Microsoft SharePoint¤Ë¥¤¥Ù¥ó¥È¥í¥°¤ò²þ¤¶¤ó¤·¤Æ¥À¥¦¥ó¥í¡¼¥É²Äǽ¤ÊÉÔ¶ñ¹ç
Varonis¤Ï4·î9Æü(Êƹñ»þ´Ö)¡¢¡ÖSidestepping SharePoint Security: Two New Techniques to Evade Exfiltration Detection¡ÃVaronis¡×¤Ë¤ª¤¤¤Æ¡¢Microsoft SharePoint¤«¤é¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤ÎµÏ¿¤ò²þ¤¶¤ó¤·¤Æ¥Õ¥¡¥¤¥ë¤ò¥À¥¦¥ó¥í¡¼¥É¤¹¤ë2¤Ä¤Î¼êË¡¤òȯ¸«¤·¤¿¤ÈÊ󤸤¿¡£¤³¤Î¼êË¡¤òÍѤ¤¤ë¤È¡¢¹¶·â¼Ô¤¬¥»¥¥å¥ê¥Æ¥£¥½¥ê¥å¡¼¥·¥ç¥ó¤Î¸¡½Ð¤ò²óÈò¤·¤ÆÂçÎ̤Υե¡¥¤¥ë¤ò¥À¥¦¥ó¥í¡¼¥É¤Ç¤¤ë²ÄǽÀ¤¬¤¢¤ë¡£
Sidestepping SharePoint Security: Two New Techniques to Evade Exfiltration Detection¡ÃVaronis
¡û¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤¬Êú¤¨¤ë¥ê¥¹¥¯
¥æ¡¼¥¶¡¼¤¬SharePoint¤«¤é¥Õ¥¡¥¤¥ë¤ä¥Õ¥©¥ë¥À¤ò¥À¥¦¥ó¥í¡¼¥É¤¹¤ë¤È¡¢´Æºº¥í¥°¤Ë¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¡ÖFileDownloaded¡×¤¬µÏ¿¤µ¤ì¤ë¡£¥»¥¥å¥ê¥Æ¥£¥½¥ê¥å¡¼¥·¥ç¥ó¤Ï¤³¤Î¥¤¥Ù¥ó¥È¤ò»ÈÍѤ·¤Æ¥Ý¥ê¥·¡¼°ãÈ¿¤ò¸¡½Ð¤¹¤ë¤³¤È¤¬¤Ç¤¤ë¡£
¹¶·â¼Ô¤¬¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤ÎµÏ¿¤ò²óÈò¤·¤Æ¥À¥¦¥ó¥í¡¼¥É²Äǽ¤Ë¤Ê¤ë¤È¡¢¥»¥¥å¥ê¥Æ¥£¥½¥ê¥å¡¼¥·¥ç¥ó¤Î¸¡½Ðµ¡Ç½¤ò²óÈò¤Ç¤¤ë¾ì¹ç¤¬¤¢¤ê¡¢Èï³²¤Î³ÈÂç¤Ë¤Ä¤Ê¤¬¤ë²ÄǽÀ¤¬¤¢¤ë¡£
´Æºº¥í¥°¤ËµÏ¿¤µ¤ì¤¿¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤ÎÎã¡¡°úÍÑ¡§Varonis
¡û¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤Î²þ¤¶¤ó
