{"id":103940,"date":"2018-11-16T20:00:33","date_gmt":"2018-11-17T04:00:33","guid":{"rendered":"https:\/\/unit42.paloaltonetworks.com\/?p=103940"},"modified":"2020-05-21T18:30:54","modified_gmt":"2020-05-22T01:30:54","slug":"unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery","status":"publish","type":"post","link":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/","title":{"rendered":"\u30c6\u30b9\u30c8\uff64\u5175\u5668\u5316\u3001\u914d\u4fe1\u307e\u3067\u306eOilRig\u306e\u4f5c\u6226\u5b9f\u884c\u30b9\u30d4\u30fc\u30c9\u3092\u5206\u6790"},"content":{"rendered":"<h2>\u6982\u8981<\/h2>\n<p>\u653b\u6483\u8005\u306e\u4f5c\u6226\u304c\u3069\u306e\u3088\u3046\u306a\u30b9\u30d4\u30fc\u30c9\u3067\u5c55\u958b\u3055\u308c\u3066\u3044\u304f\u304b\u3092\u653b\u6483\u30e9\u30a4\u30d5\u30b5\u30a4\u30af\u30eb\u306e\u521d\u671f\u6bb5\u968e\u3067\u8003\u5bdf\u3059\u308b\u306b\u306f\u304b\u306a\u308a\u306e\u56f0\u96e3\u304c\u3068\u3082\u306a\u3044\u307e\u3059\u3002\u5075\u5bdf\u30fb\u5175\u5668\u5316\u306e\u3088\u3046\u306a\u653b\u6483\u306e\u521d\u671f\u6bb5\u968e\u3067\u306f\uff64\u6a19\u7684\u306b\u76f4\u63a5\u50cd\u304d\u304b\u3051\u308b\u914d\u4fe1\u6bb5\u968e\u3068\u6bd4\u3079\u308b\u3068\u3001\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u304c\u5206\u6790\u306b\u4f7f\u3048\u308b\u30c7\u30fc\u30bf\u304c\u307e\u3060\u3042\u307e\u308a\u306a\u3044\u304b\u3089\u3067\u3059\u3002<\/p>\n<p>\u3057\u304b\u3057\u306a\u304c\u3089\uff64BONDUPDATER\u3092\u914d\u4fe1\u3057\u305f<a href=\"https:\/\/blog.paloaltonetworks.com\/2018\/09\/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government\/\">\u4e2d\u6771\u306e\u653f\u5e9c\u6a5f\u95a2\u306b\u5bfe\u3059\u308b2018\u5e748\u6708\u306e\u653b\u6483<\/a>\u3092\u7d99\u7d9a\u8abf\u67fb\u3059\u308b\u306a\u304b\u3067\u3001Unit 42\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u306f\u3001OilRig\u306b\u3088\u308b\u30c6\u30b9\u30c8\u6bb5\u968e\u306e\u6d3b\u52d5\u3092\u89b3\u6e2c\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3057\u305f\u3002\u307e\u305f\u3053\u306e\u30c6\u30b9\u30c8\u6bb5\u968e\u306e\u6d3b\u52d5\u304c\uff64\u7d9a\u304f\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u305f\u5175\u5668\u5316\u6e08\u307f\u914d\u4fe1\u6587\u66f8\u306e\u4f5c\u6210\u306b\u3064\u306a\u304c\u3063\u305f\u3053\u3068\u3092\u78ba\u4fe1\u3059\u308b\u306b\u3044\u305f\u308a\u307e\u3057\u305f\u3002<\/p>\n<p>OilRig\u304c\u30c6\u30b9\u30c8\u6d3b\u52d5\u3092\u958b\u767a\u30d7\u30ed\u30bb\u30b9\u306b\u7d44\u307f\u8fbc\u3093\u3067\u3044\u308b\u3053\u3068\u306f\u660e\u3089\u304b\u3067\uff64\u79c1\u305f\u3061\u306f\u4ee5\u524d\u306b\u3082<a href=\"https:\/\/unit42.paloaltonetworks.jp\/unit42-oilrig-actors-provide-glimpse-development-testing-efforts\/\">\u914d\u4fe1\u6587\u66f8<\/a>\u304a\u3088\u3073<a href=\"https:\/\/blog.paloaltonetworks.com\/2017\/12\/unit42-oilrig-performs-tests-twoface-webshell\/\">TwoFace web\u30b7\u30a7\u30eb<\/a>\u3067\u30c6\u30b9\u30c8\u6d3b\u52d5\u3092\u5b9f\u884c\u3057\u305f\u69d8\u5b50\u3092\u89b3\u6e2c\u3057\u3066\u3044\u307e\u3059\u3002\u5f7c\u3089\u306f\u305d\u3053\u3067\uff64\u914d\u4fe1\u6587\u66f8\u3092\u3059\u3053\u3057\u3060\u3051\u4fee\u6b63\u3057\u3001\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u306b\u5e83\u304f\u516c\u958b\u3055\u308c\u3066\u3044\u308b\u30a2\u30f3\u30c1\u30a6\u30a4\u30eb\u30b9 \u30b9\u30ad\u30e3\u30cb\u30f3\u30b0 \u30c4\u30fc\u30eb\u306b\u9001\u4fe1\u3057\u3066\u307f\u3066\uff64\u305d\u308c\u304c\u30de\u30eb\u30a6\u30a7\u30a2\u3068\u5224\u65ad\u3055\u308c\u308b\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u3059\u308b\u3053\u3068\u3067\u3001\u691c\u51fa\u56de\u907f\u65b9\u6cd5\u3092\u7de8\u307f\u51fa\u3059\u3068\u3044\u3046\u30d7\u30ed\u30bb\u30b9\u3092\u30c6\u30b9\u30c8\u6d3b\u52d5\u306b\u7d44\u307f\u5165\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u30aa\u30f3\u30e9\u30a4\u30f3\u306e\u30a2\u30f3\u30c1\u30a6\u30a4\u30eb\u30b9\u30b9\u30ad\u30e3\u30ca\u30fc\u306b\u306f\uff64\u7121\u6599\u3067\u8fc5\u901f\u306b\u30a2\u30f3\u30c1\u30a6\u30a4\u30eb\u30b9\u3092\u30c6\u30b9\u30c8\u3067\u304d\u308b\u3068\u3044\u3046\u5229\u70b9\u304c\u3042\u308b\u4e00\u65b9\uff64\u653b\u6483\u8005\u304c\u30a2\u30f3\u30c1\u30a6\u30a4\u30eb\u30b9 \u30a8\u30f3\u30b8\u30f3\u306b\u3088\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u691c\u51fa\u306b\u3064\u3044\u3066\u5b66\u7fd2\u3059\u308b\u305f\u3081\u306e\u30c4\u30fc\u30eb\u306b\u3082\u306a\u3063\u3066\u304a\u308a\uff64\u7d50\u679c\u7684\u306b\u653b\u6483\u8005\u306b\u300c\u54c1\u8cea\u4fdd\u8a3c\u30b5\u30fc\u30d3\u30b9\u300d\u3092\u63d0\u4f9b\u3057\u3066\u3044\u308b\u304b\u305f\u3061\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>OilRig\u306e\u4f5c\u6226\u5b9f\u884c\u30b9\u30d4\u30fc\u30c9\u3092\u5224\u65ad\u3059\u308b\u305f\u3081\u306b\u3001\u30c6\u30b9\u30c8\u6642\u306b\u4f5c\u6210\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306e\u4f5c\u6210\u6642\u9593\u3001\u914d\u4fe1\u6587\u66f8\u306e\u4f5c\u6210\u6642\u9593\u3001\u653b\u6483\u3067\u30b9\u30d4\u30a2\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0 \u30e1\u30fc\u30eb\u304c\u9001\u4fe1\u3055\u308c\u305f\u6642\u9593\u3092\u6bd4\u8f03\u3057\u307e\u3057\u305f\u3002<\/p>\n<p>OilRig\u306e\u30c6\u30b9\u30c8\u6d3b\u52d5\u306f\u6a19\u7684\u578b\u653b\u6483\u306e\u308f\u305a\u304b6\u65e5\u524d\u306b\u958b\u59cb\u3055\u308c\u30012018\u5e748\u670820\u65e5\u300121\u65e5\u300126\u65e5\u306e3\u56de\u306b\u308f\u305f\u3063\u3066\u30c6\u30b9\u30c8\u304c\u884c\u308f\u308c\u305f\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3057\u305f\u3002\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\u6700\u7d42\u7248\u306e\u30c6\u30b9\u30c8 \u30d5\u30a1\u30a4\u30eb\u4f5c\u6210\u5f8c8\u6642\u9593\u4ee5\u5185\u306b\u914d\u4fe1\u6587\u66f8\u3092\u4f5c\u6210\u3057\u3066\u304a\u308a\u3001\u305d\u306e20\u5206\u5f8c\u306b\u30b9\u30d4\u30a2\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0 \u30e1\u30fc\u30eb\u3092\u4ecb\u3057\u3066\u305d\u306e\u914d\u4fe1\u6587\u66f8\u304c\u914d\u4fe1\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<h3><a id=\"post-103940-oilrig\u306e\u30c6\u30b9\u30c8\u6d3b\u52d5\"><\/a>OilRig\u306e\u30c6\u30b9\u30c8\u6d3b\u52d5<\/h3>\n<p>\u65b0\u3057\u3044Bondupdater<a href=\"https:\/\/blog.paloaltonetworks.com\/2018\/09\/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government\/\">\u30d0\u30fc\u30b8\u30e7\u30f3<\/a>\u3092\u4f7f\u7528\u3057\u305f\u3001\u8105\u5a01\u653b\u6483\u8005\u30b0\u30eb\u30fc\u30d7OilRig\u306b\u3088\u308b\u6700\u8fd1\u306e\u653b\u6483\u3092\u8abf\u67fb\u3057\u3066\u3044\u304f\u306a\u304b\u3067\u3001Unit 42\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u306f\u3001OilRig\u304c\u4f7f\u7528\u3057\u305f\u5225\u306eMicrosoft Office\u6587\u66f8\u304c\u306a\u3044\u304b\u63a2\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u305d\u3053\u304b\u3089\uff64\u540c\u6642\u671f\u306b\u4ed6\u306e\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u305f\u5225\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u898b\u3064\u3051\u308b\u304b\u3082\u3057\u308c\u306a\u3044\u3068\u8003\u3048\u305f\u304b\u3089\u3067\u3059\uff61\u79c1\u305f\u3061\u306f\u6a5f\u80fd\u9762\u306b\u30d5\u30a9\u30fc\u30ab\u30b9\u3059\u308b\u3053\u3068\u306b\u3057\uff64\u6700\u8fd1\u306e\u8abf\u67fb\u3067\u898b\u3064\u304b\u3063\u305f\u30aa\u30ea\u30b8\u30ca\u30eb\u306eOilRig Microsoft\u6587\u66f8\u3092\u6700\u521d\u306e\u8db3\u304c\u304b\u308a\u3068\u3057\u3066\u8abf\u67fb\u7bc4\u56f2\u3092\u5e83\u3052\u3066\u3044\u304d\u307e\u3057\u305f\u3002<\/p>\n<p>Unit 42\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u306f\u3001\u3044\u304f\u3064\u304b\u306e\u516c\u958b\u30a2\u30f3\u30c1\u30a6\u30a4\u30eb\u30b9 \u30c6\u30b9\u30c8 \u30b5\u30a4\u30c8\u306b\u9001\u4fe1\u3055\u308c\u305f11\u306e\u7570\u306a\u308b\u30b5\u30f3\u30d7\u30eb\u3092\u898b\u3064\u3051\u307e\u3057\u305f(\u88681\u53c2\u7167)\u3002\u3053\u308c\u3089\u306e\u30b5\u30f3\u30d7\u30eb\u306f\u3001OilRig\u304c\u958b\u767a\u3068\u30c6\u30b9\u30c8\u306e\u6d3b\u52d5\u4e2d\u306b\u4f5c\u6210\u3057\u305f\u3082\u306e\u306e\u3088\u3046\u3067\u3001\u4e2d\u6771\u653f\u5e9c\u306b\u5bfe\u3059\u308b\u6700\u8fd1\u306eOilRig\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u305f\u914d\u4fe1\u6587\u66f8\u3001 N56.15.doc (7cbad6b3f505a199d6766a86b41ed23786bbb99dab9cae6c18936afdc2512f00) \u3068\u591a\u304f\u306e\u985e\u4f3c\u70b9\u304c\u3042\u308a\u307e\u3057\u305f(\u3053\u308c\u306b\u3064\u3044\u3066\u3082\u88681\u3092\u53c2\u7167\u3057\u3066\u304f\u3060\u3055\u3044)\u3002\u3053\u306e\u30c6\u30b9\u30c8\u3067\u79c1\u305f\u3061\u306f\uff64XLS-withyourface.xls\u304a\u3088\u3073XLS-withyourface \u2013 test.xls\u3068\u3044\u3063\u305f\u6587\u66f8\u306e\u30d5\u30a1\u30a4\u30eb\u540d\u306b\u524d\u8ff0\u306e\u6a19\u7684\u578b\u653b\u6483\u3067\u89b3\u6e2c\u3055\u308c\u305fC2\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3057\u307e\u3057\u305f\u3002\u30e1\u30bf\u30c7\u30fc\u30bf\u3001\u30de\u30af\u30ed \u30b3\u30fc\u30c9\u3001C2\u30c9\u30e1\u30a4\u30f3\u3092\u542b\u3080\u30d5\u30a1\u30a4\u30eb\u540d\u306e\u985e\u4f3c\u70b9\u304b\u3089\u3001\u3053\u308c\u3089\u306e\u30d5\u30a1\u30a4\u30eb\u306f\u30018\u670826\u65e5\u306b\u767a\u751f\u3057\u305f\u6a19\u7684\u578b\u653b\u6483\u3067\u4f7f\u7528\u3059\u308b\u524d\u306bOilRig\u304c\u5b9f\u969b\u306b\u30b3\u30fc\u30c9\u306e\u30c6\u30b9\u30c8\u3067\u4f7f\u7528\u3057\u305f\u3082\u306e\u3068\u8003\u3048\u3089\u308c\u307e\u3059\u3002\u3053\u308c\u3089\u3059\u3079\u3066\u306e\u30c6\u30b9\u30c8 \u30d5\u30a1\u30a4\u30eb\u306fMicrosoft Excel\u6587\u66f8\u3067\u3042\u308b\u306b\u3082\u304b\u304b\u308f\u3089\u305a\u3001\u6a19\u7684\u578b\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u305f\u5b9f\u969b\u306e\u30d5\u30a1\u30a4\u30eb\u306fMicrosoft Word\u6587\u66f8\u3067\u3042\u3063\u305f\u3053\u3068\u306f\u3001\u8208\u5473\u6df1\u3044\u70b9\u3067\u3059\u3002<\/p>\n<table>\n<tbody>\n<tr>\n<td><strong>\u30cf\u30c3\u30b7\u30e5<\/strong><\/td>\n<td><strong>\u6700\u7d42\u5909\u66f4\u65e5\/\u4fdd\u5b58\u65e5<\/strong><\/td>\n<td><strong>\u6700\u521d\u306e\u30d1\u30d6\u30ea\u30c3\u30af\u9001\u4fe1\u3067\u306e\u5e73\u5747\u691c\u51fa\u4ef6\u6570<\/strong><\/td>\n<td><strong>\u30d5\u30a1\u30a4\u30eb\u540d<\/strong><\/td>\n<\/tr>\n<tr>\n<td>6f522b1be1f2b6642c292bb3fb57f523ebedeb04f0d18efa2a283e79f3689a9f<\/td>\n<td>8\/20\/2018 19:30:13<\/td>\n<td>22<\/td>\n<td>XLS-withyourface.xls<\/td>\n<\/tr>\n<tr>\n<td>9b6ebc44e4452d8c53c21b0fdd8311bac10dc672309b67d7f214fbd2a08962ce<\/td>\n<td>8\/20\/2018 19:31:54<\/td>\n<td>16<\/td>\n<td>XLS-withyourface.xls<\/td>\n<\/tr>\n<tr>\n<td>a5bec7573b743932329b794042f38571dd91731ae50757317bdaf9e820ec8d5e<\/td>\n<td>8\/20\/2018 19:38:51<\/td>\n<td>6<\/td>\n<td>XLS-withyourface.xls<\/td>\n<\/tr>\n<tr>\n<td>6719e80361950cdb10c4a4fcccc389c2a26eaab761c202870353fe65e8f954a3<\/td>\n<td>8\/21\/2018 6:24:52<\/td>\n<td>4<\/td>\n<td>XLS-withyourface \u2013 test.xls<\/td>\n<\/tr>\n<tr>\n<td>056ffc13a7a2e944f7ab8c99ea9a2d1b429bbafa280eb2043678aa8b259999aa<\/td>\n<td>8\/21\/2018 7:58:16<\/td>\n<td>18<\/td>\n<td>sss.xls<\/td>\n<\/tr>\n<tr>\n<td>216ffed357b5fe4d71848c79f77716e9ecebdd010666cdb9edaadf7a8c9ec576<\/td>\n<td>8\/21\/2018 8:03:22<\/td>\n<td>5<\/td>\n<td>sss.xls<\/td>\n<\/tr>\n<tr>\n<td>687027d966667780ab786635b0d4274b651f27d99717c5ba95e139e94ef114c3<\/td>\n<td>8\/21\/2018 