[{"id":367,"title":"Network Shares Denetimini Hafife Almay\u0131n","content":"<p>Kurumsal a\u011flarda g&uuml;venlik a&ccedil;\u0131klar\u0131 denildi\u011finde akla genellikle&nbsp;<strong>zararl\u0131 yaz\u0131l\u0131mlar, zay\u0131f parolalar veya g&uuml;ncel olmayan sistemler<\/strong> gelir.<br>Ancak pratikte en s\u0131k kar\u015f\u0131la\u015f\u0131lan &mdash; ve en &ccedil;ok g&ouml;zden ka&ccedil;an &mdash; risklerden biri <strong>a&ccedil;\u0131k unutulmu\u015f network payla\u015f\u0131mlar\u0131d\u0131r<\/strong>.<\/p>\n<p><iframe style=\"width: 674px; height: 379px;\" src=\"https:\/\/www.youtube.com\/embed\/uFDepQ-aC4M\" width=\"674\" height=\"379\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<p>Bir dosya transferi i&ccedil;in ge&ccedil;ici olarak a&ccedil;\u0131lan bir klas&ouml;r,<br>bir departmana &ldquo;\u015fimdilik&rdquo; verilen eri\u015fim,<br>ya da test ama&ccedil;l\u0131 payla\u015f\u0131ma a&ccedil;\u0131lan bir dizin&hellip;<\/p>\n<p>Bunlar\u0131n her biri, fark edilmeden <strong>aylarca hatta y\u0131llarca sessiz bir a&ccedil;\u0131k kap\u0131<\/strong> h&acirc;line gelebilir.<\/p>\n<p>Bir IT y&ouml;neticisi i&ccedil;in sorulmas\u0131 gereken kritik soru \u015fudur:<\/p>\n<blockquote>\n<p><strong>&ldquo;A\u011f\u0131mda \u015fu anda kim, neyi, neden payla\u015f\u0131yor?&rdquo;<\/strong><\/p>\n<\/blockquote>\n<p>Bu soruya net ve h\u0131zl\u0131 bir cevap veremiyorsan\u0131z,<br>orada <strong>y&ouml;netilmeyen bir risk<\/strong> vard\u0131r.<\/p>\n<p>Kurumsal siber g&uuml;venlik stratejilerinde a\u011f payla\u015f\u0131mlar\u0131 (network shares), genellikle zararl\u0131 yaz\u0131l\u0131mlar veya zay\u0131f parolalar kadar dikkat &ccedil;ekmese de asl\u0131nda <strong>en s\u0131k kar\u015f\u0131la\u015f\u0131lan ve en &ccedil;ok g&ouml;zden ka&ccedil;an<\/strong> risk alanlar\u0131ndan biridir. Bir dosya transferi i&ccedil;in ge&ccedil;ici a&ccedil;\u0131lan klas&ouml;rler veya test ama&ccedil;l\u0131 payla\u015f\u0131lan dizinler, aylar hatta y\u0131llar boyunca <strong>\"sessiz bir a&ccedil;\u0131k kap\u0131\"<\/strong> olarak kalabilmektedir.<\/p>\n<p>A\u011f payla\u015f\u0131mlar\u0131n\u0131n kurumsal g&uuml;venlikteki kritik &ouml;nemi ve bar\u0131nd\u0131rd\u0131\u011f\u0131 temel riskler \u015fu \u015fekilde detayland\u0131r\u0131labilir:<\/p>\n<h3>Kritik &Ouml;nemi ve Y&ouml;netim Gereklili\u011fi<\/h3>\n<p>A\u011f payla\u015f\u0131mlar\u0131 do\u011frudan <strong>veriye eri\u015fim<\/strong> anlam\u0131na geldi\u011fi i&ccedil;in kurumsal stratejinin merkezinde yer almal\u0131d\u0131r. Ger&ccedil;ek g&uuml;venlik, sadece tehditleri engellemek de\u011fil, <strong>kurumun neye sahip oldu\u011funu ve bu verilere kimlerin eri\u015fti\u011fini bilmesidir<\/strong>. E\u011fer bir IT y&ouml;neticisi a\u011fda \"\u015fu anda kimin, neyi, neden payla\u015ft\u0131\u011f\u0131n\u0131\" net bir \u015fekilde a&ccedil;\u0131klayam\u0131yorsa, orada <strong>y&ouml;netilmeyen bir risk<\/strong> mevcuttur.<\/p>\n<h3>Temel Riskler<\/h3>\n<p>Yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f veya a&ccedil;\u0131k unutulmu\u015f a\u011f payla\u015f\u0131mlar\u0131 \u015fu ciddi sorunlara yol a&ccedil;abilir:<\/p>\n<ul>\n<li><strong>Yatay Yay\u0131lma (Lateral Movement):<\/strong> Fidye yaz\u0131l\u0131mlar\u0131n\u0131n (ransomware) a\u011f i&ccedil;erisinde makineler aras\u0131nda kolayca yay\u0131lmas\u0131na zemin haz\u0131rlar.<\/li>\n<li><strong>Yetkisiz Eri\u015fim ve Veri S\u0131z\u0131nt\u0131s\u0131:<\/strong> Hassas dosyalara yetkisiz kullan\u0131c\u0131lar\u0131n ula\u015fmas\u0131na veya i&ccedil; tehditlerin fark edilmeden veri s\u0131zd\u0131rmas\u0131na neden olur.<\/li>\n<li><strong>Loglarda Sessiz Kalma:<\/strong> Bu risklerin &ccedil;o\u011fu sistem loglar\u0131nda alarm &uuml;retmez veya \"ba\u011f\u0131rmaz\"; sadece orada sessizce beklerler.<\/li>\n<li><strong>Uyum Sorunlar\u0131:<\/strong> KVKK ve ISO 27001 gibi yasal denetim ve uyumluluk s&uuml;re&ccedil;lerinde ciddi eksiklikler yarat\u0131r.