wa poto Kaipoi Puka Whakahoki / Mono Kupuhipa.
4. Mena kei te mau to rorohiko pona Windows ki te Mata Kahurangi o te Mate (BSOD) bootloop i muri i te whakahoutanga haumarutanga mo te po, whakaahuatia te tika Stop Code a .sys ingoa kōnae kei raro o te mata kikorangi (pērā i csagent.sys ranei SentinelMonitor.sys). Ko taua ingoa konae ka korero tonu ki to roopu IT mena he he te konae hongere EDR, he atekōkiri kernel ranei i tukinga.
5. I mua i te urunga ki te Aratau Haumaru Windows, ki te Tohu Whakahau WinRE ranei i runga i te PC rangatōpū, waea atu ki to Papamahi Awhina IT i runga i to waea ka tono kia panuihia, panui atu ranei ki a koe te Kī Whakaora BitLocker 48-mati a to pona (whakaritea ki nga tohu tuatahi e 8 o te Key ID ka whakaatuhia ki to mata). Kaore e taea e koe te whakatuwhera i te whakahau whakahau whakaora, te whakaara ranei ki te Aratau Haumaru i runga i te pona hinonga whakamunatia me te kore e uru ki aua mati 48.
6. Mena kua tukuna e CrowdStrike Falcon, SentinelOne, Defender mo Endpoint ranei to pona ki roto i te "Waihanga Whatunga" (Whakatuwhera Kaihautu), kati te whakahaere i nga tuhinga tuhi, te whakawhiti ranei i nga konae ka waea atu ki to Pokapū Whakahaere Haumarutanga (SOC) rangatōpū ma te waea. Whakamaramahia taau mahi i mua tonu i te raka (pērā i te whakahaere i te kaiwhakawhanake kaiwhakawhanake, te whakauru i te taputapu whakamatautau haerenga ki te SO, te whakahononga hiko ranei ki te taputapu haerenga ki te SO, te whakaurunga hiko ki te SOC, te whakamohio ranei i te taputapu haerenga ki te SO), Ka taea e te kaitätari te manatoko he pai te whakapae, ka paato i te "Whakaekea" mai i te papatohu kapua (ka tae aunoa ki to pona ahakoa kua taratahitia).

Rakau Whakatau: Te tirotiro i nga kati whatunga pona umanga umanga me nga bootloops¶

Whakamahia tenei tūtohi rerenga ki te tohu ko wai te paparanga haumaru hinonga i maukati i to pona me te huarahi ki te tikanga whakaora.

flowchart TD
    A["Pona Mahi Mamao kua maukati, kaore ranei e taea te hono"] --> B{"Ka eke te pona ki te papamahi Windows / macOS?"}
    B -->|"Kao: Tutuki i te Mata Kahurangi (BSOD) Loop, Mata BitLocker ranei"| C{"He aha te mea ka whakaatuhia ki te mata?"}
    C -->|"BSOD whakaingoa csagent.sys, SentinelMonitor.sys, wdfilter.sys ranei"| D["KERNEL DRIVER BOOTLOOP: Whakaara ki te Whakaora WinRE -> Whakauruhia te 48-mati BitLocker Key mai i te IT -> Mukua te konae hongere hapa, whakaingoa ano ranei te taraiwa i te Aratau Haumaru"]
    C -->|"Ko te Mata Whakaora BitLocker Blue e tono ana mo te taviri 48-mati"| E["TPM PCR TRIP: Wewetehia nga tauranga USB / puku katoa -> Whakahoutia -> Ki te aki tonu, waea atu ki te Papamahi Awhina IT me te 8-char Key ID ki te tiki 48-mati Whakaora Kī"]
    B -->|"Ae: Putu ki te Papamahi, engari ZERO uru ipurangi / whatunga"| F{"Ka aha ina tirohia e koe te mana VPN / ZTNA & Wi-Fi?"}
    F -->|"I te Hotera/Taurangi: Wi-Fi hono, engari karekau e tuwhera te wharangi takiuru Captive Portal"| G["KAUPAPA KAUPAPA KAUPAPA KAUPAPA: Whakauruhia te pona ki te Hotspot Waea atamai tuatahi -> Whakamotuhēhē VPN -> Whakauruhia ranei he Pouara Haere ki te whakaoti i te takiuru tomokanga i runga waea"]
    F -->|"Ka hono te Kainga/Hotspot Wi-Fi, engari ko te ping 8.8.8.8 e kii ana 'Rahua Rahua'"| H{"Kei te mau tonu te kiritaki VPN ki te 'Honohono / Kill-Switch Active' RĀNEI kei te wehe a EDR?"}
    H -->|"E kii ana te Kiritaki VPN 'Maka Whatunga / Whakamate Whakawhiti Hohe - Kaore e taea te tae atu ki te Waahi'"| I["VPN KILL-SWITCH LOCK: Hurihia ki te waahi waea -> Whakauruhia ranei IT Kotahi-Wa Mono Kupuhipa ki Zscaler / AnyConnect / GlobalProtect"]
    H -->|"Kua weto, kua momotuhia ranei te VPN, OR te pahū-ake haumarutanga e kii ana 'Kaiwhakahaere Motuhake'"| J["EDR NETWORK CONTAINMENT: Kia hono tonu te Wi-Fi -> Waea ki te SOC Corporate -> Whakarato Ingoa Kaihautū -> SOC paohia te 'Lift Containment' RĀNEI ka hoatu Token Tiaki Tuimotu"]