8:08:36<\/td>\n<td>17<\/td>\n<td>sss.xls<\/td>\n<\/tr>\n<tr>\n<td>364e2884251c151a29071a5975ca0076405a8cc2bab8da3e784491632ec07f56<\/td>\n<td>8\/21\/2018 8:18:36<\/td>\n<td>9<\/td>\n<td>sss.xls<\/td>\n<\/tr>\n<tr>\n<td>66d678b097a2245f60f3d95bb608f3958aa0f5f19ca7e5853f38ea79885b9633<\/td>\n<td>8\/26\/2018 5:43:07<\/td>\n<td>11<\/td>\n<td>sss \u2013 Copy.xls<\/td>\n<\/tr>\n<tr>\n<td>70ff20f2e5c7fd90c6bfe92e28df585f711ee4090fc7669b3a9bd024c4e11702<\/td>\n<td>8\/26\/2018 5:45:04<\/td>\n<td>7<\/td>\n<td>sss \u2013 Copy.xls<\/td>\n<\/tr>\n<tr>\n<td>7cbad6b3f505a199d6766a86b41ed23786bbb99dab9cae6c18936afdc2512f00<\/td>\n<td>8\/26\/2018 13:34:00<\/td>\n<td>38<\/td>\n<td>N56.15.doc<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-size: 10pt;\"><em>\u88681 \u30c6\u30b9\u30c8\u6d3b\u52d5\u4e2d\u306b\u751f\u6210\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u304a\u3088\u3073\u95a2\u9023\u3057\u305f\u6a19\u7684\u578b\u653b\u6483\u3067\u914d\u4fe1\u3055\u308c\u305f\u6587\u66f8<\/em><\/span><\/p>\n<p>\u88681\u306eMicrosoft Excel\u30b9\u30d7\u30ec\u30c3\u30c9\u30b7\u30fc\u30c8\u5185\u306e\u30e1\u30bf\u30c7\u30fc\u30bf\u304b\u3089\u3001OilRig\u958b\u767a\u8005\u306f\u3001\u95a2\u9023\u3057\u305f\u6a19\u7684\u578b\u653b\u6483\u306e6\u65e5\u524d\u3067\u3042\u308b8\u670820\u65e5\u306b\u3053\u308c\u3089\u306e\u30c6\u30b9\u30c8\u6587\u66f8\u306e\u4f5c\u6210\u3092\u958b\u59cb\u3057\u305f\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002OilRig\u304c\u5b9f\u884c\u3057\u305f\u30c6\u30b9\u30c8\u6d3b\u52d5\u306f\u3059\u3079\u30668\u670826\u65e5\u306e\u653b\u6483\u4ee5\u524d\u306b\u767a\u751f\u3057\u3066\u3044\u307e\u3059\u3002\u30c6\u30b9\u30c8\u6d3b\u52d5\u3068\u653b\u6483\u6d3b\u52d5\u3067\u300c\u6700\u7d42\u5909\u66f4\u65e5\u300d\u3092\u76f8\u4e92\u53c2\u7167\u3059\u308b\u3068\u3001\u56f31\u306b\u793a\u3059\u3068\u304a\u308a\uff64\u6d3b\u52d5\u306e\u6642\u7cfb\u5217\u3092\u5bb9\u6613\u306b\u63cf\u304f\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/p>\n<p><img width=\"1110\" height=\"339\"  class=\"wp-image-103941 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-63.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-63.png 1110w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-63-300x92.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-63-1024x313.png 1024w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-63-768x235.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-63-900x275.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-63-370x113.png 370w\" sizes=\"(max-width: 1110px) 100vw, 1110px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f31 \u30c6\u30b9\u30c8\u304a\u3088\u3073\u653b\u6483\u306e\u6d3b\u52d5\u306e\u6642\u7cfb\u5217<\/em><\/span><\/p>\n<p>\u307e\u305f\uff64\u56f32\u306e\u56f3\u8868\u306f\u30018\u670820\u65e5\u30688\u670822\u65e5\u306b\u30a2\u30f3\u30c1\u30a6\u30a4\u30eb\u30b9 \u30a8\u30f3\u30b8\u30f3\u304c\u7e70\u308a\u8fd4\u3057XLS-withyourface.xls\u3092\u30de\u30eb\u30a6\u30a7\u30a2\u3068\u3057\u3066\u691c\u51fa\u3057\u305f\u69d8\u5b50\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002\u7d9a\u304f7\u5206\u9593\u3067\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\u3055\u3089\u306b2\u3064\u306e\u30b5\u30f3\u30d7\u30eb\u3092\u4f5c\u6210\u3057\u3001\u305d\u308c\u3089\u306e\u691c\u51fa\u306f\u3001\u305d\u308c\u305e\u308c16\u4ef6\u304b\u30896\u4ef6\u306b\u6e1b\u3063\u3066\u3044\u307e\u3059\u3002\u6700\u7d42\u7684\u306b\u691c\u51fa\u4ef6\u6570\u306f8\u670821\u306b\u6700\u5c0f\u3068\u306a\u308a\u307e\u3059\u304c\u3001\u3053\u308c\u304c\u6a19\u7684\u578b\u653b\u6483\u306e5\u65e5\u524d\u3067\u3059\u3002\u56f31\u306e\u6642\u7cfb\u5217\u304b\u3089\uff648\u670821\u65e5\u30688\u670826\u65e5\u306e\u9593\u3067\u30c6\u30b9\u30c8\u6d3b\u52d5\u306b\u8c37\u304c\u898b\u3089\u308c\u307e\u3059\u3002\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3053\u306e\u9593\u6d3b\u52d5\u3092\u505c\u6b62\u3057\u3066\u3044\u305f\u306e\u3067\u3059\u3002\u3057\u304b\u3057\u30018\u670826\u65e5\u306e\u653b\u6483\u76f4\u524d\u306b\u6d3b\u52d5\u306f\u518d\u958b\u3055\u308c\u3001Excel\u6587\u66f8\u304c\u5909\u66f4\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u6700\u5f8c\u306e\u7e70\u308a\u8fd4\u3057\u30c6\u30b9\u30c8\u306f\u3001\u6a19\u7684\u578b\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u305fWord\u914d\u4fe1\u6587\u66f8\u306e\u4f5c\u6210\u6642\u9593\u304b\u30898\u6642\u9593\u524d\u4ee5\u5185\u306b\u884c\u308f\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img width=\"974\" height=\"612\"  class=\"wp-image-103943 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-64.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-64.png 974w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-64-300x189.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-64-768x483.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-64-900x566.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-64-370x232.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f32 \u30c6\u30b9\u30c8\u306e\u5404\u7e70\u308a\u8fd4\u3057\u306e\u3067\u5b9f\u884c\u3055\u308c\u305f\u633f\u5165\u304a\u3088\u3073\u524a\u9664\u3068\u6bd4\u8f03\u3057\u305f\u691c\u51fa\u7387<\/em><\/span><\/p>\n<p>\u56f32\u306e\u56f3\u8868\u3067\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306b\u3088\u308b\u30c6\u30b9\u30c8\u306e\u5404\u7e70\u308a\u8fd4\u3057\u3067\u306e\u30b9\u30d7\u30ec\u30c3\u30c9\u30b7\u30fc\u30c8\u306e\u5909\u66f4\u306b\u4f34\u3063\u3066\u3001\u691c\u51fa\u7387\u304c\u4e0a\u304c\u3063\u305f\u308a\u3001\u4e0b\u304c\u3063\u305f\u308a\u3057\u3066\u3044\u308b\u306e\u304c\u308f\u304b\u308a\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u691c\u51fa\u7387\u306e\u5909\u5316\u306b\u3088\u3063\u3066\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\u30d5\u30a1\u30a4\u30eb\u306e\u5909\u66f4\u5ea6\u5408\u3044\u306b\u3088\u3063\u3066\u691c\u51fa\u3055\u308c\u308b\u304b\u3069\u3046\u304b\u3092\u5224\u65ad\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u3053\u306e\u30c6\u30b9\u30c8\u6d3b\u52d5\u3092\u5206\u6790\u3059\u308b\u306b\u5f53\u305f\u308a\u3001\u5f0a\u793e\u306f\u5404\u7e70\u308a\u8fd4\u3057\u3067\u5b9f\u884c\u3055\u308c\u305f\u5909\u66f4\u306e\u6570\u3092\u6bd4\u8f03\u3057\u307e\u3057\u305f\u3002\u7279\u306b\u3001GitHub\u30d5\u30a1\u30a4\u30eb\u5dee\u5206\u306b\u57fa\u3065\u304f\u3001\u633f\u5165\u884c\u6570\u304a\u3088\u3073\u524a\u9664\u884c\u6570\u3068\u691c\u51fa\u4ef6\u6570\u3092\u6bd4\u8f03\u3057\u3066\u3001\u5909\u66f4\u91cf\u304c\u691c\u51fa\u7387\u306b\u660e\u3089\u304b\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u304b\u3069\u3046\u304b\u3092\u5224\u65ad\u3057\u307e\u3057\u305f\u3002\u56f32\u3067\u306f\u3001\u308f\u305a\u304b\u3057\u304b\u5909\u66f4\u3055\u308c\u3066\u3044\u306a\u3044\u7e70\u308a\u8fd4\u30571\u304a\u3088\u30732\u3067\u306f\u3001\u691c\u51fa\u4ef6\u6570\u304c\u591a\u304f\u6e1b\u308a\u3001\u5909\u66f4\u304c\u591a\u3044\u7e70\u308a\u8fd4\u30573\u304a\u3088\u30734\u3067\u306f\u3001\u691c\u51fa\u4ef6\u6570\u304c\u5c11\u3057\u3057\u304b\u6e1b\u3089\u306a\u3044\u3001\u3042\u308b\u3044\u306f\u5927\u304d\u304f\u5897\u52a0\u3059\u308b\u3068\u3044\u3046\u7d50\u679c\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u30cf\u30a4\u30ec\u30d9\u30eb\u3067\u8003\u5bdf\u3059\u308b\u3068\u3001\u5909\u66f4\u306e\u6570\u91cf\u306f\u5fc5\u305a\u3057\u3082\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306b\u3068\u3063\u3066\u91cd\u8981\u3067\u306f\u306a\u304f\u3001\u691c\u51fa\u7387\u3092\u4e0b\u3052\u308b\u306b\u306f\u5909\u66f4\u306e\u8cea\u304c\u91cd\u8981\u3067\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u691c\u51fa\u3092\u56de\u907f\u3059\u308b\u65b9\u6cd5\u306b\u3064\u3044\u3066\u60c5\u5831\u3092\u5f97\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u8cea\u306e\u5909\u66f4\u4f8b\u306f\u3001\u7e70\u308a\u8fd4\u30572\u306b\u304a\u3051\u308b\u300cwscript\u300d\u3092\u4f7f\u7528\u3057\u3066\u30c9\u30ed\u30c3\u30d7\u3055\u308c\u305fVBScript\u3092\u5b9f\u884c\u3059\u308b\u30b3\u30fc\u30c9\u884c\u306e\u524a\u9664\u3067\u3001\u3053\u308c\u306b\u3088\u3063\u3066\u3001\u691c\u51fa\u7387\u306f16\u4ef6\u304b\u30896\u4ef6\u306b\u6e1b\u3063\u3066\u3044\u307e\u3059\u3002\u6700\u7d42\u7684\u306b\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\u3053\u308c\u3089\u306e\u30c6\u30b9\u30c8\u7e70\u308a\u8fd4\u3057\u304b\u3089\u5f97\u305f\u77e5\u898b\u306b\u3088\u308a\u3001\u3088\u308a\u691c\u51fa\u3055\u308c\u306b\u304f\u304f\u3001\u653b\u6483\u304c\u6210\u529f\u3057\u3084\u3059\u3044\u914d\u4fe1\u6587\u66f8\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002\u5404\u7e70\u308a\u8fd4\u3057\u306b\u304a\u3051\u308b\u5909\u66f4\u306b\u3064\u3044\u3066\u8a73\u3057\u304f\u306f\u3001<a href=\"#post-103940-appendix\">\u4ed8\u9332\u306e\u5206\u6790<\/a>\u3092\u53c2\u7167\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<h3><a id=\"post-103940-oilrig\u306f\u4f55\u3092\u5b66\u3093\u3060\u306e\u304b\"><\/a>OilRig\u306f\u4f55\u3092\u5b66\u3093\u3060\u306e\u304b<\/h3>\n<p>OilRig\u306e\u958b\u767a\u904e\u7a0b\u3067\u3001\u653b\u6483\u8005\u304c\u3001\u958b\u767a\u6280\u6cd5\u3092\u5b66\u3073\u3001\u9069\u5fdc\u3055\u305b\u3066\u3044\u308b\u306e\u306f\u660e\u3089\u304b\u3067\u3059\u3002\u653b\u6483\u8005\u306f\u3001\u5909\u66f4\u3092\u884c\u3044\u3001\u518d\u9001\u4fe1\u3057\u3066\u3001\u30d5\u30a1\u30a4\u30eb\u306e\u7279\u5b9a\u306e\u30b3\u30f3\u30c6\u30f3\u30c4\u304c\u30a2\u30f3\u30c1\u30a6\u30a4\u30eb\u30b9\u691c\u51fa\u3055\u308c\u308b\u304b\u3069\u3046\u304b\u3092\u5224\u65ad\u3059\u308b\u305f\u3081\u3060\u3051\u3092\u76ee\u7684\u3068\u3057\u3066\u3001\u30c6\u30b9\u30c8 \u30b5\u30fc\u30d3\u30b9\u306b\u30d5\u30a1\u30a4\u30eb\u3092\u9001\u4fe1\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u5f0a\u793e\u306f\u89b3\u6e2c\u3057\u3066\u3044\u307e\u3059\u3002OilRig\u653b\u6483\u8005\u306f\u3001\u3053\u306e\u30d7\u30ed\u30bb\u30b9\u3067\u5b66\u3093\u3060\u77e5\u8b58\u3092\u4f7f\u7528\u3057\u3066\u3001\u691c\u51fa\u3092\u56de\u907f\u3059\u308b\u914d\u4fe1\u6587\u66f8\u3092\u958b\u767a\u3057\u3001\u653b\u6483\u306e\u6210\u529f\u7387\u3092\u9ad8\u3081\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>&nbsp;<\/p>\n<p>\u5404\u6587\u66f8\u306e\u5dee\u5206\u6bd4\u8f03\u3092\u884c\u3046\u3053\u3068\u3067\u3001Unit 