<\/li>\n<\/ul>\n<h3>En Tehlikeli Payla\u015f\u0131m T&uuml;rleri<\/h3>\n<p>Kaynaklara g&ouml;re en tehlikeli payla\u015f\u0131mlar, <strong>\"kimsenin hat\u0131rlamad\u0131\u011f\u0131 ama herkesin eri\u015febildi\u011fi\"<\/strong> payla\u015f\u0131mlard\u0131r. &Ouml;zellikle \u015funlar y&uuml;ksek risk ta\u015f\u0131r:<\/p>\n<ul>\n<li><strong>\"Everyone\"<\/strong> veya &ccedil;ok geni\u015f gruplara a&ccedil;\u0131k olan dizinler.<\/li>\n<li>Eski projelere ait, i\u015fi bitmi\u015f ancak kapat\u0131lmam\u0131\u015f klas&ouml;rler.<\/li>\n<li>Backup (yedekleme) veya log klas&ouml;rlerinin yanl\u0131\u015fl\u0131kla payla\u015f\u0131ma a&ccedil;\u0131lmas\u0131.<\/li>\n<li>Kullan\u0131c\u0131lar\u0131n kendi profil dizinleri alt\u0131nda manuel olarak a&ccedil;t\u0131\u011f\u0131 payla\u015f\u0131mlar,.<\/li>\n<\/ul>\n<h3>Stratejik Yakla\u015f\u0131m ve Denetim<\/h3>\n<p>A\u011f payla\u015f\u0131mlar\u0131n\u0131n denetimi, \"bir kez yap\u0131ld\u0131 ve bitti\" denilecek bir i\u015f de\u011fildir; bu s&uuml;recin <strong>periyodik, raporlanabilir ve standartla\u015ft\u0131r\u0131lm\u0131\u015f<\/strong> olmas\u0131 gerekir. Tek bir makine &uuml;zerinde <code>net share<\/code> komutuyla yerel g&ouml;r&uuml;n&uuml;rl&uuml;k sa\u011flanabilse de, kurumsal a\u011flarda as\u0131l de\u011fer <strong>Active Directory (domain) seviyesinde g&ouml;r&uuml;n&uuml;rl&uuml;k<\/strong> elde etmektir,. PowerShell gibi ara&ccedil;lar kullan\u0131larak domain genelindeki t&uuml;m a&ccedil;\u0131k SMB payla\u015f\u0131mlar\u0131n\u0131n d&uuml;zenli olarak taranmas\u0131, \"bilmiyordum\" l&uuml;ks&uuml;n&uuml; ortadan kald\u0131rarak g&uuml;venli\u011fi art\u0131r\u0131r,.<\/p>\n<p>A\u011f payla\u015f\u0131mlar\u0131n\u0131n y&ouml;netimi, binan\u0131n giri\u015fine en geli\u015fmi\u015f &ccedil;elik kap\u0131y\u0131 (firewall\/antivir&uuml;s) tak\u0131p, arka taraftaki pencerelerden birini (a&ccedil;\u0131k unutulmu\u015f klas&ouml;r) sonuna kadar a&ccedil;\u0131k b\u0131rakmaya benzer; kap\u0131 ne kadar sa\u011flam olursa olsun, pencereyi bilen biri i&ccedil;eri s\u0131zabilir.<\/p>\n<p>Yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f veya a&ccedil;\u0131k unutulmu\u015f a\u011f payla\u015f\u0131mlar\u0131, kurumsal a\u011flarda genellikle zararl\u0131 yaz\u0131l\u0131mlar veya zay\u0131f parolalar kadar dikkat &ccedil;ekmese de en s\u0131k kar\u015f\u0131la\u015f\u0131lan ve en &ccedil;ok g&ouml;zden ka&ccedil;an g&uuml;venlik risklerinden biridir. Bu payla\u015f\u0131mlar, fark edilmeden aylar hatta y\u0131llar boyunca <strong>\"sessiz bir a&ccedil;\u0131k kap\u0131\"<\/strong> olarak kalabilmektedir.<\/p>\n<p>Kaynaklara g&ouml;re, yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f a\u011f payla\u015f\u0131mlar\u0131n\u0131n neden olabilece\u011fi temel siber riskler \u015funlard\u0131r:<\/p>\n<ul>\n<li><strong>Yetkisiz Veri Eri\u015fimi:<\/strong> Hassas dosyalar\u0131n yetkisi olmayan kullan\u0131c\u0131lar taraf\u0131ndan g&ouml;r&uuml;nt&uuml;lenmesine veya de\u011fi\u015ftirilmesine yol a&ccedil;ar.<\/li>\n<li><strong>Yatay Yay\u0131lma (Lateral Movement):<\/strong> &Ouml;zellikle <strong>fidye yaz\u0131l\u0131mlar\u0131n\u0131n (ransomware)<\/strong> a\u011f i&ccedil;erisinde makineler aras\u0131nda kolayca yay\u0131lmas\u0131na zemin haz\u0131rlar.<\/li>\n<li><strong>\u0130&ccedil; Tehditler:<\/strong> K&ouml;t&uuml; niyetli veya dikkatsiz &ccedil;al\u0131\u015fanlar\u0131n (i&ccedil; tehditlerin), fark edilmeden veri s\u0131zd\u0131rmas\u0131na olanak tan\u0131r.<\/li>\n<li><strong>Denetim ve Uyumluluk Sorunlar\u0131:<\/strong> <strong>KVKK ve ISO 27001<\/strong> gibi yasal d&uuml;zenlemeler ve standartlara uyum konusunda ciddi a&ccedil;\u0131klar yaratarak yasal riskler olu\u015fturur.<\/li>\n<li><strong>G&ouml;r&uuml;nmezlik ve Log Sessizli\u011fi:<\/strong> Bu t&uuml;r risklerin en tehlikeli y&ouml;nlerinden biri, <strong>loglarda \"ba\u011f\u0131rmamas\u0131\"<\/strong> veya sistemlerde otomatik bir alarm &uuml;retmemesidir; risk orada sessizce bekler.<\/li>\n<li><strong>Y&ouml;netilemeyen Risk:<\/strong> E\u011fer bir IT y&ouml;neticisi a\u011fda \"kimin, neyi, neden payla\u015ft\u0131\u011f\u0131n\u0131\" net olarak g&ouml;remiyorsa, bu durum do\u011frudan y&ouml;netilemeyen bir riskin varl\u0131\u011f\u0131na i\u015farettir.