Tauari 1: Pona kua taratahihia e EDR "Waiunga Whatunga" (CrowdStrike, SentinelOne, Defender)¶

Ko nga pona hinonga o naianei kei te whakahaere i nga pukoro taumata-kero Endpoint Detection and Response (EDR) pūoko hei utu mo te rorohiko wheori kaihoko tuku iho. Ina kitea e te kaikorero EDR te whanonga e rite ana ki te whakaeke ipurangi - penei i te miihini rorohiko e whakahiato ana i te haina-rua, he kaitātari raraunga e whakahaere ana i tetahi tuhinga hiko PowerShell, Python ranei, he kaihoahoa e whakatuwhera ana i te ripanga tonotono-whakahohea, he tangata haere ranei e hono ana ki tetahi whatunga hotera kua taupatupatuhia e whakaputa ana i nga paatete tinihanga ARP - ko te **Whakatairanga Pukapuka Tukutuku.

Me pehea te mohio ki tetahi EDR Network Containment taratahi¶

Kaore i rite ki te whakaheke Wi-Fi noa, ka whakaatuhia e te taratahi EDR nga tohu hangarau tino motuhake:

1. Whakaatu Wi-Fi "Hono" ranei "Karekau he Ipurangi, Haumaru," Heoi Kare e kitea nga taputapu LAN Paetata: Kaore e taea e koe te ping i to pouara kaainga (192.168.1.1), kāore e taea te tā ki tētahi pūreretā whatunga paetata, ā ping 8.8.8.8 hoki mai General failure ranei Transmit failed inamata (<1 ms) nā te mea ko te Pūmanawa Tātari Matapihi a te pūoko EDR (WFP) ka haukotia e te atekōkiri waea ka whakataka ia mōkihi TCP/UDP/ICMP i mua i te taenga atu ki te kāri Wi-Fi.
2. Ko te Papamahi Mamao Hohe, Te Puoro, Topa, me nga Wātū Pūtirotiro Ka Whakatio I te Waetahi: I roto i te 2 hēkona o te keu whanonga, ka kati nga turanga katoa i te wa kotahi.
3. Te Tirohanga i te Tunga EDR Paetata ma te Raina Whakahau (Kaore he Mana Whakahaere e Hiahia ana):
4. CrowdStrike Falcon: Whakatuwhera Whakatairanga Tono (cmd.exe) ka oma sc query csagent. Mena ka whakaatu STATE: 4 RUNNING, me te omaoma netstat -ano | findstr :443 e whakaatu ana ko te anake kaha ESTABLISHED Ko nga hononga ki waho o te pona katoa no CSFalconService.exe e korero ana ki nga wahitau IP kapua AWS/CrowdStrike, kei roto to kaihautu i te Falcon Network Containment.
5. SentinelOne: Titiro ki te tohu parepare SentinelOne papura kei te paepae punaha (me te pae tahua kei runga macOS). Ina wehea, ka panui te mana o te kaihoko Network Quarantined / Disconnected from Network by Management.
6. Microsoft Defender for Endpoint (MDE): Ka taea e te toast whakamōhiotanga Haumarutanga Windows te kii poto "Kua wehea tenei taputapu e to kaiwhakahaere," MsSense.exe ka noho tonu ko te tukanga anake e whakaaetia ana ma te papaahi.

