20.500.12556/RUL-180954 Enovrstični napadi: minimalna koda z maksimalnim učinkom One-liner attacks: minimal code with maximum impact Diplomsko delo obravnava zaznavanje večfaznega kibernetskega napada v Windows okolju s poudarkom na uporabi PowerShell enovrstičnih ukazov kot napadalnega mehanizma. Namen raziskave je bil preveriti, v kolikšni meri je mogoče napade, izvedene z uporabo legitimnih sistemskih orodij, učinkovito zaznati s pomočjo večplastne varnostne arhitekture ter jih preslikati v standardizirani okvir MITRE ATT&CK. V okviru študije primera je bilo vzpostavljeno izolirano laboratorijsko okolje, ki je vključevalo napadalni sistem Kali Linux, odjemalsko napravo Windows 10, strežnik Windows Server 2019 ter zaznavna sistema Wazuh (SIEM) in Security Onion (NDR). Simuliran je bil celovit napadalni scenarij, ki je obsegal faze izvidništva, pridobivanja poverilnic, napada z ugibanjem gesel, lateralnega gibanja in oddaljenega izvajanja kode. Vse ključne aktivnosti so bile izvedene z uporabo PowerShell enovrstičnih ukazov, ki so omogočili izvajanje napadalnih dejanj brez potrebe po kompleksni zlonamerni programski opremi ali izkoriščanju programske ranljivosti. Rezultati raziskave so pokazali, da je mogoče z ustrezno konfiguracijo SIEM-sistema, korelacijo dogodkov ter kombinacijo na gostitelju in omrežju temelječe zaznave uspešno identificirati posamezne faze napada ter jih povezati v smiselno napadalno verigo. Analiza potrjuje, da je zaznavanje napadov, ki temeljijo na zlorabi legitimnih administrativnih orodij, odvisno predvsem od vedenjske analize, pravilne konfiguracije nadzornih mehanizmov in uporabe standardiziranih modelov groženj. Ugotovitve poudarjajo, da enovrstični pristop predstavlja resno varnostno tveganje zaradi svoje preprostosti, prenosljivosti in možnosti zlorabe tudi prek socialno-inženirskih tehnik. This thesis examines the detection of a multi-stage cyber attack in a Windows environment with a particular focus on the use of PowerShell one-liners as an attack mechanism. The objective of the research was to evaluate to what extent attacks executed through legitimate system tools can be effectively detected using a multi-layered security architecture and mapped to the standardized MITRE ATT&CK framework. A controlled laboratory environment was established for the case study, consisting of a Kali Linux attacker machine, a Windows 10 workstation, a Windows Server 2019 system, and detection platforms Wazuh (SIEM) and Security Onion (NDR). A comprehensive attack scenario was simulated, including the phases of discovery, credential access, brute-force attack, lateral movement, and remote code execution. All major attack activities were performed using PowerShell one-liners, demonstrating that complex attack chains can be executed without deploying sophisticated malware or exploiting software vulnerabilities. The results indicate that, with proper SIEM configuration, event correlation, and the integration of host-based and network-based detection mechanisms, individual attack phases can be successfully identified and correlated into a coherent attack chain. The study confirms that detecting attacks based on the abuse of legitimate administrative tools relies primarily on behavioral analysis, appropriate configuration of monitoring systems, and the application of standardized threat models. The findings emphasize that the one-liner approach represents a significant security risk due to its simplicity, portability, and potential for abuse through social engineering techniques. Enovrstični napadi PowerShell SIEM MITRE ATT&CK One-liner Attacks PowerShell one-liners SIEM MITRE ATT&CK true false false Slovenski jezik Angleški jezik Diplomsko delo/naloga 2026-03-20 12:00:20 2026-03-20 12:00:28 2026-04-07 14:22:32 0000-00-00 00:00:00 2026 0 0 0000-00-00 NiDoloceno NiDoloceno NiDoloceno 0000-00-00 0000-00-00 0000-00-00 63211 274411267 Vidic_Matej_-_Enovrsticni_napadi_minimalna_koda_z_maksimalnim_ucinkom.pdf Vidic_Matej_-_Enovrsticni_napadi_minimalna_koda_z_maksimalnim_ucinkom.pdf 1 D56E583B144C920D8631E91F1A59B3F2 b49c23477521097fd5e037d7c001cb8357301c8d4f059c2bf77ecfbad91fb5c8 ed065fd5-244b-11f1-b0ab-0050569b8976 https://repozitorij.uni-lj.si/Dokument.php?lang=slv&id=230977 Fakulteta za elektrotehniko 0 0 0