<\/li>\n<\/ul>\n<p>&Ouml;zellikle <strong>\"Everyone\"<\/strong> veya &ccedil;ok geni\u015f gruplara a&ccedil;\u0131k dizinler, eski projelere ait unutulmu\u015f klas&ouml;rler, kullan\u0131c\u0131lar\u0131n manuel olarak a&ccedil;t\u0131\u011f\u0131 payla\u015f\u0131mlar ve yanl\u0131\u015fl\u0131kla payla\u015f\u0131lan <strong>yedekleme (backup) veya log klas&ouml;rleri<\/strong> en y&uuml;ksek risk grubunda yer almaktad\u0131r.<\/p>\n<p>Bu durumu bir binan\u0131n g&uuml;venli\u011fine benzetebiliriz: Binan\u0131n giri\u015fine en geli\u015fmi\u015f &ccedil;elik kap\u0131y\u0131 ve g&uuml;venlik kameralar\u0131n\u0131 (firewall ve antivir&uuml;s) yerle\u015ftirseniz bile, arka tarafta kimsenin hat\u0131rlamad\u0131\u011f\u0131 a&ccedil;\u0131k bir pencere (hatal\u0131 a\u011f payla\u015f\u0131m\u0131) b\u0131rakt\u0131\u011f\u0131n\u0131zda, t&uuml;m g&uuml;venlik &ouml;nlemleri i\u015flevsiz kalabilir.<\/p>\n<hr>\n<h2>Neden Network Payla\u015f\u0131mlar\u0131 Tehlikelidir?<\/h2>\n<p>Network payla\u015f\u0131mlar\u0131 do\u011frudan <strong>veriye eri\u015fim<\/strong> anlam\u0131na gelir.<br>Yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f bir payla\u015f\u0131m;<\/p>\n<ul>\n<li>\n<p>Yetkisiz kullan\u0131c\u0131lar\u0131n hassas dosyalara ula\u015fmas\u0131na<\/p>\n<\/li>\n<li>\n<p>Fidye yaz\u0131l\u0131mlar\u0131n\u0131n yatay olarak yay\u0131lmas\u0131na<\/p>\n<\/li>\n<li>\n<p>\u0130&ccedil; tehditlerin fark edilmeden veri s\u0131zd\u0131rmas\u0131na<\/p>\n<\/li>\n<li>\n<p>Denetim ve uyumluluk (KVKK, ISO 27001 vb.) sorunlar\u0131na<\/p>\n<\/li>\n<\/ul>\n<p>neden olabilir.<\/p>\n<p>&Uuml;stelik bu risklerin &ccedil;o\u011fu <strong>loglarda ba\u011f\u0131rmaz<\/strong>, alarm &uuml;retmez.<br>Sadece oradad\u0131r&hellip; sessizce.<\/p>\n<hr>\n<h2>Yakla\u015f\u0131m 1: Lokal G&ouml;r&uuml;n&uuml;rl&uuml;k (Tek Makine Kontrol&uuml;)<\/h2>\n<p>Basit ama etkili bir ilk ad\u0131m olarak, \u015f&uuml;pheli herhangi bir Windows makinesinde a\u015fa\u011f\u0131daki komut yeterlidir.<\/p>\n<p><strong>CMD (Run as Administrator):<\/strong><\/p>\n<pre><code class=\"language-cmd\">net share\n<\/code><\/pre>\n<p>Bu komut tek ekranda \u015funlar\u0131 g&ouml;sterir:<\/p>\n<ul>\n<li>\n<p>A&ccedil;\u0131k kullan\u0131c\u0131 payla\u015f\u0131mlar\u0131<\/p>\n<\/li>\n<li>\n<p>Gizli y&ouml;netici payla\u015f\u0131mlar\u0131 (C$, ADMIN$)<\/p>\n<\/li>\n<li>\n<p>Beklenmeyen veya unutulmu\u015f klas&ouml;rler<\/p>\n<\/li>\n<\/ul>\n<p>&Ouml;zellikle <strong>kullan\u0131c\u0131 taraf\u0131ndan manuel a&ccedil;\u0131lm\u0131\u015f<\/strong> payla\u015f\u0131mlar burada h\u0131zl\u0131ca fark edilir.<\/p>\n<p>Bu kontrol, bireysel makineler i&ccedil;in iyi bir ba\u015flang\u0131&ccedil;t\u0131r;<br>ancak kurumsal a\u011flar i&ccedil;in <strong>yeterli de\u011fildir<\/strong>.<\/p>\n<hr>\n<h2>Yakla\u015f\u0131m 2: Domain Genelinde G&ouml;r&uuml;n&uuml;rl&uuml;k (Ger&ccedil;ek Denetim)<\/h2>\n<p>Active Directory ortamlar\u0131nda as\u0131l de\u011fer,<br>lokal de\u011fil <strong>domain seviyesinde g&ouml;r&uuml;n&uuml;rl&uuml;k<\/strong> sa\u011flamakt\u0131r.<\/p>\n<p>Domain Admin yetkileriyle &ccedil;al\u0131\u015ft\u0131r\u0131labilecek &ouml;rnek bir PowerShell yakla\u015f\u0131m\u0131:<\/p>\n<pre><code class=\"language-powershell\">Get-ADComputer -Filter * | ForEach-Object {\n    try {\n        $shares = Get-SmbShare -CimSession $_.Name -ErrorAction SilentlyContinue\n        if ($shares) {\n            [PSCustomObject]@{\n                ComputerName = $_.Name\n                ShareName    = $shares.Name -join ', '\n                Path         = $shares.Path -join ' | '\n            }\n        }\n    } catch {}\n} | Format-Table -AutoSize\n<\/code><\/pre>\n<p>Bu script sayesinde:<\/p>\n<ul>\n<li>\n<p>Domain&rsquo;e ba\u011fl\u0131 t&uuml;m makineler taran\u0131r<\/p>\n<\/li>\n<li>\n<p>A&ccedil;\u0131k SMB payla\u015f\u0131mlar\u0131 listelenir<\/p>\n<\/li>\n<li>\n<p>Hangi makinede, hangi klas&ouml;r&uuml;n payla\u015f\u0131ld\u0131\u011f\u0131 netle\u015fir<\/p>\n<\/li>\n<\/ul>\n<p>Bu noktadan sonra art\u0131k <strong>&ldquo;bilmiyordum&rdquo;<\/strong> deme l&uuml;ks&uuml; yoktur.