Me pehea te noho taratahi-mamao (Tuku Kapua Tuihono me te Tohu Tiaki Tuimotu)¶

E rua nga huarahi ka taea e to Pokapū Whakahaere Haumarutanga IT (SOC) te tuku taratahi EDR:

Tauari 2: Kua pakaru i nga wa katoa VPN Whakamate-Whakawhiti, ZTNA Captive-Portal Mate ranei¶

He aha mena ka karekau i taratahia e SecOps to pona, engari kei te whakahaere hinonga Kei runga tonu VPN ranei Zero-Trust Network Access (ZTNA) te kiritaki (Zscaler Client Connector, Cisco AnyConnect / Cisco Secure Client with Network Visibility Module, Palo Alto GlobalProtect, or Netskope a ) whirihorahia ki te "Kiiwhakawhiti"il"il, Netskope) / "Araia nga hokohoko kore-rangatōpū katoa ina kore e pono")?

1. Te Whakataunga i te "Hotera / Tauranga rererangi Captive Portal Deadlock" (The Chicken-and-Egg Trap)¶

Anei te take e maukati ana nga mano o nga kaimahi mamao i o ratou pona rorohiko i ia ata i nga hotera, nga kawhe me nga taunga rererangi:

• Ki te uru ipurangi ki runga Wi-Fi hotera, taunga rererangi ranei, me whakatuwhera koe i tetahi kaitirotiro paetukutuku, tukuna ma te HTTP/DNS ki te wharangi takiuru rohe o te hotera (captive.apple.com ranei neverssl.com), ka patohia to nama ruma me to ingoa whanau.
• Heoi, ka kite tonu te Puka Whakamate VPN Kill-Switch o to pona umanga ko te Wi-Fi hotera he "Whatunga Kore-Kaporeihana Karekau" ka ** ka aukati i nga tono HTTP me DNS katoa o te rohe** kia hono ra ano te kauhanga VPN whakamunatia ki te tari matua umanga.
• Ko te kauhanga VPN kaore e taea te hono kia patohia e koe to nama ruma ki te wharangi takiuru hotera, a kaore e taea e koe te uta te wharangi takiuru hotera na te mea kei te aukati te VPN Kill-Switch i to kaitirotiro.

Whakamahia tetahi o enei e wha nga tikanga maataki kua whakamatauria ki te pakaru tonu i te kati me te kore e hiahia mo nga mana whakahaere:

+-----------------------------------------------------------------------+
|  4 WAYS TO BREAK A VPN KILL-SWITCH CAPTIVE PORTAL DEADLOCK            |
|                                                                       |
|  METHOD 1 (Smartphone USB/Wi-Fi Tethering + MAC Clone / Travel Router)|
|  Authenticate the hotel captive portal on a pocket Travel Router      |
|  (or Android Wi-Fi Share), then connect your work laptop to the       |
|  already-authenticated router Wi-Fi.                                  |
|                                                                       |
|  METHOD 2 (Built-In Mini Captive Portal Browser Inside VPN Client)    |
|  Click the Zscaler / GlobalProtect / AnyConnect tray icon ->          |
|  Click "Captive Portal Detected / Open Login Window".                 |
|                                                                       |
|  METHOD 3 (Gateway IP Direct Entry in Browser)                        |
|  Run `ipconfig` -> Find "Default Gateway" (e.g., 10.0.0.1) ->         |
|  Type `http://10.0.0.1` directly into Edge/Chrome address bar.        |
|                                                                       |
|  METHOD 4 (Authenticate on Phone First -> Call IT for Disable Code)   |
|  Tether laptop to Phone Cellular Data -> Get Zscaler/VPN Disable      |
|  Password from IT -> Pause VPN for 10 min -> Join Hotel Wi-Fi.        |
+-----------------------------------------------------------------------+

