{"id":169,"title":"Active Directory G\u00fcvenli\u011fi ve \u0130zleme Ara\u00e7lar\u0131","content":"Active Directory (AD), kurumsal a\u011flar\u0131n temelini olu\u015fturan kritik bir bile\u015fendir. Ancak, AD'nin karma\u015f\u0131k yap\u0131s\u0131 ve geni\u015f kapsam\u0131, g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131n ortaya \u00e7\u0131kmas\u0131na neden olabilir. Bu nedenle, AD g\u00fcvenli\u011fini sa\u011flamak ve olas\u0131 tehditleri tespit etmek i\u00e7in \u00e7e\u015fitli ara\u00e7lar ve scriptler geli\u015ftirilmi\u015ftir. Bu blog yaz\u0131s\u0131nda, AD g\u00fcvenli\u011fi ve izleme konusunda kullan\u0131lan baz\u0131 pop\u00fcler ara\u00e7lar\u0131 ve scriptleri inceleyece\u011fiz. ## 1. **Invoke-TrimarcADChecks** Bu PowerShell scripti, tek bir etki alan\u0131 AD orman\u0131ndan veri toplamak ve Active Directory G\u00fcvenlik De\u011ferlendirmesi (ADSA) yapmak i\u00e7in tasarlanm\u0131\u015ft\u0131r. Script, AD yap\u0131land\u0131rmas\u0131ndaki zay\u0131f noktalar\u0131 ve g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 tespit etmek i\u00e7in kullan\u0131l\u0131r. <a href=\"https:\/\/ondernet.net\/post\/invoke-trimarcadchecks\">Kurulum ve Kullan\u0131m<\/a> ## 2. **Create-Tiers in AD** Bu proje, herhangi bir ortamda Active Directory'de katmanlar\u0131n otomatik olarak da\u011f\u0131t\u0131lmas\u0131n\u0131 sa\u011flar. Katmanl\u0131 mimari, AD g\u00fcvenli\u011fini art\u0131rmak i\u00e7in kritik \u00f6neme sahiptir ve bu script, bu s\u00fcreci otomatikle\u015ftirir. <a href=\"https:\/\/ondernet.net\/post\/create-tiers-in-ad\">Kurulum ve Kullan\u0131m\u00a0<\/a> ## 3. **SAMRi10** art\u0131k MS galerisinde bulunmuyor..!! Windows 10 ve Server 2016'da SAM (Security Account Manager) uzaktan eri\u015fimini g\u00fc\u00e7lendirmek i\u00e7in tasarlanm\u0131\u015f bir ara\u00e7t\u0131r. Bu ara\u00e7, yetkisiz eri\u015fimleri engellemek i\u00e7in SAM veritaban\u0131n\u0131n g\u00fcvenli\u011fini art\u0131r\u0131r. &nbsp; ## 4. **Net Cease** Net Session Enumeration'\u0131 g\u00fc\u00e7lendirmek i\u00e7in kullan\u0131lan bir ara\u00e7t\u0131r. Bu ara\u00e7, a\u011f \u00fczerindeki oturumlar\u0131n yetkisiz \u015fekilde numaraland\u0131r\u0131lmas\u0131n\u0131 engelleyerek g\u00fcvenli\u011fi art\u0131r\u0131r. <a href=\"https:\/\/ondernet.net\/post\/netcease\">Kurulum ve Kullan\u0131m<\/a> ## 5. **PingCastle** PingCastle, Active Directory g\u00fcvenlik seviyesini h\u0131zl\u0131 bir \u015fekilde de\u011ferlendirmek i\u00e7in tasarlanm\u0131\u015f bir ara\u00e7t\u0131r. Risk de\u011ferlendirmesi ve olgunluk \u00e7er\u00e7evesine dayal\u0131 bir metodoloji kullan\u0131r. <a