<\/p>\n<hr>\n<h2>Teknik Not<\/h2>\n<p>Bu komutun &ccedil;al\u0131\u015fabilmesi i&ccedil;in:<\/p>\n<ul>\n<li>\n<p><strong>Active Directory PowerShell mod&uuml;l&uuml; (RSAT)<\/strong> y&uuml;kl&uuml; olmal\u0131d\u0131r<\/p>\n<\/li>\n<li>\n<p>Aksi h&acirc;lde <code>Get-ADComputer<\/code> hatas\u0131 al\u0131n\u0131r<\/p>\n<\/li>\n<\/ul>\n<p>Kurumsal ortamlarda bu mod&uuml;l genellikle Domain Controller veya y&ouml;netim makinelerinde haz\u0131r bulunur.<\/p>\n<hr>\n<h2>En Tehlikeli Payla\u015f\u0131mlar Hangileridir?<\/h2>\n<blockquote>\n<p><strong>&ldquo;En tehlikeli payla\u015f\u0131mlar,<br>kimsenin hat\u0131rlamad\u0131\u011f\u0131 ama herkesin eri\u015febildi\u011fi payla\u015f\u0131mlard\u0131r.&rdquo;<\/strong><\/p>\n<\/blockquote>\n<p>&Ouml;zellikle dikkat edilmesi gerekenler:<\/p>\n<ul>\n<li>\n<p><code>Everyone<\/code> veya geni\u015f gruplara a&ccedil;\u0131k dizinler<\/p>\n<\/li>\n<li>\n<p>Eski projelere ait unutulmu\u015f klas&ouml;rler<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131c\u0131 profil dizinleri alt\u0131ndaki payla\u015f\u0131mlar<\/p>\n<\/li>\n<li>\n<p>Backup veya log klas&ouml;rlerinin yanl\u0131\u015fl\u0131kla payla\u015f\u0131lmas\u0131<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>Denetim Tek Seferlik Olmamal\u0131<\/h2>\n<p>Network share kontrolleri;<\/p>\n<ul>\n<li>\n<p>Tek seferlik yap\u0131lan bir i\u015f de\u011fil<\/p>\n<\/li>\n<li>\n<p>&ldquo;Bug&uuml;n bakt\u0131k, tamam&rdquo; denilecek bir konu de\u011fil<\/p>\n<\/li>\n<\/ul>\n<p>Bu s&uuml;re&ccedil;:<\/p>\n<ul>\n<li>\n<p><strong>Periyodik<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Raporlanabilir<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Standartla\u015ft\u0131r\u0131lm\u0131\u015f<\/strong><\/p>\n<\/li>\n<\/ul>\n<p>olmal\u0131d\u0131r.<\/p>\n<p>Aksi h&acirc;lde en iyi firewall, en g&uuml;ncel antivir&uuml;s bile<br>i&ccedil;erideki bu <strong>sessiz a&ccedil;\u0131k kap\u0131y\u0131<\/strong> kapatamaz.<\/p>\n<hr>\n<p>Network payla\u015f\u0131mlar\u0131 k&uuml;&ccedil;&uuml;k gibi g&ouml;r&uuml;nen ama etkisi b&uuml;y&uuml;k risklerdir.<br>Ger&ccedil;ek g&uuml;venlik, sadece tehditleri engellemek de\u011fil,<br><strong>neye sahip oldu\u011funuzu ve kimin eri\u015fti\u011fini bilmektir.<\/strong><\/p>\n<p>Bug&uuml;n kendinize \u015fu soruyu sorun:<\/p>\n<blockquote>\n<p><strong>&ldquo;\u015eu anda a\u011f\u0131mda ka&ccedil; payla\u015f\u0131m var ve ben bunlar\u0131n ka&ccedil;\u0131n\u0131 ger&ccedil;ekten biliyorum?&rdquo;<\/strong><\/p>\n<\/blockquote>\n<p>Cevap net de\u011filse,<br>ilk risk zaten ortaya &ccedil;\u0131km\u0131\u015f demektir.<\/p>","excerpt":"Kurumsal a\u011flarda g\u00fcvenlik a\u00e7\u0131klar\u0131 denildi\u011finde akla genellikle\u00a0zararl\u0131 yaz\u0131l\u0131mlar, zay\u0131f parolalar veya g\u00fcncel olmayan sistemler gelir.\nAncak pratikte en s\u0131k kar\u015f\u0131la\u015f\u0131lan \u2014 ve en \u00e7ok g\u00f6zden ka\u00e7an \u2014 risklerden biri a\u00e7\u0131k unutulmu\u015f network payla\u015f\u0131mlar\u0131d\u0131r.","created_at":"2025-12-21 08:55:44","updated_at":"2026-09-06 19:21:48","category_id":7,"view_count":572,"reading_time":9,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-12-21 05:55:44","featured_image":"\/uploads\/images\/2025\/12\/69478bd4b8286_1766296532.png","slug":"network-shares-denetimini-hafife-almayin","category_name":"Cyber Security","category_slug":"cyber-security","category_color":"#10b981"},{"id":349,"title":"Windows GPO Tabanl\u0131 Uygulama Engelleme: Kullan\u0131c\u0131 Ba\u011flam\u0131nda G\u00fcvenlik Sertle\u015ftirmesi","content":"<p>Bu yap\u0131land\u0131rma,&nbsp;<strong>Kullan\u0131c\u0131 Ba\u011flam\u0131nda Uygulama Engelleme<\/strong> stratejisi ile LOLBins ve bilinen k&ouml;t&uuml; ama&ccedil;l\u0131 yaz\u0131l\u0131mlar\u0131n &ccedil;al\u0131\u015ft\u0131r\u0131lmas\u0131n\u0131 engelleyerek sald\u0131r\u0131 y&uuml;zeyini minimize eder.