1. ** Tikanga 1 - Te Piriti Wi-Fi Waea atamai, Pocket Travel Router Trick ranei (Ka Mahi 100 Ōrau o te Wa):**
2. Kaore e taea e to pona mahi te whakaatu i te rereketanga i waenga i te whatunga Wi-Fi hotera kaore i whakamotuhēhēhia me te pouara whaiaro kua kua takiuru ki te tomokanga hotera.
3. Mena kei a koe he waea Android (Wi-Fi Sharing): Honoa to waea Android ki te Wi-Fi hotera, whakaotia te whakaurunga tomokanga mauhere ruma ruma i runga i te mata o to waea, katahi ka whakakāhia te Waea Pukoro o to waea (tautoko waea Samsung Pika/Android hou i te wa kotahi Wi-Fi Repeater / Wi-Fi Sharing mode, whakapaoho i te hotera Wi-Fi i whakamahia ma to waea waea). Honoa to pona mahi ki te waahi wera o to waea: ka hono tonu te VPN.
4. Mena kei te mau koe i te Pocket Travel Router (pērā i te GL.iNet Beryl/Slate; tirohia mahi mamao mai i te hotera): Honoa te pouara haere ki te Wi-Fi hotera, whakaotihia te takiuru hotera ma te whakamahi i to kaitirotiro atamai, ka hono atu i to pona mahi ki te WPA3 Wi-Fi, Ethernet tauranga ranei o to pouara haere.
5. Tirohanga 2 - Patohia te IP Waahi Taunoa Paetata ki To Pūtirotiro (http://10.x.x.x):
6. I te nuinga o nga wa, ka kahakina noa e te VPN Kill-Switch, Zscaler DNS takawaenga ranei Tirohanga ingoa rohe DNS (aukati neverssl.com ranei google.com), i te wa e tuku ana i nga paatete IP kupenga-a-rohe kia tae ki te kuaha pouara rohe mo te 60 hēkona i muri i te hononga Wi-Fi.
7. Whakatuwhera Tohuaki Tono (cmd.exe), momo ipconfig, ka titiro ki te Waahi Taunoa IP wāhitau kei raro Wireless LAN adapter Wi-Fi (hei tauira, 172.16.0.1 ranei 192.168.20.1).
8. Whakatuwherahia to kaitirotiro ka pato http://172.16.0.1 (whakamahi http://, kore rawa https://, me nga tau tika mai i to Waahi Taunoa) ki te pae wāhitau. Ka pa atu tenei ki te kaiwhakahaere tomokanga o te hotera ma te IP me te kore e hiahia ki te whakatau DNS, ka puta ake te mata takiuru.
9. ** Tikanga 3 - Whakamahia te Paatene Zscaler / GlobalProtect / AnyConnect "Whakatuwherahia te Puka Mauhere" me te Whakahou Ratonga ranei:**
10. I te Zscaler Client Connector (ZCC): Whakatuwherahia te matapihi Zscaler mai i te paepae punaha, pawhiria More -> Troubleshoot -> Restart Service (kaore e hiahiatia he kupuhipa me te whakatuwhera i te 30-hekona te matapihi rapunga hopu-waahi i te wa o te arataki ano).
11. Kei roto i te Palo Alto GlobalProtect: Patohia te rarangi-toru tahua i te taha matau o runga o te pahū-ake GlobalProtect paepae -> Settings -> General -> mena kei te kii te mana "Kua kitea te Puka Whakapumau," paatohia te puru Remediate patene hei whakarewa i te pouaka-kirikiri a GlobalProtect.

2. Whakatikatika "Zombie VPN Adapter / Kua pakaru DNS Loopback (127.0.0.1 ranei 100.64.0.1)" I muri i te tukinga¶

He aha mena kei te kaainga koe i runga i to Wi-Fi noa, a i muri i te mate o to pākahiko pona, i te pakaru ranei i te wa e hono ana koe ki te VPN umanga, ka tiimata to pona ki te kore DNS taumira (e kii ana nga paetukutuku DNS_PROBE_FINISHED_NXDOMAIN, a kaore e taea e koe te whakatau i te ingoa rohe tūmau VPN umanga ki te hono ano i te VPN)?

Ka puta tenei ina tukinga te kaihoko VPN me te kore e whakahoki maemae i nga tautuhinga DNS o to kaari Wi-Fi, ka waiho to urutau whatunga kia tohu tonu ki tetahi IP mariko kua mate (100.64.0.1 mo Zscaler / Tailscale CGNAT ranei 127.0.0.1):

1. Whakapuruhia te Keteroki DNS Windows me te Putumōhio Winsock (Ka Mahi Kore he Mana Whakahaere mo te DNS Flush):
2. Whakatuwheratia te Tohuaki Whakahau ka oma ipconfig /flushdns.
3. Rere nslookup vpn.yourcompany.com 8.8.8.8 (whakakapi vpn.yourcompany.com me te ingoa manaaki kuaha VPN o to kamupene). Ma te apiti 8.8.8.8 ki te mutunga o te nslookup Ko te whakahau, ka hipa koe i te kaiwhakatau DNS rohe pakaru o to pona, ka patai tika ki te DNS whanui a Google (mehemea kei te tuwhera te tauranga 53) ki te ako i te wahitau IP mata o to keeti VPN umanga.
4. Hono ki te Waahi VPN Corporate Ma te whakamahi i tana Wāhitau IP Tau Raw:
5. Mena ka rahua a Cisco AnyConnect, GlobalProtect ranei me "Kare e taea te whakatau i te wahitau tūmau," whakapiri i te wāhitau IP tau mata (203.0.113.50) ki te pouaka tūmau VPN (mehemea ka whakaaetia e te kaupapa here) waea atu ranei ki a IT ki te tiki Zscaler / VPN App-Profile Mono Kupuhipa hei tautuhi i te urutau whatunga mariko (ncpa.cpl).

