´Ó BeijingCrypt¹¥»÷¿´Ìì«‘EDR·À»¤Êµ¼Ê £¬¹¹Öþ´úÂë·ì϶֮±íµÄÖն˰²È«·®Àé

°ä²¼¹¦·ò 2026-03-02

½üÆÚ £¬AnthropicÍÆ³öµÄClaude Code Security×÷Ϊһ¿î¼¯³ÉÓÚClaude CodeµÄAI°²È«¹¤¾ß £¬±¸ÊܹØ×¢¡£Çø±ðÓÚÒÀÀµ¹æ¶¨Æ¥ÅäµÄ´«Í³¾²Ì¬·ÖÎö¹¤¾ß £¬ËüÄÜÄ£Äⰲȫ×êÑÐÔ±µÄ·ÖÎöÂß¼­ £¬Éî¶ÈÀí½â´úÂë½á¹¹ £¬Í¨¹ý×é¼þ½»»¥ÓëÊý¾ÝÁ÷ת·ÖÎö £¬¾«×¼¼ø±ð´«Í³¼¿Á©Ò×ÒÅ©µÄ¸´ÔÓ·ì϶¡£È»¶ø £¬Claude Code SecurityµÄÄÜÁ¦ÌìǵÔÚÓÚ¾²Ì¬´úÂë·ÖÎö £¬ÎÞ·¨´¥¼°¶¯Ì¬ÔËÐÐʱµÄ°²È«·À»¤¡£


ÔÚÏÖʵ¹¥»÷³¡¾°ÖÐ £¬´óÁ¿¹¥»÷·½Ê½²¢·ÇÀûÓôúÂë·ì϶ £¬¶øÊÇͨ¹ýÔ¶³Ì×ÀÃæ±¬ÆÆ¡¢Êý¾Ý¿â¶Ë¿Ú¹¥»÷¡¢´¹µöÓʼþµÈ·½Ê½ £¬Ö±½Ó¶ÔÖÕ¶Ë¡¢¶Ë¿Ú»òȨÏÞ½øÐÐÍ»ÆÆ £¬½ø¶øÖ²Èë¶ñÒⷨʽ»òÇÔÈ¡Êý¾Ý¡£ÕâÀද̬¡¢ÊµÊ±ÖÕ¶ËÈëÇÖÐÐΪ £¬ÐèÒÀÀµÖն˲àµÄÈ«Á÷³ÌÐÐΪ¼à²âÓ뼴ʱÀ¹½Ø £¬ÕâÕýÊÇEDR²úÆ·µÄÖ÷ÌâÄÜÁ¦µØµã £¬Ò²ÊǾ²Ì¬AI¹¤¾ßµÄ·À»¤Ã¤Çø¡£


BeijingCrypt±äÖÖÀÕË÷²¡¶¾¹¥»÷ÊÖ·¨·Ö½â


ÒÔ½üÆÚijÆóÒµÔâ·êµÄBeijingCrypt±äÖÖÀÕË÷²¡¶¾¹¥»÷ΪÀý £¬¸ÃÊÂÎñ¼´ÊôÓÚµäÐ͵ÄÎÞ´úÂë·ì϶ÀûÓÃÐͶ¯Ì¬¹¥»÷¡£¹¥»÷Á´Â·ÆëÈ«ÍÑÀë´úÂë²ãÃæ £¬´Ó¼¼ÊõÉÏÈÃClaude Code SecurityµÈAI´úÂ빤¾ßʧȥ·À»¤×÷Óá£


? ÈëÇÖÁ´Â·Òñ±Îרҵ£º¹¥»÷Õßͨ¹ý±©Á¦ÆÆ½â¹¥ÆÆSQL ServerÊý¾Ý¿âÃÜÂë £¬ÊµÏÖ³õÊ¼Í»ÆÆºóÁ¢¼´Ö´ÐÐPowerShell¶ñÒâºÅÁî £¬Ö²ÈëCobaltStrikeºóÃÅ £¬½ø¶øÏÂÔØÍøÂçɨÃ蹤¾ßÓëÀÕË÷·¨Ê½µÄ¶ñÒâÎļþ¡£Õû¸ö¹ý³ÌÒÀ¸½Öն˹ý³ÌÖð²ãÍÆ¶¯ £¬ÐÐΪÒñ±ÎÇÒÖ±Ö¸Ö÷ÌâÊý¾Ý¿â¡£