42\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u306f\u3001\u30b3\u30fc\u30c9\u306e\u5404\u7e70\u308a\u8fd4\u3057\u3092\u8003\u5bdf\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u305d\u306e\u969b\u3001OilRig\u304c\u3069\u306e\u3088\u3046\u306b\u30c6\u30b9\u30c8\u3092\u5b9f\u884c\u3057\u305f\u304b\u3060\u3051\u3067\u306a\u304f\u3001\u653b\u6483\u8005\u304c\u914d\u4fe1\u6587\u66f8\u306e\u691c\u51fa\u7387\u3092\u4e0b\u3052\u308b\u305f\u3081\u306b\u4f55\u3092\u5b66\u3093\u3060\u304b\u3068\u3044\u3046\u89b3\u70b9\u3067\u8003\u5bdf\u3057\u3066\u3044\u307e\u3059\u3002OilRig\u304c\u4f55\u3092\u5b66\u3093\u3060\u304b\u3092\u3059\u3079\u3066\u6319\u3052\u308b\u3053\u3068\u306f\u3067\u304d\u307e\u305b\u3093\u304c\u3001\u4ee5\u4e0b\u306e\u3088\u3046\u306b\u5b66\u3093\u3060\u3068\u4e88\u60f3\u3055\u308c\u308b\u3053\u3068\u3092\u3044\u304f\u3064\u304b\u63a8\u5b9a\u3059\u308b\u3053\u3068\u306f\u53ef\u80fd\u3067\u3059\u3002<\/p>\n<ul>\n<li>\u30c9\u30ed\u30c3\u30d7\u3055\u308c\u305fVBScript\u3092\u5b9f\u884c\u3059\u308b\u7d44\u307f\u8fbc\u307fShell\u95a2\u6570\u306e\u6c4e\u7528\u547c\u3073\u51fa\u3057\u3092\u884c\u3046\u304b\u3069\u3046\u304b\u3067\u30de\u30af\u30ed\u304c\u691c\u51fa\u3055\u308c\u308b\u3053\u3068\u304c\u3042\u308b<\/li>\n<li>Shell\u95a2\u6570\u3092\u4f7f\u7528\u3057\u305f\u975e\u8868\u793a\u30a6\u30a3\u30f3\u30c9\u30a6(vbHide\u30d5\u30e9\u30b0)\u3067\u306e\u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u306f\u3001\u53ef\u8996\u30a6\u30a3\u30f3\u30c9\u30a6(vbNormalFocus\u30d5\u30e9\u30b0)\u3092\u4f7f\u7528\u3057\u305f\u5834\u5408\u3088\u308a\u3082\u591a\u304f\u691c\u51fa\u3055\u308c\u308b<\/li>\n<li>\u30de\u30af\u30ed\u304c\u30b7\u30b9\u30c6\u30e0\u306b\u66f8\u304d\u8fbc\u3080VBScript\u5185\u306b\u6587\u5b57\u5217\u300cpowershell\u300d\u3092\u7d44\u307f\u8fbc\u3080\u3068\u691c\u51fa\u3055\u308c\u308b<\/li>\n<li>Shell\u95a2\u6570\u3092\u4f7f\u7528\u3057\u3066\u5b9f\u884c\u3055\u308c\u308b\u30b3\u30de\u30f3\u30c9\u3067\u300cpowershell\u300d\u6587\u5b57\u5217\u304a\u3088\u3073\u300cwscript\u300d\u6587\u5b57\u5217\u306b\u5bfe\u3057\u3066\u6587\u5b57\u5217\u96e3\u8aad\u5316\u3092\u4f7f\u7528\u3059\u308b\u3068\u3001\u691c\u51fa\u7387\u304c\u4e0b\u304c\u308b<\/li>\n<\/ul>\n<h3><a id=\"post-103940-\u308f\u308c\u308f\u308c\u306f\u4f55\u3092\u5b66\u3093\u3060\u306e\u304b\"><\/a>\u308f\u308c\u308f\u308c\u306f\u4f55\u3092\u5b66\u3093\u3060\u306e\u304b<\/h3>\n<p>OilRig\u304c\u691c\u51fa\u3092\u3046\u307e\u304f\u56de\u907f\u3059\u308b\u65b9\u6cd5\u3092\u5b66\u3093\u3060\u306e\u3068\u540c\u69d8\u306b\u3001\u5f0a\u793e\u3082\u7814\u7a76\u8005\u3068\u3057\u3066\u305d\u308c\u305e\u308c\u306e\u7e70\u308a\u8fd4\u3057\u306b\u7740\u76ee\u3059\u308b\u3053\u3068\u3067\u5b66\u3079\u308b\u3053\u3068\u304c\u3042\u308a\u307e\u3057\u305f\u3002\u5b66\u3073\u306e\u6a5f\u4f1a\u3092\u5f97\u308b\u3053\u3068\u306f\u3001\u8105\u5a01\u653b\u6483\u8005\u306e\u624b\u6cd5\u3068\u80fd\u529b\u306e\u7406\u89e3\u306b\u5f79\u7acb\u3064\u3060\u3051\u3067\u306a\u304f\u3001\u4fdd\u8b77\u30e1\u30ab\u30cb\u30ba\u30e0\u306e\u30d7\u30ed\u30a2\u30af\u30c6\u30a3\u30d6\u306a\u69cb\u7bc9\u306b\u3082\u3064\u306a\u304c\u308a\u307e\u3059\u3002<\/p>\n<p>OilRig\u306b\u3064\u3044\u3066\u306f\u4ee5\u4e0b\u306e\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3057\u305f\u3002<\/p>\n<ul>\n<li>\u6587\u66f8\u306b\u5909\u66f4\u3092\u52a0\u3048\u305f\u5f8c\u3001\u901f\u3084\u304b\u306b\u30d5\u30a1\u30a4\u30eb\u3092\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3057\u3066\u30c6\u30b9\u30c8\u3057\u3066\u304a\u308a\uff64\u30d5\u30a1\u30a4\u30eb\u4f5c\u6210\u304b\u3089\u30c6\u30b9\u30c8\u307e\u3067\u306e\u6642\u9593\u306f\u5e73\u574733\u79d2<\/li>\n<li>\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u304c\u4f55\u5ea6\u3082\u7e70\u308a\u8fd4\u3057\u306a\u304c\u3089\u5909\u66f4\u3092\u52a0\u3048\u308b\u3053\u3068\u3067\u3001\u30de\u30af\u30ed\u304c\u672c\u6765\u610f\u56f3\u3055\u308c\u3066\u3044\u305f\u3088\u3046\u306b\u306f\u6a5f\u80fd\u3057\u306a\u304f\u306a\u3063\u3066\u3044\u305f\u3053\u3068\u304b\u3089\u3001\u30c6\u30b9\u30c8\u306e\u53d6\u308a\u7d44\u307f\u4e2d\u306f\u30de\u30af\u30ed\u306e\u6a5f\u80fd\u306e\u7dad\u6301\u306f\u6c17\u306b\u3057\u3066\u3044\u306a\u3044\u3082\u306e\u3068\u601d\u308f\u308c\u308b<\/li>\n<li>\u30c9\u30ed\u30c3\u30d7\u3057\u305fVBScript\u306e\u5b9f\u884c\u306e\u305f\u3081\u306b\u95a2\u6570\u3092\u5909\u66f4\u3059\u308b\u3060\u308d\u3046\uff61\u5177\u4f53\u7684\u306b\u306fShell\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u304b\u3089\u7d44\u307f\u8fbc\u307f\u306eShell\u95a2\u6570\u3078\u306e\u5909\u66f4\u3092\u884c\u3046\u3068\u601d\u308f\u308c\u308b<\/li>\n<li>\u30b5\u30f3\u30c9\u30dc\u30c3\u30af\u30b9\u56de\u907f\u306e\u305f\u3081\u306b\u30b9\u30ea\u30fc\u30d7\u6a5f\u80fd\u3092\u8ffd\u52a0\u3059\u308b\u3060\u308d\u3046\u3002\u5177\u4f53\u7684\u306b\u306fWait\u95a2\u6570\u3092\u4f7f\u7528\u3059\u308b\u3068\u601d\u308f\u308c\u308b<\/li>\n<li>\u6587\u5b57\u5217\u306e\u5404\u6587\u5b57\u309216\u9032\u5f62\u5f0f\u306b\u7f6e\u304d\u63db\u3048\u3066\u9023\u7d50\u3059\u308b\u306a\u3069\u6587\u5b57\u5217\u306e\u96e3\u8aad\u5316\u6280\u6cd5\u3092\u597d\u3093\u3067\u4f7f\u7528\u3057\u3066\u3044\u308b<\/li>\n<\/ul>\n<p>\u3053\u306e\u5206\u6790\u304b\u3089\u3001OilRig\u653b\u6483\u8005\u304c\u60aa\u610f\u306e\u3042\u308bWord\u6587\u66f8(\u5f0a\u793e<a href=\"https:\/\/blog.paloaltonetworks.com\/2018\/09\/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government\/\">\u30d6\u30ed\u30b0<\/a>\u3067\u8aac\u660e)\u306e\u30d9\u30fc\u30b9\u3068\u3057\u3066\u3001\u60aa\u610f\u306e\u3042\u308bExcel\u6587\u66f8\u304b\u3089\u306e\u30de\u30af\u30ed\u3092\u4f7f\u7528\u3057\u305f\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3057\u305f\u3002\u4ee5\u4e0b\u306e\u985e\u4f3c\u70b9\u306b\u3088\u308a\u3001\u3053\u306e\u30de\u30af\u30ed\u304c\u914d\u4fe1\u6587\u66f8\u306e\u4f5c\u6210\u306b\u4f7f\u7528\u3055\u308c\u305f\u3053\u3068\u3092\u5f37\u304f\u78ba\u4fe1\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<ul>\n<li>\u500b\u3005\u306e\u6587\u5b57\u306e16\u9032\u6570\u5024\u3092\u9023\u7d50\u3057\u305f\u6587\u5b57\u5217\u3067\u8868\u73fe\u3059\u308b\u540c\u3058\u6587\u5b57\u5217\u96e3\u8aad\u5316\u6280\u6cd5\u304c\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u6280\u6cd5\u306f\u3001\u30c6\u30b9\u30c8\u7528Excel\u6587\u66f8\u3068\u3001OilRig\u306e\u6700\u8fd1\u306e\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u305fWord\u6587\u66f8(\u5f0a\u793e\u30d6\u30ed\u30b0\u3067\u8aac\u660e)\u306e\u4e21\u65b9\u306b\u5b58\u5728\u3057\u3066\u3044\u307e\u3059\u3002<\/li>\n<li>\u57cb\u3081\u8fbc\u307f\u306eVBScript\u5185\u306e\u300cpowershell\u300d\u6587\u5b57\u5217\u304a\u3088\u3073\u300ccmd.exe\u300d\u6587\u5b57\u5217\u3092\u6587\u5b57\u5217\u96e3\u8aad\u5316\u6280\u6cd5\u3092\u4f7f\u7528\u3057\u3066\u96e3\u8aad\u5316\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u4e00\u9023\u306e\u30c6\u30b9\u30c8\u6d3b\u52d5\u306e\u300c\u7e70\u308a\u8fd4\u30574\u300d\u3067\u30c6\u30b9\u30c8\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/li>\n<li>\u7d44\u307f\u8fbc\u307f\u306eShell\u95a2\u6570\u3067\u5b9f\u884c\u3055\u308c\u308b\u30b3\u30de\u30f3\u30c9\u3092\u6587\u5b57\u5217\u96e3\u8aad\u5316\u6280\u6cd5\u3092\u4f7f\u7528\u3057\u3066\u96e3\u8aad\u5316\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u4e00\u9023\u306e\u30c6\u30b9\u30c8\u6d3b\u52d5\u306e\u300c\u7e70\u308a\u8fd4\u30578\u300d\u3067\u30c6\u30b9\u30c8\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/li>\n<\/ul>\n<p>OilRig\u653b\u6483\u8005\u306f\u3001\u30c6\u30b9\u30c8\u6d3b\u52d5\u3067\u4f7f\u7528\u3057\u305f\u30de\u30af\u30ed\u306b\u5909\u66f4\u3092\u52a0\u3048\u3066\u3001\u5175\u5668\u5316\u3057\u305f\u914d\u4fe1\u6587\u66f8\u3092\u4f5c\u6210\u3057\u3066\u3044\u308b\u3068\u601d\u308f\u308c\u307e\u3059\u3002\u3053\u3046\u3044\u3063\u305f\u5909\u66f4\u3068\u3057\u3066\u306f\u3001\u300cHGHG\u300d\u3068\u3044\u3046\u95a2\u6570\u3092\u8ffd\u52a0\u3057\u3066\u3001\u96e3\u8aad\u5316\u3057\u305fBONDUPDATER PowerShell\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u30d5\u30a1\u30a4\u30eb\u306b\u4fdd\u5b58\u3059\u308b\u884c\u70ba\u304c\u3042\u308a\u307e\u3059\u3002\u307e\u305f\u3001OilRig\u306f\u3001VBScript\u306e\u4fdd\u5b58\u306b\u4f7f\u7528\u3059\u308b\u5909\u6570\u3092\u3001\u30c6\u30b9\u30c8\u7528Excel\u6587\u66f8\u3067\u78ba\u8a8d\u3055\u308c\u305f\u300cDDDD\u300d\u306e\u4ee3\u308f\u308a\u306b\u3001\u5175\u5668\u5316\u3057\u305fWord\u6587\u66f8\u3067\u306f\u300cA\u300d\u3068\u3044\u3046\u5909\u6570\u306b\u5909\u66f4\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u6700\u5f8c\u306b\u3001OilRig\u653b\u6483\u8005\u306f\u3001\u30de\u30af\u30ed\u304b\u3089\u95a2\u6570\u300cAA\u300d\u3092\u524a\u9664\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u95a2\u6570\u306f\u3001Excel\u306b\u56fa\u6709\u3067Word\u6587\u66f8\u306b\u306f\u4e0d\u8981\u306e\u304a\u3068\u308a\u30b3\u30f3\u30c6\u30f3\u30c4\u304c\u542b\u307e\u308c\u308b\u3068\u601d\u308f\u308c\u308b\u975e\u8868\u793a\u306e\u30b9\u30d7\u30ec\u30c3\u30c9\u30b7\u30fc\u30c8\u3092\u8868\u793a\u3055\u305b\u308b\u3082\u306e\u3067\u3059\u3002<\/p>\n<h2><a id=\"post-103940-\u7d50\u8ad6\"><\/a>\u7d50\u8ad6<\/h2>\n<p>\u653b\u6483\u8005\u3084\u653b\u6483\u30b0\u30eb\u30fc\u30d7\u306f\u3001\u691c\u51fa\u56de\u907f\u306e\u305f\u3081\uff64\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u958b\u767a\u30fb\u5909\u66f4\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u304f\u308c\u308b\u30d5\u30a1\u30a4\u30eb\u3084URL\u306e\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u306b\u516c\u958b\u3055\u308c\u3066\u3044\u308b\u30b9\u30ad\u30e3\u30f3 \u30b5\u30fc\u30d3\u30b9\u3092\u65e5\u5e38\u7684\u306b\u4f7f\u7528\u3057\u3066\u3044\u307e\u3059\u3002\u5f0a\u793e<a href=\"https:\/\/unit42.paloaltonetworks.jp\/unit42-oilrig-actors-provide-glimpse-development-testing-efforts\/\">\u30d6\u30ed\u30b0<\/a>\u3067\u3082\u8aac\u660e\u3057\u305f\u3068\u304a\u308a\uff64\u79c1\u305f\u3061\u306f\u3053\u308c\u307e\u3067\u84c4\u7a4d\u3057\u3066\u304d\u305fOilRig\u306e\u30c6\u30b9\u30c8\u30fb\u958b\u767a\u306b\u95a2\u3059\u308b\u8c4a\u5bcc\u306a\u77e5\u898b\u3092\u3055\u3089\u306b\u6df1\u3081\u3089\u308c\u308b\u3088\u3046\uff64\u4eca\u5f8c\u3082OilRig\u306e\u958b\u767a\u6280\u8853\u306e\u5909\u66f4\u3092\u7d99\u7d9a\u7684\u306b\u76e3\u8996\u3057\u3066\u3044\u304d\u307e\u3059\u3002\u77e5\u898b\u3092\u6df1\u3081\u308b\u3053\u3068\u3067OilRig\u306e\u9ad8\u3044\u653b\u6483\u80fd\u529b\u306b\u3055\u3089\u306b\u30b9\u30dd\u30c3\u30c8\u30e9\u30a4\u30c8\u3092\u3042\u3066\u3001\u653b\u6483\u8005\u305f\u3061\u306e\u3088\u308a\u5b8c\u5168\u306a\u59ff\u3092\u6d6e\u304b\u3073\u4e0a\u304c\u3089\u305b\u308b\u3053\u3068\u304c\u3067\u304d\u308b\u304b\u3089\u3067\u3059\u3002<\/p>\n<p>\u653b\u6483\u30b0\u30eb\u30fc\u30d7\u306e\u958b\u767a\u65b9\u6cd5\u3092\u8a73\u7d30\u306b\u8abf\u67fb\u3059\u308b\u3053\u3068\u306f\u3001\u7814\u7a76\u8005\u306b\u3068\u3063\u3066\u653b\u6483\u8005\u306e\u30c4\u30fc\u30eb\u3001\u6226\u7565\u3001\u304a\u3088\u3073\u624b\u9806\u306e\u7406\u89e3\u3092\u6df1\u3081\u308b\u7d76\u597d\u306e\u6a5f\u4f1a\u3068\u306a\u308a\u307e\u3059\u3002\u30a2\u30af\u30c6\u30a3\u30d6\u306a\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u6700\u7d42\u7684\u306b\u4f7f\u7528\u3055\u308c\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u3068\u958b\u767a\u4e2d\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u6bd4\u8f03\u3059\u308b\u3053\u3068\u3067\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u5404\u7e70\u308a\u8fd4\u3057\u3067\u52a0\u3048\u3089\u308c\u305f\u4fee\u6b63\u3068\u5909\u66f4\u3092\u7406\u89e3\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002\u3055\u3089\u306b\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u81ea\u4f53\u306e\u7279\u5b9a\u306e\u6a5f\u80fd\u5909\u66f4\u3092\u78ba\u8a8d\u3067\u304d\u305f\u5834\u5408\u306f\u3001\u65b0\u3057\u3044\u6a5f\u80fd\u3068\u524d\u306e\u6a5f\u80fd\u3092\u76f8\u95a2\u3055\u305b\u308b\u3053\u3068\u3082\u3067\u304d\u307e\u3059\u3002\u4eca\u56de\uff64\u30c6\u30b9\u30c8\u4e2d\u306b\u4f5c\u6210\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u3068\u5b9f\u969b\u306e\u653b\u6483\u3067\u914d\u4fe1\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306e\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7\u3092\u6bd4\u8f03\u3059\u308b\u3053\u3068\u3067\u3001OilRig\u306e\u4f5c\u6226\u5b9f\u884c\u901f\u5ea6\u306e\u6d1e\u5bdf\u3092\u5f97\u308b\u3053\u3068\u3082\u3067\u304d\u307e\u3057\u305f\u3002OilRig\u304c\u653b\u6483\u306e6\u65e5\u524d\u306b\u30c6\u30b9\u30c8\u6d3b\u52d5\u3092\u958b\u59cb\u3057\u3001\u6587\u66f8\u3092\u4f5c\u6210\u3059\u308b8\u6642\u9593\u524d\u306b\u30c6\u30b9\u30c8\u3092\u7d42\u4e86\u3057\u3001\u6587\u66f8\u3092\u4f5c\u6210\u3057\u305f20\u5206\u5f8c\u306b\u30b9\u30d4\u30a2\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0 \u30e1\u30fc\u30eb\u3067\u653b\u6483\u8005\u304c\u305d\u306e\u6587\u66f8\u3092\u914d\u4fe1\u3057\u305f\u3068\u65ad\u5b9a\u3059\u308b\u3053\u3068\u3082\u3067\u304d\u307e\u3057\u305f\u3002<\/p>\n<p>OilRig\u306f\u5f15\u304d\u7d9a\u304d\u6d3b\u767a\u306a\u52d5\u304d\u3092\u898b\u305b\u3066\u3044\u307e\u3059\u304c\u3001\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306e\u304a\u5ba2\u69d8\u306f\u3001\u3053\u306e\u8105\u5a01\u30b0\u30eb\u30fc\u30d7\u304b\u3089\u4ee5\u4e0b\u306e\u65b9\u6cd5\u3067\u4fdd\u8b77\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<ul>\n<li>AutoFocus\u3092\u3054\u5229\u7528\u306e\u304a\u5ba2\u69d8\u306f\u3001<a href=\"https:\/\/autofocus.paloaltonetworks.com\/#\/tag\/Unit42.Bondupdater_Docs\">Bondupdater_Docs<\/a>\u3067\u30b5\u30f3\u30d7\u30eb\u3092\u8abf\u3079\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/li>\n<li>WildFire\u306f\u73fe\u5728\u306eOilRig Bondupdater_Docs\u30d5\u30a1\u30a4\u30eb\u306b\u3064\u3044\u3066\u3001\u60aa\u610f\u304c\u3042\u308b\u3068\u5224\u65ad\u3057\u305f\u30d5\u30a1\u30a4\u30eb\u3059\u3079\u3066\u3092\u691c\u51fa\u3057\u307e\u3059\u3002<\/li>\n<li>Traps\u306f\u3001Bondupdater_Docs\u306b\u73fe\u5728\u95a2\u9023\u4ed8\u3051\u3089\u308c\u3066\u3044\u308b\u3059\u3079\u3066\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u30d6\u30ed\u30c3\u30af\u3057\u307e\u3059\u3002<\/li>\n<\/ul>\n<h2><a id=\"post-103940-\u4ed8\u9332\"><\/a>\u4ed8\u9332<\/h2>\n<p>\u3053\u306e\u4ed8\u9332\u306b\u306f\u3001\u653b\u6483\u8005\u306b\u3088\u308b\u30c6\u30b9\u30c8\u306e\u4e00\u9023\u306e\u300c\u7e70\u308a\u8fd4\u3057\u300d\u3054\u3068\u306b\u5b9f\u65bd\u3057\u305f\u5206\u6790\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u5404\u7e70\u308a\u8fd4\u3057\u306b\u5bfe\u3059\u308b\u5206\u6790\u3092\u63d0\u793a\u3059\u308b\u524d\u306b\u3001\u88681\u306b\u30d5\u30a1\u30a4\u30eb\u3068\u691c\u51fa\u7387\u306b\u95a2\u3059\u308b\u8ffd\u52a0\u60c5\u5831\u3082\u793a\u3057\u3066\u3042\u308a\u307e\u3059\u3002<\/p>\n<table>\n<tbody>\n<tr>\n<td>&nbsp;<\/p>\n<p><strong>\u30d5\u30a3\u30fc\u30eb\u30c9<\/strong><\/td>\n<td><strong>\u8aac\u660e<\/strong><\/td>\n<\/tr>\n<tr>\n<td>\u30d5\u30a1\u30a4\u30eb<\/td>\n<td>\u52a0\u3048\u3089\u308c\u305f\u5909\u66f4\u5185\u5bb9\u3092\u5224\u5225\u3059\u308b\u305f\u3081\u306b\u6bd4\u8f03\u3057\u305f2\u3064\u306e\u30d5\u30a1\u30a4\u30eb\u306eSHA256\u30cf\u30c3\u30b7\u30e5<\/td>\n<\/tr>\n<tr>\n<td>\u30d5\u30a1\u30a4\u30eb\u540d<\/td>\n<td>\u6bd4\u8f03\u3057\u305f2\u3064\u306e\u30d5\u30a1\u30a4\u30eb\u306e\u30d5\u30a1\u30a4\u30eb\u540d<\/td>\n<\/tr>\n<tr>\n<td>\u6642\u9593\u5dee<\/td>\n<td>\u5404\u30d5\u30a1\u30a4\u30eb\u306e\u30e1\u30bf\u30c7\u30fc\u30bf\u5185\u306b\u898b\u3064\u304b\u3063\u305f\u300cModified\u300d(\u5909\u66f4\u6e08\u307f)\u306e\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7\u540c\u58eb\u306e\u6642\u9593\u306e\u5dee<\/td>\n<\/tr>\n<tr>\n<td>\u691c\u51fa\u7387<\/td>\n<td>\u6bd4\u8f03\u3057\u305f2\u3064\u306e\u30d5\u30a1\u30a4\u30eb\u306e\u691c\u51fa\u7387\u3002\u3053\u308c\u306b\u3088\u3063\u3066\u7279\u5b9a\u306e\u30c6\u30b9\u30c8\u7e70\u308a\u8fd4\u3057\u56de\u3067\u52a0\u3048\u3089\u308c\u305f\u5909\u66f4\u304c\u691c\u51fa\u5168\u4f53\u306b\u53ca\u307c\u3057\u305f\u5f71\u97ff\u3092\u628a\u63e1\u3067\u304d\u307e\u3059<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-size: 10pt;\"><em>\u88681 \u30c6\u30b9\u30c8\u306e\u5404\u7e70\u308a\u8fd4\u3057\u5225\u306e\u8ffd\u52a0\u30c7\u30fc\u30bf<\/em><\/span><\/p>\n<p>\u7e70\u308a\u8fd4\u3057\u5225\u306e\u5206\u6790\u90e8\u5206\u306b\u306f\u3001\u914d\u4fe1\u6587\u66f8\u5185\u306e\u30de\u30af\u30ed\u306b\u52a0\u3048\u3089\u308c\u305f\u5909\u66f4\u306e\u8aac\u660e\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u5909\u66f4\u306f\u3001\u5404\u7e70\u308a\u8fd4\u3057\u3067\u6bd4\u8f03\u3057\u305f2\u3064\u306e\u30d5\u30a1\u30a4\u30eb\u9593\u306e\u5dee\u5206\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3082\u78ba\u8a8d\u3067\u304d\u307e\u3059\u3002\u5dee\u5206\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3001\u80cc\u666f\u304c\u8d64\u3044\u884c\u306f\u30d5\u30a1\u30a4\u30eb\u304b\u3089\u524a\u9664\u3055\u308c\u305f\u3082\u306e\u3067\u3001\u80cc\u666f\u304c\u7dd1\u306e\u884c\u306f\u30d5\u30a1\u30a4\u30eb\u306b\u8ffd\u52a0\u3055\u308c\u305f\u3082\u306e\u3067\u3059\u3002<\/p>\n<h3><a id=\"post-103940-\u7e70\u308a\u8fd4\u30570\"><\/a>\u7e70\u308a\u8fd4\u30570<\/h3>\n<p>\u3053\u306e\u30c6\u30b9\u30c8\u6d3b\u52d5\u306b\u95a2\u9023\u4ed8\u3051\u3089\u308c\u3066\u3044\u308b\u6700\u521d\u306e\u65e2\u77e5\u306e\u30d5\u30a1\u30a4\u30eb\u306f\u3001\u653b\u6483\u8005\u304c\u4f5c\u6210\u3057\u305f\u30aa\u30ea\u30b8\u30ca\u30eb\u6587\u66f8\u3067\u306f\u306a\u3044\u3088\u3046\u3067\u3059\u3002\u305d\u3046\u8003\u3048\u308b\u306e\u306f\u3001\u3053\u306eExcel\u30b9\u30d7\u30ec\u30c3\u30c9\u30b7\u30fc\u30c8\u306b\u306f\u3001\u3053\u306e\u914d\u4fe1\u6587\u66f8\u306e\u524d\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u304b\u3089\u306e\u30a2\u30fc\u30c6\u30a3\u30d5\u30a1\u30af\u30c8\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u3068\u601d\u308f\u308c\u308b__SRP_0\u3068\u3044\u3046\u30b9\u30c8\u30ea\u30fc\u30e0\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u304b\u3089\u3067\u3059\u3002__SRP_0\u30b9\u30c8\u30ea\u30fc\u30e0\u306b\u306f\u3001\u30a2\u30fc\u30c6\u30a3\u30d5\u30a1\u30af\u30c8\u3001\u5177\u4f53\u7684\u306b\u306f\u4e00\u9023\u306ebase64\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u6587\u5b57\u5217\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u6587\u5b57\u5217\u306f\u3001\u30c7\u30b3\u30fc\u30c9\u3055\u308c\u308b\u3068\u3001<a href=\"https:\/\/blog.paloaltonetworks.com\/2018\/09\/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government\/\">2018\u5e748\u6708\u306e\u4e2d\u6771\u653f\u5e9c\u306b\u5bfe\u3059\u308bOilRig\u306e\u653b\u6483\u306b\u95a2\u3059\u308b\u5f0a\u793e\u30d6\u30ed\u30b0<\/a>\u3067\u8aac\u660e\u3057\u305f7cbad6b3f505a199d6766a86b41ed23786bbb99dab9cae6c18936afdc2512f00\u306b\u3088\u3063\u3066\u30c9\u30ed\u30c3\u30d7\u3055\u308c\u305f\u300cAppPool.ps1\u300d\u3068\u3044\u3046BONDUPDATER PowerShell\u30da\u30a4\u30ed\u30fc\u30c9\u306e\u307b\u307c\u5b8c\u5168\u306b\u540c\u3058\u30b3\u30d4\u30fc\u306b\u306a\u308a\u307e\u3059\u3002\u6b21\u306e\u56f32\u3067\u306f\u3001__SRP_0\u304b\u3089\u30c7\u30b3\u30fc\u30c9\u3057\u305fbase64\u6587\u5b57\u5217\u3068\u3001\u5f0a\u793e\u30d6\u30ed\u30b0\u3067\u8aac\u660e\u3057\u305f\u300cAppPool.ps1\u300d\u30d5\u30a1\u30a4\u30eb\u3068\u3092\u6bd4\u8f03\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u6bd4\u8f03\u3067\u306f\u3001\u6539\u884c\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u3068\u30b9\u30da\u30fc\u30b9\u304c\u3042\u308b\u3053\u3068\u306e\u9055\u3044\u4ee5\u5916\u306f\u5b8c\u5168\u306b\u540c\u4e00\u306e\u30b3\u30f3\u30c6\u30f3\u30c4(\u300cwithyourface[.]com\u300dC2\u3092\u542b\u3081)\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002<\/p>\n<p><img width=\"974\" height=\"214\"  class=\"wp-image-103945 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-65.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-65.png 974w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-65-300x66.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-65-768x169.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-65-900x198.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-65-370x81.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f32 \u524d\u306eBONDUPDATER\u30da\u30a4\u30ed\u30fc\u30c9\u3068\u30ad\u30e3\u30c3\u30b7\u30e5\u6e08\u307f\u30b9\u30c8\u30ea\u30fc\u30e0\u304b\u3089\u62bd\u51fa\u3057\u305f\u30da\u30a4\u30ed\u30fc\u30c9\u3068\u306e\u6bd4\u8f03<\/em><\/span><\/p>\n<p>\u3053\u306e\u7279\u5b9a\u306e\u30b5\u30f3\u30d7\u30eb\u3092\u5206\u6790\u3057\u305f\u3068\u304d\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u304cPowerShell\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u60aa\u610f\u306e\u3042\u308bWord\u6587\u66f8(\u5f0a\u793e\u30d6\u30ed\u30b0\u3067\u8aac\u660e)\u304b\u3089\u30b7\u30b9\u30c6\u30e0\u306b\u30c9\u30ed\u30c3\u30d7\u3059\u308b\u65b9\u6cd5\u3092\u5909\u66f4\u3057\u305f\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3057\u305f\u3002\u3053\u306e\u60aa\u610f\u306e\u3042\u308bExcel\u6587\u66f8\u5185\u306e\u30de\u30af\u30ed\u306f\u3001AppPool.ps1\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210\u3059\u308b\u306e\u3067\u306f\u306a\u304f\u3001AppPool.vbs\u3092\u4f5c\u6210\u3059\u308b\u3060\u3051\u3067\u3059\u3002\u305d\u306e\u5f8c\u30de\u30af\u30ed\u306f\u3053\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u300cwscript\u300d\u3092\u4f7f\u7528\u3057\u3066\u5b9f\u884c\u3057\u307e\u3059\u3002\u6b21\u306bVBScript\u306b\u3088\u3063\u3066AppPool.ps1\u304c\u30b7\u30b9\u30c6\u30e0\u5185\u306b\u4f5c\u6210\u3055\u308c\u307e\u3059\u3002\u3053\u308c\u304c\u3001\u524d\u306e\u5f0a\u793e\u30d6\u30ed\u30b0\u3067\u8aac\u660e\u3057\u305fWord\u6587\u66f8\u306e\u624b\u6cd5\u3068\u306e\u4e3b\u306a\u9055\u3044\u3067\u3059\u3002<\/p>\n<p>\u307e\u305f\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\u30b5\u30f3\u30d7\u30eb\u304b\u3089BONDUPDATER\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u5b8c\u5168\u306b\u524a\u9664\u3057\u305f\u3088\u3046\u3067\u3059\u3002AppPool.vbs\u30b9\u30af\u30ea\u30d7\u30c8\u3067\u306f\u3001\u5f8c\u306b\u30c7\u30b3\u30fc\u30c9\u3055\u308c\u3066AppPool.ps1\u30d5\u30a1\u30a4\u30eb\u306b\u4fdd\u5b58\u3055\u308c\u308bbase64\u30a8\u30f3\u30b3\u30fc\u30c9\u5316\u30da\u30a4\u30ed\u30fc\u30c9\u306e\u4fdd\u5b58\u306b\u4f7f\u7528\u3055\u308c\u308b\u300cmysrc\u300d\u3068\u3044\u3046\u7a7a\u306e\u5909\u6570\u304c\u4f7f\u7528\u3055\u308c\u3066\u3044\u308b\u304b\u3089\u3067\u3059\u3002<\/p>\n<p>\u524d\u8ff0\u306e\u3068\u304a\u308a\u3001\u3053\u306e\u30c6\u30b9\u30c8\u6d3b\u52d5\u306f\u5f0a\u793e\u30d6\u30ed\u30b0\u3067\u8aac\u660e\u3057\u305fWord\u914d\u4fe1\u6587\u66f8\u3092\u4f7f\u7528\u3057\u305f\u653b\u6483\u306b\u5148\u7acb\u3064\u3082\u306e\u3068\u78ba\u4fe1\u3057\u3066\u3044\u307e\u3059\u3002\u3055\u3089\u306b\u3001\u3053\u308c\u306f\u8105\u5a01\u30b0\u30eb\u30fc\u30d7\u304c\u5b9f\u65bd\u3057\u305f\u5358\u306a\u308b\u4e00\u9023\u306e\u30c6\u30b9\u30c8\u3067\u306f\u306a\u304b\u3063\u305f\u3053\u3068\u3082\u78ba\u4fe1\u3057\u3066\u3044\u307e\u3059\u3002__SRP_0\u30b9\u30c8\u30ea\u30fc\u30e0\u306b\u5b58\u5728\u3059\u308bBONDUPDATER\u30c4\u30fc\u30eb\u304c\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u304c\u65e2\u306b\u30da\u30a4\u30ed\u30fc\u30c9\u304c\u542b\u307e\u308c\u308b\u6587\u66f8\u3092\u3053\u308c\u3088\u308a\u524d\u306b\u4f5c\u6210\u3057\u3066\u3044\u3066\u3001\u3053\u306e\u30c6\u30b9\u30c8\u6d3b\u52d5\u3067\u306f\u305d\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u524a\u9664\u3057\u3066\u3044\u305f\u3053\u3068\u3092\u793a\u5506\u3057\u3066\u3044\u308b\u304b\u3089\u3067\u3059\u3002\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u304cPowerShell\u30da\u30a4\u30ed\u30fc\u30c9\u306b\u5bfe\u3057\u3066\u30c6\u30b9\u30c8\u6d3b\u52d5\u3092\u4ee5\u524d\u306b\u5b9f\u65bd\u3057\u3066\u3001\u914d\u4fe1\u6587\u66f8\u306e\u30de\u30af\u30ed\u90e8\u5206\u306b\u73fe\u5728\u306e\u30c6\u30b9\u30c8\u6d3b\u52d5\u3092\u9650\u5b9a\u3059\u308b\u305f\u3081\u306b\u305d\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u524a\u9664\u3057\u305f\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<h3><a