href=\"https:\/\/ondernet.net\/post\/pingcastle\">Kurulum ve Kullan\u0131m<\/a> ## 6. **Aorato Skeleton Key Malware Remote DC Scanner** Bu ara\u00e7, Skeleton Key Malware'nin varl\u0131\u011f\u0131n\u0131 uzaktan taramak i\u00e7in kullan\u0131l\u0131r. Skeleton Key, AD ortam\u0131nda ciddi g\u00fcvenlik a\u00e7\u0131klar\u0131na neden olabilen bir k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131md\u0131r. <a href=\"https:\/\/ondernet.net\/post\/aorato-skeleton-key-malware-remote-dc-scanner\">Kurulum ve Kullan\u0131m<\/a> ## 7. **Reset the krbtgt account password\/keys** Bu script, krbtgt hesab\u0131n\u0131n parolas\u0131n\u0131 ve ilgili anahtarlar\u0131 s\u0131f\u0131rlamak i\u00e7in kullan\u0131l\u0131r. Bu i\u015flem, Kerberos kimlik do\u011frulama sorunlar\u0131n\u0131 en aza indirirken AD g\u00fcvenli\u011fini art\u0131r\u0131r. <a href=\"https:\/\/ondernet.net\/post\/krbtgt-hesabinin-active-directory-de-guvenli-bir-sekilde-sifirlanmasi\">Kurulum ve Kullan\u0131m<\/a> ## 8. **RiskySPN** RiskySPN, SPN'ler (Service Principal Name) ile ili\u015fkili hesaplar\u0131 tespit etmek ve k\u00f6t\u00fcye kullanmak i\u00e7in odaklanm\u0131\u015f bir PowerShell script koleksiyonudur. SPN'ler, AD ortam\u0131nda s\u0131k\u00e7a hedef al\u0131nan bile\u015fenlerdir. Kurulum ve Kullan\u0131m ## 9. **Deploy-Deception** Bu PowerShell mod\u00fcl\u00fc, Active Directory'de tuzak nesneleri da\u011f\u0131tmak i\u00e7in kullan\u0131l\u0131r. Tuzak nesneler, sald\u0131rganlar\u0131n ger\u00e7ek sistemlere eri\u015fmeden \u00f6nce tespit edilmesini sa\u011flar. Kurulum ve Kullan\u0131m ## 10. **SpoolerScanner** MS-RPRN'nin uzaktan eri\u015filebilir olup olmad\u0131\u011f\u0131n\u0131 kontrol etmek i\u00e7in kullan\u0131lan bir ara\u00e7t\u0131r. Bu ara\u00e7, yaz\u0131c\u0131 hizmetlerindeki g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 tespit etmek i\u00e7in kullan\u0131l\u0131r. Kurulum ve Kullan\u0131m ## 11. **dcept** Active Directory tuzaklar\u0131n\u0131 da\u011f\u0131tmak ve kullan\u0131m\u0131n\u0131 tespit etmek i\u00e7in kullan\u0131lan bir ara\u00e7t\u0131r. Bu ara\u00e7, sald\u0131rganlar\u0131n tespit edilmesini sa\u011flar. Kurulum ve Kullan\u0131m ## 12. **LogonTracer** LogonTracer, Windows olay g\u00fcnl\u00fcklerini g\u00f6rselle\u015ftirerek ve analiz ederek k\u00f6t\u00fc ama\u00e7l\u0131 Windows oturum a\u00e7ma i\u015flemlerini ara\u015ft\u0131rmak i\u00e7in kullan\u0131l\u0131r. ## 13. **<a href=\"https:\/\/ondernet.net\/post\/dcsyncmonitor\">DCSYNCMonitor<\/a>** DCSYNC ve DCSHADOW sald\u0131r\u0131lar\u0131n\u0131 izlemek ve bu olaylar i\u00e7in \u00f6zel Windows olaylar\u0131 