¼ÓÃÜ·ÛËéÓµÓи²ÃðÐÔ£º²¡¶¾³É¹¦Ö²Èëºó £¬Ëæ¼´¶ÔÊý¾Ý¿â±¸·Ý¡¢×°Ö÷¨Ê½¡¢°ì¹«º¯¼þµÈÖ÷Ìâ×ʲú½øÐиßÇ¿¶È¼ÓÃÜ £¬Îļþºó׺ͳһ¸ÄΪ.bixi £¬²¢ÁôÏÂÀÕË÷ÐÅ¡£ÈôÆóÒµÎÞÓÐЧ±¸·Ý £¬Ö÷ÌâÊý¾Ý½«Ãæ¶ÔÓÀÔ¶ÐÔÃÔʧ £¬ÒµÎñÔËÐÐÔâ·êÑϳÁ½ø¹¥¡£

¹¥»÷ÐÐΪ¾ß±¸ÆÕÊÊÐÔ£º¸Ã¹¥»÷ÎÞÐèÀûÓÃÆóÒµ×ÔÑлò¿ªÔ´´úÂëµÄ·ì϶ £¬½öÕë¶ÔÖÕ¶ËÉ豸¡¢Êý¾Ý¿âµÄ»ù´¡È¨ÏÞÓë¶Ë¿Ú·À»¤¶Ì°å £¬ÈκδæÔÚÈõÃÜÂë¡¢¶Ë¿Ú¶³ö¡¢ÐÐΪ¼à²âȱʧµÄÆóÒµ¶¼¿ÉÄܳÉΪָ±ê¡£


ͼƬ1.jpg

Îļþ±»¼ÓÃܺó £¬ºó׺¾ù±äΪ.bixi


ͼƬ2.png

BeijingCrypt±äÖÖÀÕË÷²¡¶¾µÄÀÕË÷ÐÅ


EDRÔËÐÐʱ·À»¤ ¶¯Ì¬¼à²â ¾«×¼×è»÷


Ãæ¶ÔÕâ´Î¸ßÄѶȶ¯Ì¬¹¥»÷ £¬888¼¯ÍÅÌì«‘EDRƾ½èÖÕ¶ËÐÐΪʵʱ¼à²â¡¢¹¥»÷¹ý³ÌÊ÷ËÝÔ´¡¢¶ñÒⷨʽ¾«×¼¼ø±ðµÈÖ÷Ìâ¼¼Êõ £¬ÊµÏÖÁ˶Թ¥»÷µÄÈ«Á÷³ÌÀ¹½Ø¡£


Ò»¡¢ºÁÃë¼¶Òì³£ÐÐΪ¼ì²â


ͨ¹ý¶ÔÖն˹ý³ÌµÄʵʱ¼à¿Ø £¬¾«×¼×½Äõ½SQLServer¹ý³ÌÖ´ÐеĸßΣpowershell¶ñÒâºÅÁî £¬µÚÒ»¹¦·ò¼ø±ð³öÒì³£¹ý³ÌÐÐΪ £¬ÊµÏÖ¶Ô¹¥»÷ÐÐΪµÄÔçÆÚÔ¤¾¯ £¬´Ó¹¦·òά¶ÈѹËõ¹¥»÷Ö´Ðпռä¡£


ͼƬ3.png

SQLServer¹ý³ÌÖ´ÐÐpowershellºÅÁî¹ý³ÌÊ÷


¶þ¡¢È«Á´Â·¹¥»÷ËÝÔ´


ͨ¹ý¹¹½¨¹¥»÷¹ý³ÌÊ÷ £¬Ç峺»¹Ô­ÁË´Ówininit.exeµ½services.exe £¬ÔÙµ½sqlservr.exe £¬×îÖÕ´¥·¢cmd.exeÓëpowershell.exeÖ´ÐжñÒâºÅÁîµÄÆëÈ«¹ý³ÌÊ÷ £¬Îª°²È«´ëÖÃÌṩ¾«×¼µÄ¼¼Êõƾ¾Ý¡£