id=\"post-103940-\u7e70\u308a\u8fd4\u30571\"><\/a>\u7e70\u308a\u8fd4\u30571<\/h3>\n<table>\n<tbody>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb<\/strong><\/td>\n<td>6f522b1be1f2b6642c292bb3fb57f523ebedeb04f0d18efa2a283e79f3689a9f ..9b6ebc44e4452d8c53c21b0fdd8311bac10dc672309b67d7f214fbd2a08962ce<\/td>\n<\/tr>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb\u540d<\/strong><\/td>\n<td>XLS-withyourface.xls -&gt; XLS-withyourface.xls<\/td>\n<\/tr>\n<tr>\n<td><strong>\u6642\u9593\u5dee<\/strong><\/td>\n<td>1\u520641\u79d2<\/td>\n<\/tr>\n<tr>\n<td><strong>\u691c\u51fa\u7387<\/strong><\/td>\n<td>22 -&gt; 16<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u3053\u306e\u7e70\u308a\u8fd4\u3057\u3067\u306f\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f1\u3064\u306e\u30b7\u30f3\u30d7\u30eb\u306a\u5909\u66f4\u3092\u52a0\u3048\u3066\u304a\u308a\u3001\u6587\u5b57\u5217\u300cpowershell.exe\u300d\u3092AppPool.vbs\u30d5\u30a1\u30a4\u30eb\u306b\u8a18\u8ff0\u3055\u308c\u306a\u3044\u3088\u3046\u306b\u524a\u9664\u3057\u3066\u3044\u307e\u3059\u3002\u57fa\u672c\u7684\u306b\u3053\u306e\u5909\u66f4\u306b\u3088\u3063\u3066\u3001VBScript\u304cAppPool.ps1\u3092\u6b63\u5e38\u306b\u5b9f\u884c\u3067\u304d\u306a\u304f\u306a\u308b\u305f\u3081\u3001\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb \u30d7\u30ed\u30bb\u30b9\u304c\u4e2d\u65ad\u3055\u308c\u307e\u3059\u3002\u305f\u3060\u3057\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u691c\u51fa\u304c\u3053\u306e\u6587\u5b57\u5217\u306b\u8d77\u56e0\u3059\u308b\u304b\u3069\u3046\u304b\u3092\u5224\u65ad\u3059\u308b\u305f\u3081\u306b\u3053\u306e\u5909\u66f4\u3092\u52a0\u3048\u3066\u3044\u307e\u3059\u3002\u56f33\u306e\u5dee\u5206\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u306f\u3001\u300cpowershell.exe\u300d\u6587\u5b57\u5217\u304c\u306a\u304f\u306a\u3063\u3066\u3044\u308b\u3053\u3068\u306f\u3059\u3050\u306b\u306f\u308f\u304b\u308a\u307e\u305b\u3093\u304c\u3001\u884c24\u306e\u300cShell0\u300d\u3092\u63a2\u3059\u3068\u3001\u5de6\u306e(\u8d64\u3044)\u30c6\u30ad\u30b9\u30c8\u306b\u306f\u300cpowershell.exe -exec bypass\u300d\u3068\u8868\u793a\u3055\u308c\u3066\u3044\u308b\u306e\u306b\u3001\u53f3\u306e(\u7dd1\u306e)\u30c6\u30ad\u30b9\u30c8\u3067\u306f\u300c-exec bypass\u300d\u3068\u306a\u3063\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002<\/p>\n<p><img width=\"974\" height=\"397\"  class=\"wp-image-103947 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-66.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-66.png 974w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-66-300x122.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-66-768x313.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-66-900x367.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-66-370x151.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f33 \u7e70\u308a\u8fd4\u30571\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u9593\u306e\u5dee\u5206\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8<\/em><\/span><\/p>\n<h3><a id=\"post-103940-\u7e70\u308a\u8fd4\u30572\"><\/a>\u7e70\u308a\u8fd4\u30572<\/h3>\n<table>\n<tbody>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb<\/strong><\/td>\n<td>9b6ebc44e4452d8c53c21b0fdd8311bac10dc672309b67d7f214fbd2a08962ce .. a5bec7573b743932329b794042f38571dd91731ae50757317bdaf9e820ec8d5e<\/td>\n<\/tr>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb\u540d<\/strong><\/td>\n<td>XLS-withyourface.xls -&gt; XLS-withyourface.xls<\/td>\n<\/tr>\n<tr>\n<td><strong>\u6642\u9593\u5dee<\/strong><\/td>\n<td>6\u520657\u79d2<\/td>\n<\/tr>\n<tr>\n<td><strong>\u691c\u51fa\u7387<\/strong><\/td>\n<td>16 -&gt; 6<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u3053\u306e\u7e70\u308a\u8fd4\u3057\u3067\u306f\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001wscript\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3057\u3066AppPool.vbs\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u5b9f\u884c\u3059\u308b\u884c\u3092\u524a\u9664\u3057\u307e\u3057\u305f\u3002\u56f34\u304b\u3089\u308f\u304b\u308b\u3088\u3046\u306b\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\u30b3\u30fc\u30c9\u306e\u884c\u5168\u4f53\u3092\u524a\u9664\u3057\u3001\u65b0\u3057\u3044\u884c\u306b\u7f6e\u304d\u63db\u3048\u307e\u3057\u305f\u3002<\/p>\n<p><img width=\"974\" height=\"131\"  class=\"wp-image-103949 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-67.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-67.png 974w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-67-300x40.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-67-768x103.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-67-900x121.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-67-370x50.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f34 \u7e70\u308a\u8fd4\u30572\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u9593\u306e\u5dee\u5206\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8<\/em><\/span><\/p>\n<h3><a id=\"post-103940-\u7e70\u308a\u8fd4\u30573\"><\/a>\u7e70\u308a\u8fd4\u30573<\/h3>\n<table>\n<tbody>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb<\/strong><\/td>\n<td>a5bec7573b743932329b794042f38571dd91731ae50757317bdaf9e820ec8d5e .. a5bec7573b743932329b794042f38571dd91731ae50757317bdaf9e820ec8d5e<\/td>\n<\/tr>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb\u540d<\/strong><\/td>\n<td>XLS-withyourface.xls -&gt; XLS-withyourface.xls<\/td>\n<\/tr>\n<tr>\n<td><strong>\u6642\u9593\u5dee<\/strong><\/td>\n<td>10\u6642\u959346\u52061\u79d2<\/td>\n<\/tr>\n<tr>\n<td><strong>\u691c\u51fa\u7387<\/strong><\/td>\n<td>6 -&gt; 4<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u3053\u306e\u7e70\u308a\u8fd4\u3057\u3067\u306f\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u30de\u30af\u30ed\u3092\u304b\u306a\u308a\u5927\u5e45\u306b\u5909\u66f4\u3057\u307e\u3057\u305f\u3002\u307e\u305a\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\"C:\\ProgramData\\WindowsAppPool\"\u30d5\u30a9\u30eb\u30c0\u3092\u4f5c\u6210\u3057\u305f\u5f8c\u3001\u3053\u306e\u30d5\u30a9\u30eb\u30c0\u306bAppPool.vbs\u30d5\u30a1\u30a4\u30eb\u3092\u66f8\u304d\u8fbc\u3080\u524d\u306b10\u79d2\u9593\u30b9\u30ea\u30fc\u30d7\u3059\u308b\u30b3\u30fc\u30c9\u306e\u884c\u3092\u5c0e\u5165\u3057\u307e\u3057\u305f\u3002\u3053\u308c\u306f\u56f35\u306e\u884c12\u306b\u3042\u308a\u307e\u3059\u3002\u56f35\u306e\u4e0b\u90e8\u304b\u3089\u56f36\u3078\u7d9a\u304f\u7b87\u6240\u306f\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u304c\u3001\u3053\u306e\u30de\u30af\u30ed\u306e\u524d\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u898b\u3089\u308c\u305fVBScript\u306e\u4ee3\u308f\u308a\u306bbase64\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305fBONDUPDATER PowerShell\u30da\u30a4\u30ed\u30fc\u30c9\u3092DDDD\u5909\u6570\u306b\u8ffd\u52a0\u3057\u305f\u3053\u3068\u3082\u793a\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u3053\u306b\u542b\u307e\u308c\u3066\u3044\u308bbase64\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305fBONDUPDATER\u306f\u3001\u7e70\u308a\u8fd4\u30570\u3067\u8a00\u53ca\u3057\u305f\u6700\u521d\u306e\u30c6\u30b9\u30c8\u30b5\u30f3\u30d7\u30eb\u306e\u30ad\u30e3\u30c3\u30b7\u30e5\u3055\u308c\u305f__SRP_0\u30b9\u30c8\u30ea\u30fc\u30e0\u3068\u5b8c\u5168\u306b\u540c\u3058\u30da\u30a4\u30ed\u30fc\u30c9\u3067\u3059\u3002\u56f37\u3082\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u304c\u3001VBScript\u3092\u5b9f\u884c\u3059\u308b\u305f\u3081\u306b\u7406\u8ad6\u7684\u306b\u4f7f\u7528\u3059\u308b\"wscript.shell\"\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u542b\u3081\u308b\u3088\u3046\u306bShell0\u5909\u6570\u3092\u8a2d\u5b9a\u3059\u308b\u884c\u3092\u524a\u9664\u3057\u305f\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img width=\"974\" height=\"568\"  class=\"wp-image-103951 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-68.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-68.png 974w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-68-300x175.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-68-768x448.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-68-900x525.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-68-370x216.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f35 \u30b9\u30ea\u30fc\u30d7\u30b3\u30fc\u30c9\u3068\u305d\u306e\u4ed6\u306e\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u8ffd\u52a0\u3092\u793a\u3059\u7e70\u308a\u8fd4\u30573\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u9593\u306e\u5dee\u5206\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8<\/em><\/span><\/p>\n<p><img width=\"974\" height=\"614\"  class=\"wp-image-103953 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-69.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-69.png 974w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-69-300x189.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-69-768x484.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-69-900x567.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-69-370x233.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f36 VBScript\u306e\u4fdd\u5b58\u306b\u4f7f\u7528\u3059\u308b\u5909\u6570\u306e\u5909\u66f4\u3092\u793a\u3059\u7e70\u308a\u8fd4\u30573\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u9593\u306e\u5dee\u5206\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8<\/em><\/span><\/p>\n<p><img width=\"974\" height=\"127\"  class=\"wp-image-103955 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-70.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-70.png 974w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-70-300x39.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-70-768x100.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-70-900x117.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-70-370x48.