Tauari 3: Te Whakaora mai i te EDR Kernel Driver Blue Screen (BSOD) Bootloop¶

I te Hūrae 2024, he whakahōu whirihoranga hongere muhu i tukuna ki te CrowdStrike Falcon Windows pūoko (csagent.sys / Channel File 291) na te 8.5 miriona hinonga mihini Windows puta noa i te ao ka tukituki PAGE_FAULT_IN_NONPAGED_AREA Blue Screen of Death bootloop i mua i te hono atu o te punaha whakahaere ki te ipurangi ki te tango whakatika. He rite tonu nga bootloops ka puta ina SentinelOne (SentinelMonitor.sys), Microsoft Defender (WdFilter.sys), ko VPN NDIS tātari taraiwa ranei ka tuki ki te whakahōunga whakahiatotanga o Windows.

Na te mea kua whirihorahia te taraiwa pakaru hei BOOT_START (Start = 0) atekōkiri kernel, ka utaina e Windows ki roto i te mahara i te tuarua tuatahi o te whawhai - i mua i te tiimata o te Wi-Fi, te whakahaere kapua ranei. Ko te huarahi anake hei whakatika a BOOT_START Ko te bootloop atekōkiri kernel kei te rohe mā te Taiao Whakaora Windows (WinRE)

+-----------------------------------------------------------------------+
|  HOW TO BREAK AN EDR KERNEL DRIVER BSOD BOOTLOOP VIA WinRE            |
|                                                                       |
|  1. Force-interrupt boot 2-3 times (or hold Shift + Restart on        |
|     Recovery screen) until "Choose an option" blue menu appears.      |
|  2. Click Troubleshoot -> Advanced options -> Command Prompt          |
|     (or Startup Settings -> F4/F5 Safe Mode).                         |
|  3. Read the 8-character "Recovery Key ID" on screen to your IT       |
|     Helpdesk over the phone -> Type the 48-digit BitLocker Key.       |
|  4. In WinRE Command Prompt, locate the Windows partition (`C:` or    |
|     `D:`), delete the corrupted `.sys` channel file or rename the     |
|     faulty driver folder, and type `wpeutil reboot`.                  |
+-----------------------------------------------------------------------+

Whakaora WinRE-a-Taahi-taahiraa-a-rohe (Arahihia me to Paepae awhina IT i runga i te Waea)¶

