Enovrstični napadi: minimalna koda z maksimalnim učinkom

VIDIC, MATEJ (avtor), Sedlar, Urban (mentor)

Diplomsko delo obravnava zaznavanje večfaznega kibernetskega napada v Windows okolju s poudarkom na uporabi PowerShell enovrstičnih ukazov kot napadalnega mehanizma. Namen raziskave je bil preveriti, v kolikšni meri je mogoče napade, izvedene z uporabo legitimnih sistemskih orodij, učinkovito zaznati s pomočjo večplastne varnostne arhitekture ter jih preslikati v standardizirani okvir MITRE ATT&CK. V okviru študije primera je bilo vzpostavljeno izolirano laboratorijsko okolje, ki je vključevalo napadalni sistem Kali Linux, odjemalsko napravo Windows 10, strežnik Windows Server 2019 ter zaznavna sistema Wazuh (SIEM) in Security Onion (NDR). Simuliran je bil celovit napadalni scenarij, ki je obsegal faze izvidništva, pridobivanja poverilnic, napada z ugibanjem gesel, lateralnega gibanja in oddaljenega izvajanja kode. Vse ključne aktivnosti so bile izvedene z uporabo PowerShell enovrstičnih ukazov, ki so omogočili izvajanje napadalnih dejanj brez potrebe po kompleksni zlonamerni programski opremi ali izkoriščanju programske ranljivosti. Rezultati raziskave so pokazali, da je mogoče z ustrezno konfiguracijo SIEM-sistema, korelacijo dogodkov ter kombinacijo na gostitelju in omrežju temelječe zaznave uspešno identificirati posamezne faze napada ter jih povezati v smiselno napadalno verigo. Analiza potrjuje, da je zaznavanje napadov, ki temeljijo na zlorabi legitimnih administrativnih orodij, odvisno predvsem od vedenjske analize, pravilne konfiguracije nadzornih mehanizmov in uporabe standardiziranih modelov groženj. Ugotovitve poudarjajo, da enovrstični pristop predstavlja resno varnostno tveganje zaradi svoje preprostosti, prenosljivosti in možnosti zlorabe tudi prek socialno-inženirskih tehnik.

• Jezik: Slovenski jezik
• Ključne besede: Enovrstični napadi, PowerShell, SIEM, MITRE ATT&CK
• Vrsta gradiva: Diplomsko delo/naloga
• Tipologija: 2.11 - Diplomsko delo
• Organizacija: FE - Fakulteta za elektrotehniko
• Leto izida: 2026
• PID: 20.500.12556/RUL-180954
• COBISS.SI-ID: 274411267
• Datum objave v RUL: 20.03.2026

Sekundarni jezik

• Jezik: Angleški jezik
• Naslov: One-liner attacks: minimal code with maximum impact

Izvleček

This thesis examines the detection of a multi-stage cyber attack in a Windows environment with a particular focus on the use of PowerShell one-liners as an attack mechanism. The objective of the research was to evaluate to what extent attacks executed through legitimate system tools can be effectively detected using a multi-layered security architecture and mapped to the standardized MITRE ATT&CK framework. A controlled laboratory environment was established for the case study, consisting of a Kali Linux attacker machine, a Windows 10 workstation, a Windows Server 2019 system, and detection platforms Wazuh (SIEM) and Security Onion (NDR). A comprehensive attack scenario was simulated, including the phases of discovery, credential access, brute-force attack, lateral movement, and remote code execution. All major attack activities were performed using PowerShell one-liners, demonstrating that complex attack chains can be executed without deploying sophisticated malware or exploiting software vulnerabilities. The results indicate that, with proper SIEM configuration, event correlation, and the integration of host-based and network-based detection mechanisms, individual attack phases can be successfully identified and correlated into a coherent attack chain. The study confirms that detecting attacks based on the abuse of legitimate administrative tools relies primarily on behavioral analysis, appropriate configuration of monitoring systems, and the application of standardized threat models. The findings emphasize that the one-liner approach represents a significant security risk due to its simplicity, portability, and potential for abuse through social engineering techniques.

• Ključne besede: One-liner Attacks, PowerShell one-liners, SIEM, MITRE ATT&CK