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f37 'wscript.shell'\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u524a\u9664\u3092\u793a\u3059\u7e70\u308a\u8fd4\u30573\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u9593\u306e\u5dee\u5206\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8<\/em><\/span><\/p>\n<h3><a id=\"post-103940-\u7e70\u308a\u8fd4\u30574\"><\/a>\u7e70\u308a\u8fd4\u30574<\/h3>\n<table>\n<tbody>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb<\/strong><\/td>\n<td>6719e80361950cdb10c4a4fcccc389c2a26eaab761c202870353fe65e8f954a3 ..056ffc13a7a2e944f7ab8c99ea9a2d1b429bbafa280eb2043678aa8b259999aa<\/td>\n<\/tr>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb\u540d<\/strong><\/td>\n<td>XLS-withyourface.xls -&gt; sss.xls<\/td>\n<\/tr>\n<tr>\n<td><strong>\u6642\u9593\u5dee<\/strong><\/td>\n<td>1\u6642\u959333\u520624\u79d2<\/td>\n<\/tr>\n<tr>\n<td><strong>\u691c\u51fa\u7387<\/strong><\/td>\n<td>4 -&gt; 18<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u3053\u306e\u7e70\u308a\u8fd4\u3057\u3067\u306f\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\u30de\u30af\u30ed\u306ebase64\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305fPowerShell\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u3001\u524d\u306e\u7e70\u308a\u8fd4\u3057\u3067\u7f6e\u304d\u63db\u3048\u305fVBScript\u306b\u7f6e\u304d\u63db\u3048\u307e\u3059\u3002\u307e\u305f\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\"Scripting.FileSystemObject\"\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3068\"Wscript.Shell\"\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u5316\u3059\u308b\u30b3\u30fc\u30c9\u306e\u884c\u3092\u524a\u9664\u3057\u307e\u3057\u305f(\u56f38\u306e\u884c17\u306818)\u3002<\/p>\n<p><img width=\"974\" height=\"787\"  class=\"wp-image-103957 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-71.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-71.png 974w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-71-300x242.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-71-768x621.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-71-900x727.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-71-370x299.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f38 VBScript\u3092\u30de\u30af\u30ed\u306b\u8ffd\u52a0\u3057\u3066\u623b\u3057\u305f\u3053\u3068\u3092\u793a\u3059\u7e70\u308a\u8fd4\u30574\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u9593\u306e\u5dee\u5206\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8<\/em><\/span><\/p>\n<p>\u308f\u305a\u304b\u306a\u5909\u66f4\u3067\u3059\u304c\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306fVBScript\u3092\u30de\u30af\u30ed\u306b\u518d\u5c0e\u5165\u3057\u305f\u3088\u3046\u3067\u3059\u3002DDDD\u5909\u6570\u306b\u683c\u7d0d\u3055\u308c\u305fVBScript\u306e2\u3064\u306e\u5909\u66f4\u306f\u3001\u30b9\u30af\u30ea\u30d7\u30c8\u5185\u306e2\u3064\u306e\u6587\u5b57\u5217\u306e\u96e3\u8aad\u5316\u3067\u3059\u3002\u5177\u4f53\u7684\u306b\u306f\"powershell\"(\u56f39\u306e\u884c24)\u3068\"cmd.exe\"(\u56f39\u306e\u884c25)\u306e\u6587\u5b57\u5217\u3067\u3059\u3002\u4ee3\u308f\u308a\u306b\u3001\u3053\u308c\u3089\u306e\u6587\u5b57\u5217\u306f\u4e21\u65b9\u3068\u3082\u3001\u305d\u308c\u305e\u308c\u306e\u6587\u5b57\u306e16\u9032\u6570\u5024\u3092\u4f7f\u7528\u3057\u3066\u4e00\u5ea6\u306b1\u6587\u5b57\u304c\u7d44\u307f\u8fbc\u307e\u308c\u3001\u9023\u7d50\u3055\u308c\u307e\u3057\u305f\u3002\u305f\u3068\u3048\u3070\u3001\"powershell\"\u306e\u6587\u5b57\u5217\u306f\u6b21\u306e\u6587\u5b57\u5217\u306b\u7f6e\u304d\u63db\u3048\u3089\u308c\u307e\u3057\u305f\u3002<\/p>\n<pre class=\"\">Chr(CLng(\"&amp;H70\")) &amp; Chr(CLng(\"&amp;H6f\")) &amp; Chr(CLng(\"&amp;H77\")) &amp; \r\nChr(CLng(\"&amp;H65\")) &amp; Chr(CLng(\"&amp;H72\")) &amp; Chr(CLng(\"&amp;H73\")) &amp; \r\nChr(CLng(\"&amp;H68\")) &amp; Chr(CLng(\"&amp;H65\")) &amp; Chr(CLng(\"&amp;H6c\")) &amp; \r\nChr(CLng(\"&amp;H6c\"))\r\n<\/pre>\n<p>\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\u7d44\u307f\u8fbc\u307fShell\u95a2\u6570\u3092\u4f7f\u7528\u3057\u3001wscript\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3057\u3066\"AppPool.vbs\"\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u5b9f\u884c\u3059\u308b\u884c(\u56f39\u306e\u884c29)\u3082\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001Shell\u95a2\u6570\u306e\u547c\u3073\u51fa\u3057\u306b\u3001\u975e\u8868\u793a\u30a6\u30a3\u30f3\u30c9\u30a6\u3067\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3059\u308b\"vbHide\"\u30d5\u30e9\u30b0\u3092\u4f7f\u7528\u3057\u307e\u3057\u305f\u3002<\/p>\n<p><img width=\"974\" height=\"625\"  class=\"wp-image-103961 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-73.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-73.png 974w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-73-300x193.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-73-768x493.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-73-900x578.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-73-370x237.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f39 \u6587\u5b57\u5217\u96e3\u8aad\u5316\u304a\u3088\u3073\u7d44\u307f\u8fbc\u307fShell\u95a2\u6570\u306e\u4f7f\u7528\u3092\u793a\u3059\u7e70\u308a\u8fd4\u30574\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u9593\u306e\u5dee\u5206\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8<\/em><\/span><\/p>\n<h3><a id=\"post-103940-\u7e70\u308a\u8fd4\u30575\"><\/a>\u7e70\u308a\u8fd4\u30575<\/h3>\n<table>\n<tbody>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb<\/strong><\/td>\n<td>056ffc13a7a2e944f7ab8c99ea9a2d1b429bbafa280eb2043678aa8b259999aa -&gt; \u00a0216ffed357b5fe4d71848c79f77716e9ecebdd010666cdb9edaadf7a8c9ec576<\/td>\n<\/tr>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb\u540d<\/strong><\/td>\n<td>sss.xls -&gt; sss.xls<\/td>\n<\/tr>\n<tr>\n<td><strong>\u6642\u9593\u5dee<\/strong><\/td>\n<td>5\u52066\u79d2<\/td>\n<\/tr>\n<tr>\n<td><strong>\u691c\u51fa\u7387<\/strong><\/td>\n<td>18 -&gt; 5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u3053\u306e\u7e70\u308a\u8fd4\u3057\u3067\u306f\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\u524d\u306e\u7e70\u308a\u8fd4\u3057\u3067\u5c0e\u5165\u3057\u305fwscript\u3092\u4f7f\u7528\u3057\u3066\u3001\"AppPool.vbs\"\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u5b9f\u884c\u3059\u308b\u7d44\u307f\u8fbc\u307fShell\u95a2\u6570\u306e\u547c\u3073\u51fa\u3057\u3092\u524a\u9664\u3057\u307e\u3059\u3002\u56f310\u306f\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u304c\u3001\u30b3\u30fc\u30c9\u306e\u884c29\u3092\u7a7a\u306e\u884c\u306b\u7f6e\u304d\u63db\u3048\u308b\u3053\u3068\u306b\u3088\u3063\u3066\u3053\u306e\u884c\u3092\u524a\u9664\u3057\u305f\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img width=\"974\" height=\"135\"  class=\"wp-image-103963 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-74.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-74.png 974w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-74-300x42.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-74-768x106.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-74-900x125.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-74-370x51.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f310 Shell\u95a2\u6570\u306e\u547c\u3073\u51fa\u3057\u306e\u524a\u9664\u3092\u793a\u3059\u7e70\u308a\u8fd4\u30575\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u9593\u306e\u5dee\u5206\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8<\/em><\/span><\/p>\n<h3><a id=\"post-103940-\u7e70\u308a\u8fd4\u30576\"><\/a>\u7e70\u308a\u8fd4\u30576<\/h3>\n<table>\n<tbody>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb<\/strong><\/td>\n<td>216ffed357b5fe4d71848c79f77716e9ecebdd010666cdb9edaadf7a8c9ec576 -&gt; 687027d966667780ab786635b0d4274b651f27d99717c5ba95e139e94ef114c3<\/td>\n<\/tr>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb\u540d<\/strong><\/td>\n<td>sss.xls -&gt; sss.xls<\/td>\n<\/tr>\n<tr>\n<td><strong>\u6642\u9593\u5dee<\/strong><\/td>\n<td>5\u520614\u79d2<\/td>\n<\/tr>\n<tr>\n<td><strong>\u691c\u51fa\u7387<\/strong><\/td>\n<td>5 -&gt; 17<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u3053\u306e\u7e70\u308a\u8fd4\u3057\u3067\u306f\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\u524d\u306e\u7e70\u308a\u8fd4\u3057\u3067\u524a\u9664\u3057\u305f\u7d44\u307f\u8fbc\u307fShell\u95a2\u6570\u306e\u547c\u3073\u51fa\u3057\u3092\u518d\u5c0e\u5165\u3057\u307e\u3059\u3002\u305f\u3060\u3057\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001wscript\u3092\u4f7f\u7528\u3057\u3066\"AppPool.vbs\"\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u5b9f\u884c\u3059\u308b\u6587\u5b57\u5217\u3092\u7701\u304f\u3053\u3068\u306b\u3088\u3063\u3066\u3053\u308c\u3092\u5b9f\u884c\u3059\u308b\u30b3\u30de\u30f3\u30c9\u3092\u542b\u3081\u307e\u305b\u3093\u3067\u3057\u305f\u3002\u56f311\u306f\u3001Shell\u95a2\u6570\u306e\u547c\u3073\u51fa\u3057\u306b\u30d6\u30e9\u30f3\u30af\u306e\u30b3\u30de\u30f3\u30c9\u30d1\u30e9\u30e1\u30fc\u30bf\u304c\u3042\u308b\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002\u691c\u51fa\u7387\u304c\u5927\u5e45\u306b\u4e0a\u6607\u3057\u307e\u3057\u305f\u3002\u3053\u308c\u306f\u3001\u691c\u51fa\u7387\u304c\u30b3\u30de\u30f3\u30c9\u81ea\u4f53\u306b\u57fa\u3065\u304f\u306e\u3067\u306f\u306a\u304f\u3001\u7d44\u307f\u8fbc\u307fShell\u95a2\u6570\u306e\u6c4e\u7528\u547c\u3073\u51fa\u3057\u306b\u8d77\u56e0\u3059\u308b\u3053\u3068\u3092\u793a\u5506\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img width=\"974\" height=\"110\"  class=\"wp-image-103965 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-75.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-75.png 974w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-75-300x34.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-75-768x87.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-75-900x102.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-75-370x42.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f311 Shell\u95a2\u6570\u3067\u7a7a\u306e\u30b3\u30de\u30f3\u30c9\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u793a\u3059\u7e70\u308a\u8fd4\u30576\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u9593\u306e\u5dee\u5206\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8<\/em><\/span><\/p>\n<h3><a id=\"post-103940-\u7e70\u308a\u8fd4\u30577\"><\/a>\u7e70\u308a\u8fd4\u30577<\/h3>\n<table>\n<tbody>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb<\/strong><\/td>\n<td>687027d966667780ab786635b0d4274b651f27d99717c5ba95e139e94ef114c3 -&gt; 364e2884251c151a29071a5975ca0076405a8cc2bab8da3e784491632ec07f56<\/td>\n<\/tr>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb\u540d<\/strong><\/td>\n<td>sss.xls -&gt; sss.xls<\/td>\n<\/tr>\n<tr>\n<td><strong>\u6642\u9593\u5dee<\/strong><\/td>\n<td>10\u5206<\/td>\n<\/tr>\n<tr>\n<td><strong>\u691c\u51fa\u7387<\/strong><\/td>\n<td>17 -&gt; 9<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u3053\u306e\u7e70\u308a\u8fd4\u3057\u3067\u306f\u3001\u56f312\u3067\u793a\u3059\u3088\u3046\u306b\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001wscript\u3092\u4f7f\u7528\u3057\u3066\"AppPool.vbs\"\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u5b9f\u884c\u3057\u3001\u7d44\u307f\u8fbc\u307fShell\u95a2\u6570\u3092\u547c\u3073\u51fa\u3059\u30b3\u30de\u30f3\u30c9\u3092\u518d\u5c0e\u5165\u3057\u307e\u3059\u3002\u305f\u3060\u3057\u3001\u4eca\u56de\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\"vbHide\"\u30d5\u30e9\u30b0\u306e\u4ee3\u308f\u308a\u306b\"vbNormalFocus\"\u30d5\u30e9\u30b0\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002\u305d\u306e\u7d50\u679c\u3001\u30b3\u30de\u30f3\u30c9\u30d7\u30ed\u30f3\u30d7\u30c8\u30a6\u30a3\u30f3\u30c9\u30a6\u304c\u8868\u793a\u3055\u308c\u305f\u72b6\u614b\u3067\u30b3\u30de\u30f3\u30c9\u304c\u5b9f\u884c\u3055\u308c\u307e\u3059\u3002\u3053\u306e\u5909\u66f4\u306b\u3088\u3063\u3066\u3001\u691c\u51fa\u7387\u304c8\u6e1b\u5c11\u3057\u307e\u3059\u3002\u3053\u308c\u306f\u3001Shell\u95a2\u6570\u5185\u3067\"vbHide\"\u30d5\u30e9\u30b0\u3092\u4f7f\u7528\u3059\u308b\u3053\u3068\u3092\u8907\u6570\u306e\u30d9\u30f3\u30c0\u30fc\u304c\u60aa\u610f\u304c\u3042\u308b\u3068\u307f\u306a\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u793a\u5506\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img width=\"974\" height=\"133\"  class=\"wp-image-103967 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-76.