1. ** Whakauruhia te Taiao Whakaora Windows (WinRE):**
2. I muri i nga putu e rua i rahua, Windows 10 me Windows 11 ka whakaatu aunoa i te mata puru Whakaora ("Te ahua nei kaore i tika te utaina a Windows").
3. Pāwhiri See advanced repair options -> Troubleshoot -> Advanced options -> Command Prompt (he tere ake, me iti ake te whakaara ano i te Aratau Haumaru).
4. Wewete i te Puku Whakamuna Ki To 48-Digit BitLocker Whakaora Kī:
5. Na te mea kua whakamunatia to puku puku umanga ki te BitLocker, ka whakaatu tonu a WinRE i tetahi mata kikorangi e kii ana: "Whakauruhia te taviri whakaora mo tenei puku" me te Key ID (8 tohu hexadecimal, penei i te A1B2C3D4).
6. Waea atu ki te IT Helpdesk o to kamupene i runga i to waea atamai, panuihia te Ingoa Kaihautū / Tohu Rawa o to pona me te 8-puāhua BitLocker Key ID, ka tono hoki te kaitoi ki te panui i te 48-mati nama BitLocker Recovery Key (kua whakarōpūhia kia waru poraka o 6 mati). Patohia nga mati 48 ka pehi Enter.
7. Tautuhia Ko te Reta Puku e pupuri ana i to whakaurunga Matapihi ki roto o WinRE:
8. I roto i te taiao whakaora WinRE, ko to puku Windows matua he reta puku D:ranei E: hei utu mo C: (na te mea ka mau te wahanga huna EFI/Whakaora C:).
9. Momo dir C:\Windows me te pehi Enter. Mena e kii ana File Not Found, momo dir D:\Windows kia kitea ra ano te reta puku kei roto to Windows kōpaki.
10. Whakamahia te Muku Kōnae Hongere Whakamanahia e te Kaihoko, Whakaingoa Whakaingoa Atekōkiri ranei (Ia Tohutohu IT):
11. Mo te Whakahoutanga Kōnae Hongere CrowdStrike Kino: Whakatere ki te raarangi taraiwa CrowdStrike (cd /d C:\Windows\System32\drivers\CrowdStrike ranei D:\Windows\System32\drivers\CrowdStrike), manatokohia te konae hongere kino kua tohua e to roopu IT (hei tauira, del C-00000291*.sys), ka pehi Enter. No te hongere .sys Ko nga konae he whakahou ture hihiri, kaua ko te matua csagent.sys te miihini, te whakakore i te konae hongere kino ka taea e Windows me te pūoko Falcon te peke ma te horoi me te tango i te konae hongere tuturu mai i te kapua.
12. Mo te VPN Tuatoru-Tuatoru, Atekōkiri Tātari Haumarutanga ranei: I te tohutohu a to kaiwhakahaere IT, whakaingoa ano te tukinga motuhake .sys taraiwa (ren C:\Windows\System32\drivers\<FaultyDriver>.sys <FaultyDriver>.sys.bak) mono ranei tana uara timata ratonga i roto i te rehita tuimotu (reg load HKLM\OfflineSystem C:\Windows\System32\Config\SYSTEM), ka pato wpeutil reboot ki te timata ano ki Windows.

Nga nama ohorere a rohe me nga tikanga umanga¶

Ahakoa ko te taratahi pona pona a te kaimahi mamao ko te nuinga o te wa he pakanga teka, he paopao mauhere ranei, ma te katinga EDR ohorere, te ngaru BSOD ranei puta noa i nga hoa mahi maha ka tohu i te korenga o te kaihoko o te ao, i tetahi mahi ransomware hinonga kaha ranei:

• Te Hononga o Amerika me Kanata: Mena ka pa te taratahi EDR, te bootloop papatipu ranei 911 nga pokapu tuku, nga teihana mahi haumanu o te hohipera, nga ruuma whawhati tata, me nga hanganga waka rererangi/whakawhitinga, me whakahohe tonu i te rohe ** Tonu o nga Mahi (COOP) / Nga Kawa Pepa Raro ** ka waea atu ki te 911 mo nga ohorere ora-haumaru. Ripoata atu i nga maiki ipurangi tino nui-hanganga nui ki CISA (Cybersecurity and Infrastructure Security Agency) i 1-844-SAY-CISA (1-844-729-2472 ranei cisa.gov/report) me te Canadian Center for Cyber ​​Security i 1-833-CYBER-88.
• United Kingdom: Waea 999 mo nga aitua ohorere. Ko nga aitua ipurangi hinonga me nga kaupapa pupuri ransomware e pa ana ki nga whakahaere UK me panui ki te National Cyber ​​Security Center (NCSC) mā ncsc.gov.uk.
• Uniana Pakeha: Waea 112 mo nga ratonga ohorere. I raro i te EU NIS2 Directive (Directive (EU) 2022/2555) me GDPR Tuhinga 33, me whakaatu e nga hinonga o te rangai arohaehae nga raruraru whakahaere nui, nga maiki haumarutanga ranei ki o raatau motu CSIRT (Te Roopu Whakautu Whakautu Haumaru Rorohiko) me ENISA.
• Ahitereiria me Aotearoa: Waea mai ki a 000 i Ahitereiria, 111 ranei i Aotearoa mo nga ratonga ohorere. Tukuna atu nga mahi mo te whakangao i te umanga ipurangi me te tango moni ki te Australian Signals Directorate's Australian Cyber ​​Security Centre (ASD ACSC) i 1300 CYBER1 (1300 292 371) ranei CERT NZ / NCSC NZ.
• India me Ahia-Kiwa: Waea 112 i Inia (ka whakaatu i nga aitua ipurangi whakahaere ki CERT-In), 119 i Hapani me Korea ki te Tonga, 995 ranei i Singapore (SingCERT). Mo nga nama ohorere o te ao, tirohia tau ohorere.