<\/p>\n<h2>Temel GPO Yap\u0131land\u0131rmas\u0131<\/h2>\n<h3>1. Yeni GPO Olu\u015fturma<\/h3>\n<pre><code class=\"language-powershell\"># PowerShell ile GPO olu\u015fturma\nNew-GPO -Name \"W11-User-Application-Blocking\" -Comment \"LOLBins ve malware engellemesi\"\n\n# OU'ya ba\u011flama\nNew-GPLink -Name \"W11-User-Application-Blocking\" `\n           -Target \"OU=Users,DC=contoso,DC=local\" `\n           -LinkEnabled Yes `\n           -Order 1\n<\/code><\/pre>\n<h3>2. Loopback Processing Yap\u0131land\u0131rmas\u0131<\/h3>\n<pre><code>Computer Configuration &rarr; Policies &rarr; Administrative Templates &rarr; System &rarr; Group Policy\n&rarr; \"Configure user Group Policy loopback processing mode\" = Enabled (Merge mode)\n<\/code><\/pre>\n<h2>&nbsp;Security Filtering Yap\u0131land\u0131rmas\u0131<\/h2>\n<h3>PowerShell ile G&uuml;venlik Filtreleme<\/h3>\n<pre><code class=\"language-powershell\"># GPO Security Filtering ayarlama\n$GPO = Get-GPO -Name \"W11-User-Application-Blocking\"\n\n# Varsay\u0131lan \"Authenticated Users\" kald\u0131r\nSet-GPPermission -Name $GPO.DisplayName `\n                  -TargetName \"Authenticated Users\" `\n                  -TargetType Group `\n                  -PermissionLevel None\n\n# Standart kullan\u0131c\u0131lar\u0131 ekle\nSet-GPPermission -Name $GPO.DisplayName `\n                  -TargetName \"Domain Users\" `\n                  -TargetType Group `\n                  -PermissionLevel GpoApply\n\n# Local Users ekle (SID kullanarak)\nSet-GPPermission -Name $GPO.DisplayName `\n                  -TargetName \"S-1-5-32-545\" `\n                  -TargetType Group `\n                  -PermissionLevel GpoApply\n\n# Hari&ccedil; tutulacak gruplar (Read only izni)\n$ExcludedGroups = @(\n    \"Domain Admins\",\n    \"Enterprise Admins\",\n    \"IT-Helpdesk\",\n    \"Security-Admins\"\n)\n\nforeach ($group in $ExcludedGroups) {\n    Set-GPPermission -Name $GPO.DisplayName `\n                      -TargetName $group `\n                      -TargetType Group `\n                      -PermissionLevel GpoRead\n}\n<\/code><\/pre>\n<h2>Engellenecek Uygulamalar Listesi<\/h2>\n<h3>Kategorize Edilmi\u015f Engelleme Listesi<\/h3>\n<pre><code class=\"language-powershell\"># Tam engelleme listesi\n$BlockedApplications = @{\n    # Script Motorlar\u0131 ve Shell'ler\n    \"ScriptEngines\" = @(\n        \"powershell.exe\",\n        \"pwsh.exe\",\n        \"powershell_ise.exe\",\n        \"wscript.exe\",\n        \"cscript.exe\",\n        \"mshta.exe\",\n        \"cmd.exe\",\n        \"bash.exe\",\n        \"wsl.exe\"\n    )\n    \n    # \u0130ndirme\/C2 LOLBins\n    \"DownloadC2\" = @(\n        \"bitsadmin.exe\",\n        \"certutil.exe\",\n        \"curl.exe\",\n        \"ftp.exe\",\n        \"tftp.exe\",\n        \"xwizard.exe\"\n    )\n    \n    # Kurulum\/Proxy-Execution\n    \"ProxyExecution\" = @(\n        \"msiexec.exe\",\n        \"installutil.exe\",\n        \"regsvr32.exe\",\n        \"rundll32.exe\"\n    )\n    \n    # Persistence\/Lateral Movement\n    \"PersistenceLateral\" = @(\n        \"schtasks.exe\",\n        \"wmic.exe\",\n        \"winrs.exe\",\n        \"cmdkey.exe\",\n        \"reg.exe\"\n    )\n    \n    # Bilinen Malware\/Ara&ccedil;lar\n    \"KnownMalware\" = @(\n        \"agenttesla.exe\",\n        \"darkcomet.exe\",\n        \"havoc.exe\",\n        \"masscan.exe\",\n        \"meterpreter.exe\",\n        \"mimikatz.exe\",\n        \"mimilib.dll\",\n        \"msfvenom.exe\",\n        \"mythic.exe\",\n        \"nanocore.exe\",\n        \"ncat.exe\",\n        \"netcat.exe\",\n        \"nmap.exe\",\n        \"nping.exe\",\n        \"pathping.exe\",\n        \"pcalua.exe\",\n        \"pubprn.vbs\",\n        \"remcos.exe\",\n        \"revenge_rat.exe\",\n        \"sekurlsa.exe\",\n        \"sliver.exe\",\n        \"teamserver.exe\",\n        \"token.exe\",\n        \"vbc.exe\",\n        \"wevtutil.exe\",\n        \"winexe.exe\",\n        \"wusa.exe\",\n        \"xwizard.exe\",\n        \"wlrmdr.exe\",\n        \"zmap.exe\"\n    )\n}\n<\/code><\/pre>\n<h2>GPO Registry Ayarlar\u0131<\/h2>\n<h3>Registry.pol Dosyas\u0131 Olu\u015fturma<\/h3>\n<pre><code class=\"language-powershell\">function Create-AppBlockingRegistry {\n    param(\n        [string]$GPOName = \"W11-User-Application-Blocking\"\n    )\n    \n    $regPath = \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\"\n    \n    # Komut sat\u0131r\u0131 eri\u015fimini engelle\n    Set-GPRegistryValue -Name $GPOName `\n        -Key $regPath `\n        -ValueName \"DisableCMD\" `\n        -Type DWORD `\n        -Value 2\n    \n    # Registry edit&ouml;rlerini engelle\n    Set-GPRegistryValue -Name $GPOName `\n        -Key $regPath `\n        -ValueName \"DisableRegistryTools\" `\n        -Type DWORD `\n        -Value 1\n    \n    # Run men&uuml;s&uuml;n&uuml; devre d\u0131\u015f\u0131 b\u0131rak\n    Set-GPRegistryValue -Name $GPOName `\n        -Key $regPath `\n        -ValueName \"NoRun\" `\n        -Type DWORD `\n        -Value 1\n}\n<\/code><\/pre>\n<h2>Software Restriction Policies (SRP) Yap\u0131land\u0131rmas\u0131<\/h2>\n<h3>PowerShell ile SRP Olu\u015fturma<\/h3>\n<pre><code class=\"language-powershell\">function Configure-SoftwareRestrictionPolicies {\n    param(\n        [string]$GPOName = \"W11-User-Application-Blocking\"\n    )\n    \n    # SRP i&ccedil;in temel path\n    $srpPath = \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\"\n    \n    # Varsay\u0131lan g&uuml;venlik seviyesi (Unrestricted)\n    Set-GPRegistryValue -Name $GPOName `\n        -Key $srpPath `\n        -ValueName \"DefaultLevel\" `\n        -Type DWORD `\n        -Value 262144\n    \n    # Her bir engellenecek uygulama i&ccedil;in hash rule olu\u015ftur\n    $ruleGuid = 0\n    foreach ($category in $BlockedApplications.Keys) {\n        foreach ($app in $BlockedApplications[$category]) {\n            $ruleGuid++\n            $guidString = \"{\" + [guid]::NewGuid().ToString().ToUpper() + \"}\"\n            \n            # Path rule olu\u015ftur\n            $rulePath = \"$srpPath\\0\\Paths\\$guidString\"\n            \n            Set-GPRegistryValue -Name $GPOName `\n                -Key $rulePath `\n                -ValueName \"ItemData\" `\n                -Type String `\n                -Value \"*\\$app\"\n            \n            Set-GPRegistryValue -Name $GPOName `\n                -Key $rulePath `\n                -ValueName \"SaferFlags\" `\n                -Type DWORD `\n                -Value 0\n        }\n    }\n}\n<\/code><\/pre>\n<h2>ADMX Template Olu\u015fturma<\/h2>\n<h3>Custom ADMX Template<\/h3>\n<pre><code class=\"language-xml\">&lt;?xml version=\"1.0\" encoding=\"utf-8\"?&gt;\n&lt;policyDefinitions xmlns:xsd=\"http:\/\/www.w3.org\/2001\/XMLSchema\"\n                   xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\"\n                   revision=\"1.0\"\n                   schemaVersion=\"1.0\"\n                   xmlns=\"http:\/\/schemas.microsoft.com\/GroupPolicy\/2006\/07\/PolicyDefinitions\"&gt;\n  \n  &lt;policyNamespaces&gt;\n    &lt;target prefix=\"w11block\" namespace=\"Microsoft.Policies.W11ApplicationBlocking\" \/&gt;\n  &lt;\/policyNamespaces&gt;\n  \n  &lt;resources minRequiredRevision=\"1.0\" \/&gt;\n  \n  &lt;categories&gt;\n    &lt;category name=\"W11_App_Blocking\" displayName=\"$(string.W11_App_Blocking)\"&gt;\n      &lt;parentCategory ref=\"windows:System\" \/&gt;\n    &lt;\/category&gt;\n  &lt;\/categories&gt;\n  \n  &lt;policies&gt;\n    &lt;policy name=\"BlockLOLBins\" \n            class=\"User\" \n            displayName=\"$(string.BlockLOLBins)\"\n            explainText=\"$(string.BlockLOLBins_Help)\"\n            key=\"Software\\Policies\\W11Block\"\n            valueName=\"BlockLOLBins\"&gt;\n      &lt;parentCategory ref=\"W11_App_Blocking\" \/&gt;\n      &lt;supportedOn ref=\"windows:SUPPORTED_Windows_10_0\" \/&gt;\n      &lt;enabledValue&gt;\n        &lt;decimal value=\"1\" \/&gt;\n      &lt;\/enabledValue&gt;\n      &lt;disabledValue&gt;\n        &lt;decimal value=\"0\" \/&gt;\n      &lt;\/disabledValue&gt;\n    &lt;\/policy&gt;\n  &lt;\/policies&gt;\n&lt;\/policyDefinitions&gt;\n<\/code><\/pre>\n<h2>Test ve Do\u011frulama<\/h2>\n<h3>Test Script'i<\/h3>\n<pre><code class=\"language-powershell\">function Test-ApplicationBlocking {\n    [CmdletBinding()]\n    param(\n        [string]$TestUser = \"testuser@domain.local\"\n    )\n    \n    # Test edilecek uygulamalar\n    $testApps = @(\n        @{Name=\"PowerShell\"; Path=\"powershell.exe\"; Command=\"-NoProfile -Command Write-Host 'Test'\"},\n        @{Name=\"CMD\"; Path=\"cmd.exe\"; Command=\"\/c echo Test\"},\n        @{Name=\"CertUtil\"; Path=\"certutil.exe\"; Command=\"-?