Varonis¤Ï¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤ÎµÏ¿¤ò²þ¤¶¤ó¤·¤Æ¥À¥¦¥ó¥í¡¼¥É¤¹¤ë¼êË¡¤ò2¤Äȯ¸«¤·¤¿¤È¤·¤Æ¡¢¤½¤Î¾ÜºÙ¤ò²òÀ⤷¤Æ¤¤¤ë¡£¤½¤ì¤é¼êË¡¤Î³µÍפϼ¡¤Î¤È¤ª¤ê¡£
¡û¡Ê1¡Ë¥¢¥×¥ê¤Ç³«¤¯
¥Õ¥¡¥¤¥ë¤ò¥¢¥×¥ê¤Ç³«¤¤¤ÆÊݸ¤·¤¿¾ì¹ç¡¢¥Õ¥¡¥¤¥ë¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤ÏµÏ¿¤µ¤ì¤Ê¤¤¡£¤³¤Î¼êË¡¤ò»È¤¦¤È¥Õ¥¡¥¤¥ë¤Î¥¢¥¯¥»¥¹¥¤¥Ù¥ó¥È¤Î¤ß¤¬µÏ¿¤µ¤ì¤ë¤¿¤á¡¢¥»¥¥å¥ê¥Æ¥£¥½¥ê¥å¡¼¥·¥ç¥ó¤«¤é¤ÏÄ̾ï¤Î³èÆ°¤Î°ì´Ä¤È¤·¤Æ̵»ë¤µ¤ì¤ë²ÄǽÀ¤¬¤¢¤ë¡£¤³¤Îºî¶È¤ò¼êºî¶È¤Ç¹Ô¤¦¤Î¤ÏÂçÊѤÀ¤¬¡¢PowerShell¤ÈSharePoint¥¯¥é¥¤¥¢¥ó¥È¦¥ª¥Ö¥¸¥§¥¯¥È¥â¥Ç¥ë(CSOM: Client Side Object Model)¤òÊ»ÍѤ¹¤ë¤³¤È¤Ç¼«Æ°²½¤¹¤ë¤³¤È¤¬¤Ç¤¤ë¡£
PowerShell¤ÈCSOM¤ò»ÈÍѤ·¤ÆµÏ¿¤ò²óÈò¤·¤Ê¤¬¤é¼«Æ°¥À¥¦¥ó¥í¡¼¥É¤¹¤ëÎã - °úÍÑ¡§Varonis
¡û¡Ê2¡Ë¥Õ¥¡¥¤¥ëƱ´ü
SharePoint¤Î¥Õ¥¡¥¤¥ëƱ´üµ¡Ç½¤ò»ÈÍѤ¹¤ë¤È¥¯¥é¥¦¥É¤È¥í¡¼¥«¥ëPC´Ö¤Ç¥Õ¥¡¥¤¥ë¤òÊ£À½¤¹¤ë¤³¤È¤¬¤Ç¤¤ë¡£¤³¤Îµ¡Ç½¤ò»ÈÍѤ¹¤ë¤È¥À¥¦¥ó¥í¡¼¥É»þ¤Ë¡ÖFileSyncDownloadedFull¡×¥¤¥Ù¥ó¥È¤¬µÏ¿¤µ¤ì¤ë¡£¤Þ¤¿¡¢Microsoft SkyDriveSync¤ò»ÈÍѤ¹¤ë¤È¤¹¤Ù¤Æ¤Î¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤¬FileSyncDownloadedFull¥¤¥Ù¥ó¥È¤È¤·¤ÆµÏ¿¤µ¤ì¤ë¡£
¹¶·â¼Ô¤Ï¤³¤ÎÆ°ºî¤ò°ÍѤ·¡¢¥Ö¥é¥¦¥¶¤Î¥æ¡¼¥¶¡¼¥¨¡¼¥¸¥§¥ó¥È¤òSkyDriveSync¤Ë¥¹¥×¡¼¥Õ¥£¥ó¥°(µ¶Áõ)¤·¤Æ¥Õ¥¡¥¤¥ë¤ò¥À¥¦¥ó¥í¡¼¥É¤¹¤ë¤³¤È¤Ç¡¢¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤òFileSyncDownloadedFull¥¤¥Ù¥ó¥È¤ËÊѹ¹¤Ç¤¤ë¡£¤Þ¤¿¡¢¤³¤Î¼êË¡¤ÏPowerShell¤ò»ÈÍѤ·¤Æ¼«Æ°²½¤¹¤ë¤³¤È¤â¤Ç¤¤ë¡£
¡ûÂкö