ͼƬ4.png

Ö²ÈëCobaltStrikeºóÃźÅÁî


Èý¡¢¶àά¶È¶ñÒⷨʽ¼ø±ð


»ùÓÚÌØµã¿âÆ¥ÅäÓëÐÐΪ·ÖÎöÏà½áºÏµÄ¼¼Êõ¼¿Á© £¬³É¹¦¼ø±ð²¢ÏóÕ÷ÁËCobaltStrikeºóÃÅ¡¢ÍøÂçɨÃ蹤¾ß¡¢ÀÕË÷·¨Ê½µÈ¸÷Àà¶ñÒⷨʽ £¬Ã÷È·¸÷Àà·çÏյļ¼ÊõÀàÐÍÓë´ëÖý¨Òé £¬ÊµÏÖ¶Ô¶ñÒⷨʽµÄ¾«×¼×è¶Ï¡£


ͼƬ5.png

Ìì«‘EDR²¡¶¾²éɱ¼ì²â³ö´ËÀÕË÷²¡¶¾Óйعý³Ì


ËÄ¡¢Öն˲ãÃæÈ«Á÷³ÌÀ¹½Ø


´Ó¶ñÒâºÅÁîÖ´ÐÓ×¢ºóÃÅÖ²Èëµ½¶ñÒâÎļþÏÂÔØ £¬ÔÚÖն˲ãÃæÓÐЧÀ¹½Ø¹¥»÷¸÷»·½Ú £¬Ô¤·À²¡¶¾´«²¼ÓëÎļþµÄ´ó¹æÄ£¼ÓÃÜ £¬ÎªÆóÒµÉ豸ºÍÊý¾Ý°²È«ÖþÀÎÁËÖն˼¼Êõ·ÀÏß¡£


Õâ´ÎBeijingCryptÀÕË÷¹¥»÷ÊÂÎñÅú×¢ £¬AI¼¼ÊõËäΪ´úÂë·ì϶·À»¤ÌṩÁËÓÐЧ¼¿Á© £¬µ«ÒÀÀµÎÞ´úÂë·ì϶µÄ¶¯Ì¬¹¥»÷²¢Î´Òþû £¬·´¶øÒÔ¸üÒñ±ÎµÄ¼¿Á©¡¢¸üÆÕÊʵÄõè¾¶ £¬³ÉΪÆóÒµµ±Ç°Ãæ¶ÔµÄÖØÒª°²È«Íþв¡£´Ó¼¼ÊõÊôÐÔ¿´ £¬EDRµÈ¶¯Ì¬ÔËÐÐʱ·À»¤²úÆ·¾Û½¹ÐÐΪ¼à²âÓëʵʱÀ¹½Ø £¬Êܾ²Ì¬AI¹¤¾ßÓ°Ïì×îÓ× £¬ÊÇÓ¦¶Ô´ËÀ๥»÷µÄÖ÷Ì⼿Á© £¬Ò²ÊÇÍøÂç°²Õû¸öϵÖо߱¸¸ß¼¼Êõ±ÚÀݵĹؼü»·½Ú¡£


ÃÀÂúµÄ´úÂë²¢²»µÈͬÓÚÔËÐÐʱµÄ°²È« £¬ÏÖ´úÂë¿ÉÓÉAIÌìÉú £¬·ÀÓùÄÜÁ¦Ò²±ØÐëÏòÖÇÄÜÌå½ø»¯¡£888¼¯ÍųÖÐøÉî¸ûEDRÖն˰²È«ÁìÓò £¬½«AIÖÇÄÜ·ÖÎöÓëEDRʵʱ·À»¤Éî¶ÈÈÚºÏ £¬Í¨¹ý³ÖÐø¼¼Êõ´´Ð´òÔìÈ«·½Î»µÄÖն˰²È«½â¾ö¹æ»® £¬ÎªÓû§ÖþÀΡ°ÔËÐÐʱ¡±Óë¡°AIÆ¥µÓױ˫³Á·ÀÏß¡£