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-76.png 974w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-76-300x41.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-76-768x105.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-76-900x123.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-76-370x51.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f312 \u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u6642\u306b\u30a6\u30a3\u30f3\u30c9\u30a6\u3092\u8868\u793a\u3059\u308b\u3053\u3068\u3092\u793a\u3059\u7e70\u308a\u8fd4\u30577\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u9593\u306e\u5dee\u5206\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8<\/em><\/span><\/p>\n<h3><a id=\"post-103940-\u7e70\u308a\u8fd4\u30578\"><\/a>\u7e70\u308a\u8fd4\u30578<\/h3>\n<table>\n<tbody>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb<\/strong><\/td>\n<td>364e2884251c151a29071a5975ca0076405a8cc2bab8da3e784491632ec07f56 -&gt; 66d678b097a2245f60f3d95bb608f3958aa0f5f19ca7e5853f38ea79885b9633<\/td>\n<\/tr>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb\u540d<\/strong><\/td>\n<td>sss.xls -&gt; sss \u2013 Copy.xls<\/td>\n<\/tr>\n<tr>\n<td><strong>\u6642\u9593\u5dee<\/strong><\/td>\n<td>4\u65e521\u6642\u959324\u520631\u79d2<\/td>\n<\/tr>\n<tr>\n<td><strong>\u691c\u51fa\u7387<\/strong><\/td>\n<td>9 -&gt; 11<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u3053\u306e\u30c6\u30b9\u30c8\u306e\u7e70\u308a\u8fd4\u3057\u306f\u3001\u524d\u306e\u7e70\u308a\u8fd4\u3057\u304b\u3089\u304b\u306a\u308a\u6642\u9593\u304c\u7d4c\u904e\u3057\u3066\u304b\u3089\u5b9f\u884c\u3055\u308c\u307e\u3057\u305f\u3002\u65b0\u3057\u3044\u30d5\u30a1\u30a4\u30eb\u306f\u524d\u306e\u30d5\u30a1\u30a4\u30eb\u306e\u7d045\u65e5\u5f8c\u306b\u751f\u6210\u3055\u308c\u307e\u3057\u305f\u3002\u3053\u306e\u30d5\u30a1\u30a4\u30eb\u4f5c\u6210\u306e\u5927\u304d\u306a\u6642\u9593\u5dee\u306f\u3001\u30c6\u30b9\u30c8\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u304c\u65b0\u3057\u3044\u30e9\u30a6\u30f3\u30c9\u306b\u5165\u3063\u305f\u3053\u3068\u3092\u793a\u5506\u3057\u3066\u3044\u307e\u3059\u3002\u305f\u3060\u3057\u3001\u3053\u306e\u65b0\u3057\u304f\u751f\u6210\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306e\u30d5\u30a1\u30a4\u30eb\u540d\u306f\"sss \u2013 Copy.xls\"\u3067\u3001\u524d\u306e\u30d5\u30a1\u30a4\u30eb\u540d\u306f\"sss.xls\"\u3067\u3057\u305f\u3002\u3053\u308c\u30892\u3064\u306e\u30d5\u30a1\u30a4\u30eb\u540d\u3092\u6bd4\u8f03\u3059\u308b\u3068\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\u524d\u306e\u7e70\u308a\u8fd4\u3057\u3067\u751f\u6210\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u3092\u30b3\u30d4\u30fc\u3057\u3001\u4eca\u56de\u306e\u7e70\u308a\u8fd4\u3057\u30c6\u30b9\u30c8\u306e\u57fa\u790e\u3068\u3057\u3066\u4f7f\u7528\u3057\u305f\u304b\u3082\u3057\u308c\u306a\u3044\u3068\u3044\u3046\u3053\u3068\u304c\u793a\u5506\u3055\u308c\u307e\u3059\u3002\u30d5\u30a1\u30a4\u30eb\u540d\u3068\u3053\u308c\u30892\u3064\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306e\u30de\u30af\u30ed\u306b\u5bfe\u3059\u308b\u5909\u66f4\u306e\u305f\u3081\u3001\u79c1\u305f\u3061\u306f\u3053\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u9032\u884c\u4e2d\u306e\u30c6\u30b9\u30c8\u306e\u53d6\u308a\u7d44\u307f\u306e\u4e00\u74b0\u3068\u3057\u3066\u6271\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u3053\u306e\u7e70\u308a\u8fd4\u3057\u3067\u306f\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u30de\u30af\u30ed\u306e\u8907\u6570\u306e\u7b87\u6240\u3092\u308f\u305a\u304b\u306b\u5909\u66f4\u3057\u307e\u3057\u305f\u3002\u307e\u305a\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\u30de\u30af\u30ed\u309210\u79d2\u9593\u30b9\u30ea\u30fc\u30d7\u3059\u308b\u30b3\u30fc\u30c9\u306e\u884c\u3092\u524a\u9664\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u884c\u306f\u6700\u521d\u306b\u7e70\u308a\u8fd4\u30573\u3067\u5c0e\u5165\u3055\u308c\u305f\u884c\u3067\u3059\u3002\u56f313\u306f\u3001\u30b3\u30fc\u30c9\u306e\u3053\u306e\u884c\u306e\u524a\u9664\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u884c\u3067\u306f\u300110\u79d2\u9593\u306e\u30b9\u30ea\u30fc\u30d7\u306b\"Application.Wait\"\u95a2\u6570\u3092\u4f7f\u7528\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img width=\"974\" height=\"152\"  class=\"wp-image-103969 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-77.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-77.png 974w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-77-300x47.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-77-768x120.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-77-900x140.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-77-370x58.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f313 \u30b9\u30ea\u30fc\u30d7\u6a5f\u80fd\u306e\u524a\u9664\u3092\u793a\u3059\u7e70\u308a\u8fd4\u30578\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u9593\u306e\u5dee\u5206\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8<\/em><\/span><strong>\u00a0<\/strong><\/p>\n<p>\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306b\u3088\u308b\u6b21\u306e\u5909\u66f4\u306f\u3001Shell\u95a2\u6570\u5185\u306e\u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u5185\u306e\u6587\u5b57\u5217\"wscript\"\u306e\u96e3\u8aad\u5316\u3067\u3059\u3002\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\u6587\u5b57\u5217\u309216\u9032\u6570\u5f62\u5f0f\u306e\u305d\u308c\u305e\u308c\u306e\u6587\u5b57\u306b\u7f6e\u304d\u63db\u3048\u3066\u9023\u7d50\u3059\u308b\u3001\u524d\u306e\u7e70\u308a\u8fd4\u3057\u3067\u4f7f\u7528\u3057\u305f\u6587\u5b57\u5217\u96e3\u8aad\u5316\u624b\u6cd5\u3068\u540c\u3058\u624b\u6cd5\u3092\u4f7f\u7528\u3057\u3066\u3044\u307e\u3059\u3002\u56f314\u306f\u3001\"wscript\"\u3092\u8868\u3059\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u3066\u3044\u308b\u96e3\u8aad\u5316\u3055\u308c\u305f\u6587\u5b57\u5217\"Chr(CLng(\"&amp;H77\")) &amp; Chr(CLng(\"&amp;H73\")) &amp; Chr(CLng(\"&amp;H63\")) &amp; Chr(CLng(\"&amp;H72\")) &amp; Chr(CLng(\"&amp;H69\")) &amp; Chr(CLng(\"&amp;H70\")) &amp; Chr(CLng(\"&amp;H74\")) &amp; Chr(CLng(\"&amp;H20\"))\"\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u56f314\u306f\u3001\u73fe\u5728\u306eExcel\u30ef\u30fc\u30af\u30b7\u30fc\u30c8\u3092\u8868\u3059ActiveSheet\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u4fdd\u5b58\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3059\u308b\u5909\u6570\u540d\u3092\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u304c\u5909\u66f4\u3057\u305f\u3053\u3068\u3082\u793a\u3057\u3066\u3044\u307e\u3059\u3002\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3053\u306e\u5909\u6570\u540d\u3092\"sh\"\u304b\u3089\"Sh\"(\u884c41)\u306b\u5909\u66f4\u3057\u307e\u3057\u305f\u3002\u307e\u305f\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\u3053\u306e\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u4f7f\u7528\u3059\u308b\u3068\u304d\u3001\u305d\u308c\u305e\u308c\u306e\u524d\u306e\u884c(\u884c43\u300145\u304a\u3088\u307347)\u3082\u5909\u66f4\u3057\u307e\u3057\u305f\u3002<\/p>\n<p><img width=\"974\" height=\"474\"  class=\"wp-image-103971 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-78.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-78.png 974w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-78-300x146.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-78-768x374.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-78-380x184.png 380w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-78-900x438.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-78-370x180.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f314 \u30b3\u30de\u30f3\u30c9\u306e\u6587\u5b57\u5217\u96e3\u8aad\u5316\u306e\u4f7f\u7528\u304a\u3088\u3073\u5909\u6570\u540d\u306e\u5909\u66f4\u3092\u793a\u3059\u7e70\u308a\u8fd4\u30578\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u9593\u306e\u5dee\u5206\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8<\/em><\/span><\/p>\n<h3><a id=\"post-103940-\u7e70\u308a\u8fd4\u30579\"><\/a>\u7e70\u308a\u8fd4\u30579<\/h3>\n<table>\n<tbody>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb<\/strong><\/td>\n<td>66d678b097a2245f60f3d95bb608f3958aa0f5f19ca7e5853f38ea79885b9633 -&gt; 70ff20f2e5c7fd90c6bfe92e28df585f711ee4090fc7669b3a9bd024c4e11702<\/td>\n<\/tr>\n<tr>\n<td><strong>\u30d5\u30a1\u30a4\u30eb\u540d<\/strong><\/td>\n<td>sss \u2013 Copy.xls -&gt; sss \u2013 Copy.xls<\/td>\n<\/tr>\n<tr>\n<td><strong>\u6642\u9593\u5dee<\/strong><\/td>\n<td>1\u520657\u79d2<\/td>\n<\/tr>\n<tr>\n<td><strong>\u691c\u51fa\u7387<\/strong><\/td>\n<td>11 -&gt; 7<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u30c6\u30b9\u30c8\u306e\u6700\u5f8c\u306e\u7e70\u308a\u8fd4\u3057\u3067\u306f\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u306f\u3001\u96e3\u8aad\u5316\u3055\u308c\u305f\"wscript\"\u6587\u5b57\u5217\u3092\u542b\u3080\"AppPool.vbs\"\u30b9\u30af\u30ea\u30d7\u30c8\u306e\u547c\u3073\u51fa\u3057\u306b\u4f7f\u7528\u3059\u308bShell\u95a2\u6570\u306e\u547c\u3073\u51fa\u3057\u306b\u4f7f\u7528\u3059\u308b\u30b3\u30fc\u30c9\u306e\u884c\u5168\u4f53\u3092\u524a\u9664\u3057\u307e\u3059\u3002\u56f315\u306f\u3001\u30c6\u30b9\u30c8\u5b9f\u884c\u8005\u304c\u884c\u5168\u4f53\u3092\u524a\u9664\u3057\u305f\u3060\u3051\u3067\u3001\u5225\u306e\u30b3\u30fc\u30c9\u306b\u7f6e\u304d\u63db\u3048\u306a\u304b\u3063\u305f\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u30de\u30af\u30ed\u304cVBScript\u30d5\u30a1\u30a4\u30eb\u3092\u5b9f\u884c\u305b\u305a\u3001\u30b7\u30b9\u30c6\u30e0\u306b\u4fdd\u5b58\u3057\u306a\u3044\u3053\u3068\u3092\u793a\u5506\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img width=\"974\" height=\"202\"  class=\"wp-image-103973 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/02\/word-image-79.png\" srcset=\"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-79.png 974w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-79-300x62.png 300w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-79-768x159.png 768w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-79-900x187.png 900w, https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2020\/02\/word-image-79-370x77.