Varonis¤Ï¤³¤ÎÉÔ¶ñ¹ç¤ò2023ǯ11·î¤ËMicrosoft¤ËÊó¹ð¤·¤Æ¤¤¤ë¡£¤·¤«¤·¤Ê¤¬¤é¡¢Microsoft¤Ï¡ÖÃæÄøÅ١פΥ»¥¥å¥ê¥Æ¥£ÌäÂê¤È¤·¤Æ¥Ñ¥Ã¥Á¥Ð¥Ã¥¯¥í¥°¥×¥í¥°¥é¥à¤ËÉÔ¶ñ¹ç¤òÄɲ䷤Ƥª¤ê¡¢½¤Àµ¥Ñ¥Ã¥Á¤ÎÄ󶡤ϻþ´Ö¤¬¤«¤«¤ë¸«¹þ¤ß¤È¤Ê¤Ã¤Æ¤¤¤ë¡£
¤½¤Î¤¿¤á¡¢½¤Àµ¥Ñ¥Ã¥Á¤¬Ä󶡤µ¤ì¤ë¤Þ¤Ç¤Î´Ö¡¢¥»¥¥å¥ê¥Æ¥£Ã´Åö¼Ô¤Ï½¾Íè¤ÎÊýË¡¤Ë²Ã¤¨¤ÆÄɲäθ¡½Ð¼êË¡¤ò¼è¤êÆþ¤ì¤ëɬÍפ¬¤¢¤ë¡£Varonis¤Ï¤½¤Î¤è¤¦¤Ê¸¡½Ð¼êË¡¤È¤·¤Æ¼¡¤Î¤è¤¦¤ÊÊýË¡¤òÄó°Æ¤·¤Æ¤¤¤ë¡£
¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤ò¤³¤ì¤Þ¤ÇÄ̤긡ºº¤¹¤ë
¥æ¡¼¥¶¡¼¤´¤È¤ÎƱ´ü¥¢¥¯¥Æ¥£¥Ó¥Æ¥£¡¼¤Î°ìÈÌŪ¤ÊÉÑÅÙ¤ÈÎ̤ÎÊѲ½¤ò¸¡½Ð¤¹¤ë
Ʊ´üÁàºî¤Ë»ÈÍѤµ¤ì¤ë¥Ç¥Ð¥¤¥¹¤ÎÊѲ½¤ò¸¡½Ð¤¹¤ë
½¾Íè¤È°Û¤Ê¤ë°ÌÃÖ(¥¢¥¯¥»¥¹¸µ)¤«¤é¤ÎÁàºî¤ò¸¡½Ð¤¹¤ë
Ä̾ï¤È¤Ï°Û¤Ê¤ë¥Õ¥©¥ë¥À¡¼¤ÎƱ´ü¤ò¸¡½Ð¤¹¤ë(ÆÃÄê¤Î¥Õ¥©¥ë¥À¡¼¤Ï¥æ¡¼¥¶¡¼¥¢¥«¥¦¥ó¥È¤ÈƱ´ü¤¹¤ë)
¾åµ¤Î¤è¤¦¤ÊÊýË¡¤Ç¥¤¥Ù¥ó¥È¥í¥°¤ò¾ï»þ¸¡ºº¤·¡¢Ä̾ï¤Î¥ï¡¼¥¯¥Õ¥í¡¼¤Ç¤Ï¤Ê¤¤¤È¹Í¤¨¤é¤ì¤ëÂçÎ̤Υǡ¼¥¿¥¢¥¯¥»¥¹¤ä¥Õ¥©¥ë¥ÀƱ´ü¤Ê¤É¤¬¸¡½Ð¤µ¤ì¤¿¾ì¹ç¤Ï¥µ¥¤¥Ð¡¼¹¶·â¤Î²ÄǽÀ¤¬¤¢¤ë¤¿¤áÃí°Õ¤¹¤ë¤³¤È¤¬Ë¾¤Þ¤ì¤Æ¤¤¤ë¡£Varonis¤Ï¤³¤Î¤è¤¦¤ÊÊýË¡¤Ç¥í¥°¤ò´Æºº¤Ç¤¤ë¹âÅ٤ʥ»¥¥å¥ê¥Æ¥£¥½¥ê¥å¡¼¥·¥ç¥ó¤ÎƳÆþ¤ò¿ä¾©¤·¤Æ¤¤¤ë¡£
¡û¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤¬Êú¤¨¤ë¥ê¥¹¥¯
¥æ¡¼¥¶¡¼¤¬SharePoint¤«¤é¥Õ¥¡¥¤¥ë¤ä¥Õ¥©¥ë¥À¤ò¥À¥¦¥ó¥í¡¼¥É¤¹¤ë¤È¡¢´Æºº¥í¥°¤Ë¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¡ÖFileDownloaded¡×¤¬µÏ¿¤µ¤ì¤ë¡£¥»¥¥å¥ê¥Æ¥£¥½¥ê¥å¡¼¥·¥ç¥ó¤Ï¤³¤Î¥¤¥Ù¥ó¥È¤ò»ÈÍѤ·¤Æ¥Ý¥ê¥·¡¼°ãÈ¿¤ò¸¡½Ð¤¹¤ë¤³¤È¤¬¤Ç¤¤ë¡£