olu\u015fturmak i\u00e7in kullan\u0131lan bir ara\u00e7t\u0131r. Kurulum ve Kullan\u0131m ## 14. **Sigma** SIEM sistemleri i\u00e7in genel imza format\u0131d\u0131r. Sigma, g\u00fcvenlik olaylar\u0131n\u0131 tespit etmek i\u00e7in kullan\u0131lan kurallar\u0131 tan\u0131mlar. Kurulum ve Kullan\u0131m ## 15. **Sysmon** Sysmon, Windows sistem etkinli\u011fini izlemek ve Windows olay g\u00fcnl\u00fc\u011f\u00fcne kaydetmek i\u00e7in kullan\u0131lan bir sistem hizmetidir. Sysmon, sistem yeniden ba\u015flatmalar\u0131 s\u0131ras\u0131nda bile etkin kal\u0131r. Kurulum ve Kullan\u0131m ## 16. **SysmonSearch** SysmonSearch, Sysmon'un olay g\u00fcnl\u00fcklerini g\u00f6rselle\u015ftirerek \u015f\u00fcpheli etkinlikleri ara\u015ft\u0131rmak i\u00e7in kullan\u0131l\u0131r. Kurulum ve Kullan\u0131m ## 17. **ClrGuard** ClrGuard, Common Language Runtime (CLR) enstr\u00fcmantasyonunu ke\u015ffetmek i\u00e7in bir proof of concept projesidir. Bu ara\u00e7, g\u00fcvenlik ama\u00e7lar\u0131 i\u00e7in CLR'yi izler. ## 18. **Get-ClrReflection** Bellekteki CLR (.NET) mod\u00fcllerini tespit etmek i\u00e7in kullan\u0131lan bir ara\u00e7t\u0131r. Kurulum ve Kullan\u0131m ## 19. **Get-InjectedThread** Get-InjectedThread, \u00e7al\u0131\u015fan her bir i\u015f par\u00e7ac\u0131\u011f\u0131n\u0131 inceleyerek bellek enjeksiyonunun sonucu olup olmad\u0131\u011f\u0131n\u0131 belirler. Kurulum ve Kullan\u0131m ## 20. **SilkETW** SilkETW ve SilkService, ETW (Event Tracing for Windows) i\u00e7in esnek C# sarmalay\u0131c\u0131lar\u0131d\u0131r. Bu ara\u00e7lar, ETW'nin karma\u015f\u0131kl\u0131klar\u0131n\u0131 ortadan kald\u0131r\u0131r ve ara\u015ft\u0131rma yapmak i\u00e7in basit bir aray\u00fcz sunar. Kurulum ve Kullan\u0131m ## 21. **WatchAD** WatchAD, AD g\u00fcvenlik ihlali tespit sistemi olarak kullan\u0131l\u0131r. Bu ara\u00e7, AD ortam\u0131ndaki olas\u0131 g\u00fcvenlik ihlallerini tespit etmek i\u00e7in tasarlanm\u0131\u015ft\u0131r. Kurulum ve Kullan\u0131m ## 22. **Sparrow** Sparrow.ps1, CISA'n\u0131n Bulut Adli T\u0131p ekibi taraf\u0131ndan Azure\/M365 ortam\u0131nda olas\u0131 tehlikeye girmi\u015f hesaplar\u0131 ve uygulamalar\u0131 tespit etmek i\u00e7in olu\u015fturulmu\u015f bir PowerShell scriptidir. Kurulum ve Kullan\u0131m ## 23. **DFIR-O365RC** DFIR-O365RC, Office 365 \u0130\u015f E-posta G\u00fcvenli\u011fi ihlali ara\u015ft\u0131rmalar\u0131 i\u00e7in ilgili g\u00fcnl\u00fckleri toplamak \u00fczere tasarlanm\u0131\u015f bir PowerShell mod\u00fcl\u00fcd\u00fcr. Kurulum ve Kullan\u0131m ## 24. **AzureADIncidentResponse** Azure AD olay m\u00fcdahalesi s\u0131ras\u0131nda yard\u0131mc\u0131 olacak