Pātai auau¶

He aha te take i taratahi ai a CrowdStrike Falcon, SentinelOne ranei i taku pona mahi i te mea kaore au i mahi kino?¶

Ko nga Kaipupuri Whakamutunga Whakamutunga me te Whakautu (EDR) o naianei kaore i te tirotiro noa mo nga waitohu huaketo e mohiotia ana; ka aro turuki ratou i te whanonga o te wa-tuituru, te werohanga mahara, me nga tautohetohe raina-whakahau ma te whakamahi heuristic whanonga (`IOAs` - Tohu Whakaeke). Ko nga mahi tika noa e tere haere aunoa ana i te EDR Network Containment ko nga kaiwhakawhanake rorohiko e whakahaere ana i nga tuhinga hanga-a-rohe kaore i hainatia, i nga kaipatu ranei, nga kaimahi IT e whakahaere ana. `nmap` Ko nga whakahau rapu whatunga PowerShell ranei, me te hono ki tetahi papapātuhi tonotono ahua rapa-ducky USB kore mana, te hono ranei ki tetahi pouara Wi-Fi hotera kua whirihora pohehe e whakaoho ana i nga ture whakamarumaru ARP-spoofing / Man-in-the-Middle. Ma te waea atu ki to SOC ka taea e tetahi kaitätari te tirotiro i te räkau mahi me te whakamärama i to mahi i roto i nga meneti.

Mena kei roto taku pona i roto i te EDR Network Containment, ka taea tonu e taku roopu IT te kite i taku mata, te whakakore ranei i te taratahi i ahau?¶

Ae, i te mea kei te hono tonu to pona ki te whatunga Wi-Fi mahi (pēnei i to pouara kaainga, i te hotspot pūkoro ranei o to waea atamai). Ina tukuna e CrowdStrike Falcon, SentinelOne, Microsoft Defender ranei mo Endpoint he pona ki roto i te Whatunga Whatunga, ka aukatihia e te atekōkiri tātari kernel te katoa o nga hokohoko a nga kaiwhakamahi i te wa e tuwhera ana tetahi kauhanga whakahaere TLS whakamunatia i waenga i te pukoro EDR o te pona me te papatohu kapua. Na roto i taua kauhanga whakahaere, ka taea e to kaitirotiro SOC te whakatuwhera i tetahi anga tātaritanga mamao (`Real Time Response` i CrowdStrike ranei `Live Response` i roto i te Defender) ka paato i te "Whakaarahia te Whakanoho" ki te whakahoki i to urunga whatunga i roto i te 30 hēkona me te kore koe e pato i tetahi mea.

He aha te take i tono ohorere ai taku pona mahi mo te Kī Whakaora BitLocker 48-mati i taku whakaurunga ki roto i te kaupane hotera, te teihana tauranga USB-C ranei?¶

Ka whakamahia e nga rorohiko rorohiko a te hinonga Windows te maramara **Trusted Platform Module (TPM 2.0)** a te papahoa papa ki te ine i te taputapu tika me te whirihoranga o mua i te whakaohooho (**Rihita Whirihoranga Pūhara `PCR 0, 2, 4, 7, 11`**) ia wa ka pehi koe i te paatene mana. Mena ka whakauru koe ki te tauranga whatitiri, ki te puku USB o waho, ki te tari tirotiro ranei e whakarereke ana i te ota whawhai UEFI, te tahora pahi PCIe DMA ranei i mua i nga putu Windows, ka kitea e te TPM he huringa inenga taputapu me te kore e whakaae ki te tuku aunoa i te taviri wetemuna, me te tono mo to 48-mati BitLocker Recovery Key hei whakamarumaru mo te tahae. Tuatahi, **tangotia nga taputapu USB katoa, tauranga, me nga taura HDMI ka whakaara ano i te pona anake** - 90 paiheneti o te wa, ka rite ano te inenga TPM me nga putu pona ki roto tonu i te Matapihi me te kore e hiahia ki te kii 48-mati.

Ka taea e au te whakakore i te Kaihono Kaihoko Zscaler, Cisco AnyConnect, GlobalProtect ranei ahau ma te whakamahi i te Kaiwhakahaere Mahi Windows?¶

Kao, i runga i te pona umanga kua whirihora tika, kaore e taea e koe te patu `ZSATray.exe`, `CSFalconService.exe`, `vpnagent.exe`, ranei `PanGPS.exe` mai i te Kaiwhakahaere Mahi. Ko enei apiha haumarutanga e whakahaere ana hei **Tukatuka Tiaki Matapihi (`Protected Process Light / PPL` / `ELAM` Nga ratonga Anti-Malware)** na `SYSTEM` me nga taraiwa tiaki-whaiaro kernel; ahakoa he mana whakahaere a te kaiwhakamahi, ka whakakahore a Windows `Access Denied` i te wa e ngana ana ki te whakamutu i tetahi ratonga haumarutanga PPL me te kore te tuhinga tuhi **Tamper Protection / App-Profile Mono Kupuhipa** i hangaia mai i te papatohu kapua hinonga.