¹¶·â¼Ô¤¬¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤ÎµÏ¿¤ò²óÈò¤·¤Æ¥À¥¦¥ó¥í¡¼¥É²Äǽ¤Ë¤Ê¤ë¤È¡¢¥»¥¥å¥ê¥Æ¥£¥½¥ê¥å¡¼¥·¥ç¥ó¤Î¸¡½Ðµ¡Ç½¤ò²óÈò¤Ç¤¤ë¾ì¹ç¤¬¤¢¤ê¡¢Èï³²¤Î³ÈÂç¤Ë¤Ä¤Ê¤¬¤ë²ÄǽÀ¤¬¤¢¤ë¡£
´Æºº¥í¥°¤ËµÏ¿¤µ¤ì¤¿¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤ÎÎã¡¡°úÍÑ¡§Varonis
¡û¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤Î²þ¤¶¤ó
Varonis¤Ï¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤ÎµÏ¿¤ò²þ¤¶¤ó¤·¤Æ¥À¥¦¥ó¥í¡¼¥É¤¹¤ë¼êË¡¤ò2¤Äȯ¸«¤·¤¿¤È¤·¤Æ¡¢¤½¤Î¾ÜºÙ¤ò²òÀ⤷¤Æ¤¤¤ë¡£¤½¤ì¤é¼êË¡¤Î³µÍפϼ¡¤Î¤È¤ª¤ê¡£
¡û¡Ê1¡Ë¥¢¥×¥ê¤Ç³«¤¯
¥Õ¥¡¥¤¥ë¤ò¥¢¥×¥ê¤Ç³«¤¤¤ÆÊݸ¤·¤¿¾ì¹ç¡¢¥Õ¥¡¥¤¥ë¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤ÏµÏ¿¤µ¤ì¤Ê¤¤¡£¤³¤Î¼êË¡¤ò»È¤¦¤È¥Õ¥¡¥¤¥ë¤Î¥¢¥¯¥»¥¹¥¤¥Ù¥ó¥È¤Î¤ß¤¬µÏ¿¤µ¤ì¤ë¤¿¤á¡¢¥»¥¥å¥ê¥Æ¥£¥½¥ê¥å¡¼¥·¥ç¥ó¤«¤é¤ÏÄ̾ï¤Î³èÆ°¤Î°ì´Ä¤È¤·¤Æ̵»ë¤µ¤ì¤ë²ÄǽÀ¤¬¤¢¤ë¡£¤³¤Îºî¶È¤ò¼êºî¶È¤Ç¹Ô¤¦¤Î¤ÏÂçÊѤÀ¤¬¡¢PowerShell¤ÈSharePoint¥¯¥é¥¤¥¢¥ó¥È¦¥ª¥Ö¥¸¥§¥¯¥È¥â¥Ç¥ë(CSOM: Client Side Object Model)¤òÊ»ÍѤ¹¤ë¤³¤È¤Ç¼«Æ°²½¤¹¤ë¤³¤È¤¬¤Ç¤¤ë¡£
PowerShell¤ÈCSOM¤ò»ÈÍѤ·¤ÆµÏ¿¤ò²óÈò¤·¤Ê¤¬¤é¼«Æ°¥À¥¦¥ó¥í¡¼¥É¤¹¤ëÎã - °úÍÑ¡§Varonis
¡û¡Ê2¡Ë¥Õ¥¡¥¤¥ëƱ´ü
SharePoint¤Î¥Õ¥¡¥¤¥ëƱ´üµ¡Ç½¤ò»ÈÍѤ¹¤ë¤È¥¯¥é¥¦¥É¤È¥í¡¼¥«¥ëPC´Ö¤Ç¥Õ¥¡¥¤¥ë¤òÊ£À½¤¹¤ë¤³¤È¤¬¤Ç¤¤ë¡£¤³¤Îµ¡Ç½¤ò»ÈÍѤ¹¤ë¤È¥À¥¦¥ó¥í¡¼¥É»þ¤Ë¡ÖFileSyncDownloadedFull¡×¥¤¥Ù¥ó¥È¤¬µÏ¿¤µ¤ì¤ë¡£¤Þ¤¿¡¢Microsoft SkyDriveSync¤ò»ÈÍѤ¹¤ë¤È¤¹¤Ù¤Æ¤Î¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤¬FileSyncDownloadedFull¥¤¥Ù¥ó¥È¤È¤·¤ÆµÏ¿¤µ¤ì¤ë¡£