\"}\n    )\n    \n    Write-Host \"Testing Application Blocking for: $TestUser\" -ForegroundColor Cyan\n    Write-Host \"=\" * 50\n    \n    foreach ($app in $testApps) {\n        try {\n            # RunAs ile test\n            $credential = Get-Credential -UserName $TestUser\n            $process = Start-Process -FilePath $app.Path `\n                                    -ArgumentList $app.Command `\n                                    -Credential $credential `\n                                    -PassThru `\n                                    -Wait `\n                                    -ErrorAction Stop\n            \n            if ($process.ExitCode -eq 0) {\n                Write-Host \"\u274c $($app.Name): NOT BLOCKED\" -ForegroundColor Red\n            } else {\n                Write-Host \"\u2705 $($app.Name): BLOCKED\" -ForegroundColor Green\n            }\n        }\n        catch {\n            Write-Host \"\u2705 $($app.Name): BLOCKED (Exception)\" -ForegroundColor Green\n        }\n    }\n}\n<\/code><\/pre>\n<h2>Rollback Plan\u0131<\/h2>\n<h3>Acil Durum Geri Alma<\/h3>\n<pre><code class=\"language-powershell\">function Emergency-Rollback {\n    param(\n        [string]$GPOName = \"W11-User-Application-Blocking\"\n    )\n    \n    # GPO'yu devre d\u0131\u015f\u0131 b\u0131rak\n    $GPO = Get-GPO -Name $GPOName\n    $GPO.GpoStatus = \"AllSettingsDisabled\"\n    \n    # GPO linklerini kald\u0131r\n    Get-GPOReport -Name $GPOName -ReportType Xml | \n        Select-Xml -XPath \"\/\/LinksTo\/SOMPath\" | \n        ForEach-Object {\n            Remove-GPLink -Name $GPOName -Target $_.Node.InnerText -Confirm:$false\n        }\n    \n    # Kullan\u0131c\u0131larda zorla g&uuml;ncelleme\n    Invoke-Command -ComputerName (Get-ADComputer -Filter *).Name -ScriptBlock {\n        gpupdate \/force\n    }\n    \n    Write-Host \"Emergency rollback completed!\" -ForegroundColor Yellow\n}\n<\/code><\/pre>\n<h2>Monitoring ve Raporlama<\/h2>\n<h3>Event Log \u0130zleme<\/h3>\n<pre><code class=\"language-powershell\"># AppLocker\/SRP event monitoring\nfunction Get-BlockedApplicationEvents {\n    param(\n        [int]$Hours = 24\n    )\n    \n    $startTime = (Get-Date).AddHours(-$Hours)\n    \n    # Event ID'ler\n    # 865: SRP blocked\n    # 866: SRP warning\n    # 8003: AppLocker blocked\n    \n    Get-WinEvent -FilterHashtable @{\n        LogName = 'Application'\n        ID = 865, 866, 8003\n        StartTime = $startTime\n    } | Select-Object TimeCreated, Id, Message, UserId |\n        Export-Csv \"BlockedApps_$(Get-Date -Format 'yyyyMMdd').csv\"\n}\n<\/code><\/pre>\n<h2>&Ouml;nemli Uyar\u0131lar<\/h2>\n<h3>Kritik Dikkat Edilmesi Gerekenler<\/h3>\n<ol>\n<li>\n<p><strong>rundll32.exe Engelleme<\/strong><\/p>\n<ul>\n<li>Bir&ccedil;ok sistem fonksiyonu rundll32 kullan\u0131r<\/li>\n<li>Engellemeden &ouml;nce kapsaml\u0131 test yap\u0131n<\/li>\n<li>Alternatif: Yaln\u0131zca belirli DLL'lere izin verin<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>msiexec.exe K\u0131s\u0131tlamas\u0131<\/strong><\/p>\n<ul>\n<li>Windows Update'ler etkilenebilir<\/li>\n<li>SCCM\/Intune da\u011f\u0131t\u0131mlar\u0131 bozulabilir<\/li>\n<li>&Ccedil;&ouml;z&uuml;m: Sistem hesaplar\u0131 i&ccedil;in istisna<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>wevtutil.exe<\/strong><\/p>\n<ul>\n<li>Log toplama sistemleri etkilenebilir<\/li>\n<li>SIEM entegrasyonlar\u0131 kontrol edilmeli<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<h2>\u0130leri Seviye Yap\u0131land\u0131rmalar<\/h2>\n<h3>AppLocker ile Entegrasyon<\/h3>\n<pre><code class=\"language-xml\">&lt;AppLockerPolicy Version=\"1\"&gt;\n  &lt;RuleCollection Type=\"Exe\" EnforcementMode=\"Enabled\"&gt;\n    &lt;FilePublisherRule Id=\"a61c8b3c-a27f-4c8b-8e8a-8b4e62d8565f\" \n                       Name=\"MICROSOFT WINDOWS OPERATING SYSTEM\" \n                       Description=\"\" \n                       UserOrGroupSid=\"S-1-1-0\" \n                       Action=\"Allow\"&gt;\n      &lt;Conditions&gt;\n        &lt;FilePublisherCondition PublisherName=\"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\" \n                                ProductName=\"MICROSOFT&reg; WINDOWS&reg; OPERATING SYSTEM\" \n                                BinaryName=\"*\"&gt;\n          &lt;BinaryVersionRange LowSection=\"*\" HighSection=\"*\"\/&gt;\n        &lt;\/FilePublisherCondition&gt;\n      &lt;\/Conditions&gt;\n      &lt;Exceptions&gt;\n        &lt;!