ara\u00e7lar i\u00e7erir. Bu ara\u00e7lar, Azure AD ortam\u0131ndaki g\u00fcvenlik olaylar\u0131n\u0131 h\u0131zl\u0131 bir \u015fekilde yan\u0131tlamak i\u00e7in kullan\u0131l\u0131r. Kurulum ve Kullan\u0131m ## 25. **ADTimeline** ADTimeline scripti, ilgi \u00e7ekici nesneler i\u00e7in Active Directory \u00e7o\u011faltma meta verilerine dayal\u0131 bir zaman \u00e7izelgesi olu\u015fturur. Bu script, AD olaylar\u0131n\u0131 analiz etmek i\u00e7in kullan\u0131l\u0131r. Kurulum ve Kullan\u0131m ## 26. **Sysmon Configuration** Sysmon yap\u0131land\u0131rmas\u0131, y\u00fcksek kaliteli olay izleme i\u00e7in \u00f6zelle\u015ftirilebilir bir \u015fablon sunar. Bu yap\u0131land\u0131rma, Sysmon'un etkinli\u011fini art\u0131rmak i\u00e7in kullan\u0131l\u0131r. Kurulum ve Kullan\u0131m Active Directory g\u00fcvenli\u011fi, kurumsal a\u011flar\u0131n korunmas\u0131nda kritik bir rol oynar. Yukar\u0131da bahsedilen ara\u00e7lar ve scriptler, AD ortam\u0131ndaki g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 tespit etmek, g\u00fcvenli\u011fi art\u0131rmak ve olas\u0131 tehditlere kar\u015f\u0131 proaktif \u00f6nlemler almak i\u00e7in kullan\u0131labilir. Bu ara\u00e7lar\u0131 do\u011fru \u015fekilde kullanarak, AD ortam\u0131n\u0131z\u0131n g\u00fcvenli\u011fini sa\u011flamak ve olas\u0131 sald\u0131r\u0131lar\u0131 \u00f6nlemek m\u00fcmk\u00fcnd\u00fcr. Unutmay\u0131n, g\u00fcvenlik s\u00fcrekli bir s\u00fcre\u00e7tir ve bu ara\u00e7lar, bu s\u00fcre\u00e7te size yard\u0131mc\u0131 olacak de\u011ferli kaynaklard\u0131r.","excerpt":"Active Directory g\u00fcvenli\u011fi, kurumsal a\u011flar\u0131n korunmas\u0131nda kritik bir rol oynar. Yukar\u0131da bahsedilen ara\u00e7lar ve scriptler, AD ortam\u0131ndaki g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 tespit etmek, g\u00fcvenli\u011fi art\u0131rmak ve olas\u0131 tehditlere kar\u015f\u0131 proaktif \u00f6nlemler almak i\u00e7in kullan\u0131labilir. Bu ara\u00e7lar\u0131 do\u011fru \u015fekilde kullanarak, AD ortam\u0131n\u0131z\u0131n g\u00fcvenli\u011fini sa\u011flamak ve olas\u0131 sald\u0131r\u0131lar\u0131 \u00f6nlemek m\u00fcmk\u00fcnd\u00fcr.\r\n\r\nUnutmay\u0131n, g\u00fcvenlik s\u00fcrekli bir s\u00fcre\u00e7tir ve bu ara\u00e7lar, bu s\u00fcre\u00e7te size yard\u0131mc\u0131 olacak de\u011ferli kaynaklard\u0131r.","created_at":"2025-02-06 17:35:16","updated_at":"2026-09-07 18:25:09","category_id":7,"view_count":686,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-02-06 17:35:16","featured_image":"resimyok.jpg","slug":"active-directory-guvenligi-ve-izleme-araclari","category_name":"Cyber Security","category_slug":"cyber-security"}