¹¶·â¼Ô¤Ï¤³¤ÎÆ°ºî¤ò°ÍѤ·¡¢¥Ö¥é¥¦¥¶¤Î¥æ¡¼¥¶¡¼¥¨¡¼¥¸¥§¥ó¥È¤òSkyDriveSync¤Ë¥¹¥×¡¼¥Õ¥£¥ó¥°(µ¶Áõ)¤·¤Æ¥Õ¥¡¥¤¥ë¤ò¥À¥¦¥ó¥í¡¼¥É¤¹¤ë¤³¤È¤Ç¡¢¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤òFileSyncDownloadedFull¥¤¥Ù¥ó¥È¤ËÊѹ¹¤Ç¤¤ë¡£¤Þ¤¿¡¢¤³¤Î¼êË¡¤ÏPowerShell¤ò»ÈÍѤ·¤Æ¼«Æ°²½¤¹¤ë¤³¤È¤â¤Ç¤¤ë¡£
¡ûÂкö
Varonis¤Ï¤³¤ÎÉÔ¶ñ¹ç¤ò2023ǯ11·î¤ËMicrosoft¤ËÊó¹ð¤·¤Æ¤¤¤ë¡£¤·¤«¤·¤Ê¤¬¤é¡¢Microsoft¤Ï¡ÖÃæÄøÅ١פΥ»¥¥å¥ê¥Æ¥£ÌäÂê¤È¤·¤Æ¥Ñ¥Ã¥Á¥Ð¥Ã¥¯¥í¥°¥×¥í¥°¥é¥à¤ËÉÔ¶ñ¹ç¤òÄɲ䷤Ƥª¤ê¡¢½¤Àµ¥Ñ¥Ã¥Á¤ÎÄ󶡤ϻþ´Ö¤¬¤«¤«¤ë¸«¹þ¤ß¤È¤Ê¤Ã¤Æ¤¤¤ë¡£
¤½¤Î¤¿¤á¡¢½¤Àµ¥Ñ¥Ã¥Á¤¬Ä󶡤µ¤ì¤ë¤Þ¤Ç¤Î´Ö¡¢¥»¥¥å¥ê¥Æ¥£Ã´Åö¼Ô¤Ï½¾Íè¤ÎÊýË¡¤Ë²Ã¤¨¤ÆÄɲäθ¡½Ð¼êË¡¤ò¼è¤êÆþ¤ì¤ëɬÍפ¬¤¢¤ë¡£Varonis¤Ï¤½¤Î¤è¤¦¤Ê¸¡½Ð¼êË¡¤È¤·¤Æ¼¡¤Î¤è¤¦¤ÊÊýË¡¤òÄó°Æ¤·¤Æ¤¤¤ë¡£
¥À¥¦¥ó¥í¡¼¥É¥¤¥Ù¥ó¥È¤ò¤³¤ì¤Þ¤ÇÄ̤긡ºº¤¹¤ë
¥æ¡¼¥¶¡¼¤´¤È¤ÎƱ´ü¥¢¥¯¥Æ¥£¥Ó¥Æ¥£¡¼¤Î°ìÈÌŪ¤ÊÉÑÅÙ¤ÈÎ̤ÎÊѲ½¤ò¸¡½Ð¤¹¤ë
Ʊ´üÁàºî¤Ë»ÈÍѤµ¤ì¤ë¥Ç¥Ð¥¤¥¹¤ÎÊѲ½¤ò¸¡½Ð¤¹¤ë
½¾Íè¤È°Û¤Ê¤ë°ÌÃÖ(¥¢¥¯¥»¥¹¸µ)¤«¤é¤ÎÁàºî¤ò¸¡½Ð¤¹¤ë
Ä̾ï¤È¤Ï°Û¤Ê¤ë¥Õ¥©¥ë¥À¡¼¤ÎƱ´ü¤ò¸¡½Ð¤¹¤ë(ÆÃÄê¤Î¥Õ¥©¥ë¥À¡¼¤Ï¥æ¡¼¥¶¡¼¥¢¥«¥¦¥ó¥È¤ÈƱ´ü¤¹¤ë)
¾åµ¤Î¤è¤¦¤ÊÊýË¡¤Ç¥¤¥Ù¥ó¥È¥í¥°¤ò¾ï»þ¸¡ºº¤·¡¢Ä̾ï¤Î¥ï¡¼¥¯¥Õ¥í¡¼¤Ç¤Ï¤Ê¤¤¤È¹Í¤¨¤é¤ì¤ëÂçÎ̤Υǡ¼¥¿¥¢¥¯¥»¥¹¤ä¥Õ¥©¥ë¥ÀƱ´ü¤Ê¤É¤¬¸¡½Ð¤µ¤ì¤¿¾ì¹ç¤Ï¥µ¥¤¥Ð¡¼¹¶·â¤Î²ÄǽÀ¤¬¤¢¤ë¤¿¤áÃí°Õ¤¹¤ë¤³¤È¤¬Ë¾¤Þ¤ì¤Æ¤¤¤ë¡£Varonis¤Ï¤³¤Î¤è¤¦¤ÊÊýË¡¤Ç¥í¥°¤ò´Æºº¤Ç¤¤ë¹âÅ٤ʥ»¥¥å¥ê¥Æ¥£¥½¥ê¥å¡¼¥·¥ç¥ó¤ÎƳÆþ¤ò¿ä¾©¤·¤Æ¤¤¤ë¡£