He aha mehemea kei te mahi ahau i tetahi rohe wa rereke ka moe te Papamahi Awhina IT o taku kamupene i te raka o taku pona?¶

Tuatahi, tirohia mena kei to whakahaere he **24/7 Security Operations Center (SOC), On-Call Major Incident Hotline** wehea mai i te Paepae Awhina IT awatea (te nuinga o nga umanga e whakamahi ana i te kirimana CrowdStrike, SentinelOne ranei me te 24/7 Whakahaerehia te Rapu me te Whakautu [`MDR`] kapa, pupuri ranei i te nama whakanekehanga PagerDuty i muri i nga haora kua whakarārangihia ki to ipurangi ipurangi kaimahi, pepa whakauru ranei). Tuarua, mena he **BitLocker Recovery Key te mata o to raka, tirohia mena ka taea e koe te takiuru ki to umanga **Microsoft 365 / Entra ID "My Account" portal (`myaccount.microsoft.com/device-list`)** mai i to kaitirotiro atamai ma te whakamahi i to taupānga whakamotuhēhē MFA - he maha nga kamupene e tuku ana i nga kaimahi ki te tiro i te 48-mati a to ratou ake pona ki te mahi whakaora-whaiaro BitLocker ma te waea pukoro.

He aha taku Wi-Fi kaainga ka mutu te mahi i runga i taku pona mahi i muri tonu i taku momotu i te VPN umanga?¶

Ko etahi o nga whirihoranga VPN rangatōpū e whakamahi ana i tetahi ahuatanga e kiia nei ko **"I nga wa katoa i te taratahi / Tiaki Whatunga Whakawhirinaki (TND)"** e aukati ana i nga urunga ipurangi katoa ina momotuhia te kauhanga VPN i waho o te whare tari umanga tinana, hei aukati i te tangohanga raraunga wehewehe. I etahi atu take, ma te momotu i te VPN ka waiho he wahitau tūmau DNS mariko (`10.x.x.x`) i keteroki ki to urutau Wi-Fi kia kore e taea e to pouara kaainga te whakatau i nga wahitau paetukutuku. Me **hono noa ki te umanga VPN** (whakahaere ranei `ipconfig /flushdns` ka takahuri Wi-Fi ka Weto me te Kia) kia ma o koutou ara waka i roto i te kuaha rangatōpū whai mana.

Nga kaiarahi e pa ana¶

• Mahihia te pona kua tahaetia, kua pakaru ranei i te wa e haere ana: MDM raka me te whakaora kore-kore
• Mahi mamao mai i te hotera
• Pūrua ipurangi me te hononga
• Te haumarutanga mahi mamao ohorere me te tūmataiti raraunga

Nga puna me nga aratohu whai mana¶

• CISA (Cybersecurity and Infrastructure Security Agency): Whakatika i te Whanui Whakamutunga Rapu me te Whakautu (EDR) Kernel Sensor Outages me nga Tikanga Whakaora BitLocker i te Tauine.
• Microsoft Corporation (Microsoft Learn): Arahi Whakaora BitLocker: Raparongoā mo nga Kati Whakamana PCR TPM me te Whakamahi i te Tohuaki Whakahau WinRE ki te Whakatikatika i nga Atekōkiri Whakaara-Araruraru me te Microsoft Defender mo te Whakamutunga Miihini Motuhake Hanganga.
• NIST (National Institute of Standards and Technology): NIST Special Publication 800-207: Zero Trust Architecture (ZTA) me *NIST SP 800-83 Rev.
• CrowdStrike, Inc. & SentinelOne: Falcon Sensor Network Containment Architecture, Nga Tikanga Tango Token Tiaki, me te Tuhinga Whakaora Kōnae Hongere.
• Zscaler & Cisco Pūnaha: Whakahaere i te Rapu Putanga Whakamaunga i roto i te Whakaaetanga Whatunga Kaitiaki Kore-I nga wa katoa (ZTNA) me nga Kaupapahere Paaahi Kati Kati-Kati.