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><\/p>\n<p style=\"text-align: center;\"><span style=\"font-size: 10pt;\"><em>\u56f315 Shell\u30b3\u30de\u30f3\u30c9\u306e\u524a\u9664\u3092\u793a\u3059\u7e70\u308a\u8fd4\u30579\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u9593\u306e\u5dee\u5206\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8<\/em><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u6982\u8981 \u653b\u6483\u8005\u306e\u4f5c\u6226\u304c\u3069\u306e\u3088\u3046\u306a\u30b9\u30d4\u30fc\u30c9\u3067\u5c55\u958b\u3055\u308c\u3066\u3044\u304f\u304b\u3092\u653b\u6483\u30e9\u30a4\u30d5\u30b5\u30a4\u30af\u30eb\u306e\u521d\u671f\u6bb5\u968e\u3067\u8003\u5bdf\u3059\u308b\u306b\u306f\u304b\u306a\u308a\u306e\u56f0\u96e3\u304c\u3068\u3082\u306a\u3044\u307e\u3059\u3002\u5075\u5bdf\u30fb\u5175\u5668\u5316\u306e\u3088\u3046\u306a\u653b\u6483\u306e\u521d\u671f\u6bb5\u968e\u3067\u306f\uff64\u6a19\u7684\u306b\u76f4\u63a5\u50cd\u304d\u304b\u3051\u308b\u914d\u4fe1\u6bb5\u968e\u3068\u6bd4\u3079\u308b\u3068\u3001\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc<\/p>\n","protected":false},"author":160,"featured_media":103246,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[4322,1974,4431],"tags":[6705,6271,6868,6869],"product_categories":[4444,4343,4448],"coauthors":[888,935],"class_list":["post-103940","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threat-actor-groups","category-malware-ja","category-threat-actor-groups-ja","tag-bondupdater-ja","tag-oilrig-ja","tag-testing","tag-testing-ja","product_categories-advanced-wildfire-ja","product_categories-cortex-xdr","product_categories-cortex-xdr-ja"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.0 (Yoast SEO v27.0) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>\u30c6\u30b9\u30c8\uff64\u5175\u5668\u5316\u3001\u914d\u4fe1\u307e\u3067\u306eOilRig\u306e\u4f5c\u6226\u5b9f\u884c\u30b9\u30d4\u30fc\u30c9\u3092\u5206\u6790<\/title>\n<meta name=\"description\" content=\"BONDUPDATER\u3092\u914d\u4fe1\u3057\u305f\u4e2d\u6771\u306e\u653f\u5e9c\u6a5f\u95a2\u306b\u5bfe\u3059\u308b2018\u5e748\u6708\u306e\u653b\u6483\u3092\u7d99\u7d9a\u8abf\u67fb\u3059\u308b\u306a\u304b\u3067\u3001OilRig\u306b\u3088\u308b\u30c6\u30b9\u30c8\u6bb5\u968e\u306e\u6d3b\u52d5\u3092\u89b3\u6e2c\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3057\u305f\u3002\u307e\u305f\u3053\u306e\u30c6\u30b9\u30c8\u6bb5\u968e\u306e\u6d3b\u52d5\u304c\uff64\u7d9a\u304f\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u305f\u5175\u5668\u5316\u6e08\u307f\u914d\u4fe1\u6587\u66f8\u306e\u4f5c\u6210\u306b\u3064\u306a\u304c\u3063\u305f\u3053\u3068\u3092\u78ba\u4fe1\u3059\u308b\u306b\u3044\u305f\u308a\u307e\u3057\u305f\u3002\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/\" \/>\n<meta property=\"og:locale\" content=\"ja_JP\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u30c6\u30b9\u30c8\uff64\u5175\u5668\u5316\u3001\u914d\u4fe1\u307e\u3067\u306eOilRig\u306e\u4f5c\u6226\u5b9f\u884c\u30b9\u30d4\u30fc\u30c9\u3092\u5206\u6790\" \/>\n<meta property=\"og:description\" content=\"BONDUPDATER\u3092\u914d\u4fe1\u3057\u305f\u4e2d\u6771\u306e\u653f\u5e9c\u6a5f\u95a2\u306b\u5bfe\u3059\u308b2018\u5e748\u6708\u306e\u653b\u6483\u3092\u7d99\u7d9a\u8abf\u67fb\u3059\u308b\u306a\u304b\u3067\u3001OilRig\u306b\u3088\u308b\u30c6\u30b9\u30c8\u6bb5\u968e\u306e\u6d3b\u52d5\u3092\u89b3\u6e2c\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3057\u305f\u3002\u307e\u305f\u3053\u306e\u30c6\u30b9\u30c8\u6bb5\u968e\u306e\u6d3b\u52d5\u304c\uff64\u7d9a\u304f\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u305f\u5175\u5668\u5316\u6e08\u307f\u914d\u4fe1\u6587\u66f8\u306e\u4f5c\u6210\u306b\u3064\u306a\u304c\u3063\u305f\u3053\u3068\u3092\u78ba\u4fe1\u3059\u308b\u306b\u3044\u305f\u308a\u307e\u3057\u305f\u3002\" \/>\n<meta property=\"og:url\" content=\"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/\" \/>\n<meta property=\"og:site_name\" content=\"Unit 42\" \/>\n<meta property=\"article:published_time\" content=\"2018-11-17T04:00:33+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-05-22T01:30:54+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/04\/unit42-blog-600x300.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"600\" \/>\n\t<meta property=\"og:image:height\" content=\"300\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Kyle Wilhoit, Robert Falcone\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u30c6\u30b9\u30c8\uff64\u5175\u5668\u5316\u3001\u914d\u4fe1\u307e\u3067\u306eOilRig\u306e\u4f5c\u6226\u5b9f\u884c\u30b9\u30d4\u30fc\u30c9\u3092\u5206\u6790","description":"BONDUPDATER\u3092\u914d\u4fe1\u3057\u305f\u4e2d\u6771\u306e\u653f\u5e9c\u6a5f\u95a2\u306b\u5bfe\u3059\u308b2018\u5e748\u6708\u306e\u653b\u6483\u3092\u7d99\u7d9a\u8abf\u67fb\u3059\u308b\u306a\u304b\u3067\u3001OilRig\u306b\u3088\u308b\u30c6\u30b9\u30c8\u6bb5\u968e\u306e\u6d3b\u52d5\u3092\u89b3\u6e2c\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3057\u305f\u3002\u307e\u305f\u3053\u306e\u30c6\u30b9\u30c8\u6bb5\u968e\u306e\u6d3b\u52d5\u304c\uff64\u7d9a\u304f\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u305f\u5175\u5668\u5316\u6e08\u307f\u914d\u4fe1\u6587\u66f8\u306e\u4f5c\u6210\u306b\u3064\u306a\u304c\u3063\u305f\u3053\u3068\u3092\u78ba\u4fe1\u3059\u308b\u306b\u3044\u305f\u308a\u307e\u3057\u305f\u3002","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/","og_locale":"ja_JP","og_type":"article","og_title":"\u30c6\u30b9\u30c8\uff64\u5175\u5668\u5316\u3001\u914d\u4fe1\u307e\u3067\u306eOilRig\u306e\u4f5c\u6226\u5b9f\u884c\u30b9\u30d4\u30fc\u30c9\u3092\u5206\u6790","og_description":"BONDUPDATER\u3092\u914d\u4fe1\u3057\u305f\u4e2d\u6771\u306e\u653f\u5e9c\u6a5f\u95a2\u306b\u5bfe\u3059\u308b2018\u5e748\u6708\u306e\u653b\u6483\u3092\u7d99\u7d9a\u8abf\u67fb\u3059\u308b\u306a\u304b\u3067\u3001OilRig\u306b\u3088\u308b\u30c6\u30b9\u30c8\u6bb5\u968e\u306e\u6d3b\u52d5\u3092\u89b3\u6e2c\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3057\u305f\u3002\u307e\u305f\u3053\u306e\u30c6\u30b9\u30c8\u6bb5\u968e\u306e\u6d3b\u52d5\u304c\uff64\u7d9a\u304f\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u305f\u5175\u5668\u5316\u6e08\u307f\u914d\u4fe1\u6587\u66f8\u306e\u4f5c\u6210\u306b\u3064\u306a\u304c\u3063\u305f\u3053\u3068\u3092\u78ba\u4fe1\u3059\u308b\u306b\u3044\u305f\u308a\u307e\u3057\u305f\u3002","og_url":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/","og_site_name":"Unit 42","article_published_time":"2018-11-17T04:00:33+00:00","article_modified_time":"2020-05-22T01:30:54+00:00","og_image":[{"width":600,"height":300,"url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/04\/unit42-blog-600x300.jpg","type":"image\/jpeg"}],"author":"Kyle Wilhoit, Robert Falcone","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/#article","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/"},"author":{"name":"Kyle Wilhoit","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/c986f820098c7e362343e3c23639d7ab"},"headline":"\u30c6\u30b9\u30c8\uff64\u5175\u5668\u5316\u3001\u914d\u4fe1\u307e\u3067\u306eOilRig\u306e\u4f5c\u6226\u5b9f\u884c\u30b9\u30d4\u30fc\u30c9\u3092\u5206\u6790","datePublished":"2018-11-17T04:00:33+00:00","dateModified":"2020-05-22T01:30:54+00:00","mainEntityOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/"},"wordCount":848,"commentCount":0,"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/#primaryimage"},"thumbnailUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/04\/unit42-blog-600x300.jpg","keywords":["BONDUPDATER","OilRig","Testing","Testing"],"articleSection":["Threat Actor Groups","\u30de\u30eb\u30a6\u30a7\u30a2","\u8105\u5a01\u30a2\u30af\u30bf\u30fc \u30b0\u30eb\u30fc\u30d7"],"inLanguage":"ja","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/","url":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/","name":"\u30c6\u30b9\u30c8\uff64\u5175\u5668\u5316\u3001\u914d\u4fe1\u307e\u3067\u306eOilRig\u306e\u4f5c\u6226\u5b9f\u884c\u30b9\u30d4\u30fc\u30c9\u3092\u5206\u6790","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/#primaryimage"},"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/#primaryimage"},"thumbnailUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/04\/unit42-blog-600x300.jpg","datePublished":"2018-11-17T04:00:33+00:00","dateModified":"2020-05-22T01:30:54+00:00","author":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/c986f820098c7e362343e3c23639d7ab"},"description":"BONDUPDATER\u3092\u914d\u4fe1\u3057\u305f\u4e2d\u6771\u306e\u653f\u5e9c\u6a5f\u95a2\u306b\u5bfe\u3059\u308b2018\u5e748\u6708\u306e\u653b\u6483\u3092\u7d99\u7d9a\u8abf\u67fb\u3059\u308b\u306a\u304b\u3067\u3001OilRig\u306b\u3088\u308b\u30c6\u30b9\u30c8\u6bb5\u968e\u306e\u6d3b\u52d5\u3092\u89b3\u6e2c\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3057\u305f\u3002\u307e\u305f\u3053\u306e\u30c6\u30b9\u30c8\u6bb5\u968e\u306e\u6d3b\u52d5\u304c\uff64\u7d9a\u304f\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u305f\u5175\u5668\u5316\u6e08\u307f\u914d\u4fe1\u6587\u66f8\u306e\u4f5c\u6210\u306b\u3064\u306a\u304c\u3063\u305f\u3053\u3068\u3092\u78ba\u4fe1\u3059\u308b\u306b\u3044\u305f\u308a\u307e\u3057\u305f\u3002","breadcrumb":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/#breadcrumb"},"inLanguage":"ja","potentialAction":[{"@type":"ReadAction","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/"]}]},{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/#primaryimage","url":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/04\/unit42-blog-600x300.jpg","contentUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/04\/unit42-blog-600x300.jpg","width":600,"height":300},{"@type":"BreadcrumbList","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/unit42.paloaltonetworks.com\/ja\/"},{"@type":"ListItem","position":2,"name":"\u30c6\u30b9\u30c8\uff64\u5175\u5668\u5316\u3001\u914d\u4fe1\u307e\u3067\u306eOilRig\u306e\u4f5c\u6226\u5b9f\u884c\u30b9\u30d4\u30fc\u30c9\u3092\u5206\u6790"}]},{"@type":"WebSite","@id":"https:\/\/unit42.paloaltonetworks.com\/#website","url":"https:\/\/unit42.paloaltonetworks.com\/","name":"Unit 42","description":"Palo Alto Networks","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/unit42.paloaltonetworks.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ja"},{"@type":"Person","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/c986f820098c7e362343e3c23639d7ab","name":"Kyle Wilhoit","image":{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/image\/9213e49ea48b7676660bac40d05c9e3e","url":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","contentUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","caption":"Kyle Wilhoit"},"url":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/author\/kyle-wilhoit\/"}]}},"_links":{"self":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/103940","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/users\/160"}],"replies":[{"embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/comments?post=103940"}],"version-history":[{"count":4,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/103940\/revisions"}],"predecessor-version":[{"id":107316,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/103940\/revisions\/107316"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media\/103246"}],"wp:attachment":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media?parent=103940"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/categories?post=103940"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/tags?post=103940"},{"taxonomy":"product_categories","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/product_categories?post=103940"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/coauthors?post=103940"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}