-- LOLBins exception listesi --&gt;\n        &lt;FilePathCondition Path=\"%SYSTEM32%\\certutil.exe\"\/&gt;\n        &lt;FilePathCondition Path=\"%SYSTEM32%\\bitsadmin.exe\"\/&gt;\n      &lt;\/Exceptions&gt;\n    &lt;\/FilePublisherRule&gt;\n  &lt;\/RuleCollection&gt;\n&lt;\/AppLockerPolicy&gt;\n<\/code><\/pre>\n<h2>Sonu&ccedil; ve &Ouml;neriler<\/h2>\n<p>Bu GPO tabanl\u0131 uygulama engelleme stratejisi:<\/p>\n<ul>\n<li>\u2705 Kullan\u0131c\u0131 seviyesinde g&uuml;&ccedil;l&uuml; kontrol sa\u011flar<\/li>\n<li>\u2705 LOLBins sald\u0131r\u0131 vekt&ouml;rlerini minimize eder<\/li>\n<li>\u2705 MITRE ATT&amp;CK T1218 tekniklerini engeller<\/li>\n<li>\u2705 Zero Trust prensipleriyle uyumludur<\/li>\n<\/ul>\n<p><strong>Kritik Ba\u015far\u0131 Fakt&ouml;rleri:<\/strong><\/p>\n<ol>\n<li>Test ortam\u0131nda kapsaml\u0131 validasyon<\/li>\n<li>Kademeli da\u011f\u0131t\u0131m stratejisi<\/li>\n<li>\u0130stisna y&ouml;netimi prosed&uuml;rleri<\/li>\n<li>S&uuml;rekli monitoring ve iyile\u015ftirme<\/li>\n<\/ol>\n<p>v<\/p>","excerpt":"Bu yap\u0131land\u0131rma,\u00a0Kullan\u0131c\u0131 Ba\u011flam\u0131nda Uygulama Engelleme stratejisi ile LOLBins ve bilinen k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131n \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131n\u0131 engelleyerek sald\u0131r\u0131 y\u00fczeyini minimize eder.","created_at":"2025-11-26 17:47:33","updated_at":"2026-09-07 04:55:29","category_id":6,"view_count":745,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-11-26 14:47:33","featured_image":"resimyok.jpg","slug":"windows-gpo-tabanli-uygulama-engelleme-kullanici-baglaminda-guvenlik-sertlestirmesi","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":348,"title":"Windows 11 G\u00fcvenlik Duvar\u0131 LOLBin Engelleme Script'i","content":"<p>Bu PowerShell script'i, Windows 11 sistemlerinde&nbsp;<strong>Living Off the Land Binaries (LOLBins)<\/strong> olarak bilinen ve sald\u0131rganlar taraf\u0131ndan s\u0131k&ccedil;a k&ouml;t&uuml;ye kullan\u0131lan Windows sistem dosyalar\u0131n\u0131n giden trafi\u011fini engelleyerek g&uuml;venli\u011fi art\u0131rmay\u0131 hedeflemektedir.<\/p>\r\n<h2><iframe src=\"https:\/\/www.youtube.com\/embed\/U5yfnlpgm9U\" width=\"560\" height=\"314\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/h2>\r\n<h2>LOLBin Nedir?<\/h2>\r\n<p>LOLBin (Living Off the Land Binary), Windows i\u015fletim sisteminde varsay\u0131lan olarak bulunan ve k&ouml;t&uuml; ama&ccedil;l\u0131 faaliyetler i&ccedil;in kullan\u0131labilen me\u015fru programlard\u0131r. Sald\u0131rganlar bu ara&ccedil;lar\u0131 kullanarak:<\/p>\r\n<ul>\r\n<li>Antivir&uuml;s tespitinden ka&ccedil;\u0131nabilir<\/li>\r\n<li>AppLocker kontrollerini atlayabilir<\/li>\r\n<li>Command &amp; Control (C2) ileti\u015fimi kurabilir<\/li>\r\n<li>Veri s\u0131zd\u0131rabilir<\/li>\r\n<\/ul>\r\n<h2>Script'in Temel &Ouml;zellikleri<\/h2>\r\n<h3>1. <strong>G&uuml;venlik Duvar\u0131 Profil Sertle\u015ftirme<\/strong><\/h3>\r\n<pre><code class=\"language-powershell\"># T&uuml;m profiller i&ccedil;in varsay\u0131lan engelleme\r\nSet-NetFirewallProfile -Profile Domain,Private,Public `\r\n    -Enabled True `\r\n    -DefaultInboundAction Block `\r\n    -DefaultOutboundAction Allow\r\n<\/code><\/pre>\r\n<h3>2. <strong>Kritik Port Engellemeleri<\/strong><\/h3>\r\n<ul>\r\n<li><strong>SMB (445, 139)<\/strong>: Lateral movement engellemesi<\/li>\r\n<li><strong>RDP (3389)<\/strong>: Uzaktan eri\u015fim g&uuml;venli\u011fi<\/li>\r\n<li><strong>WinRM (5985\/5986)<\/strong>: PowerShell remoting korumas\u0131<\/li>\r\n<li><strong>RPC (135)<\/strong>: WMI\/DCOM sald\u0131r\u0131 vekt&ouml;r&uuml; engelleme<\/li>\r\n<\/ul>\r\n<h3>3. <strong>LOLBin Engellemeleri<\/strong><\/h3>\r\n<h2>&nbsp;Engellenen LOLBin Listesi ve Riskleri<\/h2>\r\n<table>\r\n<thead>\r\n<tr>\r\n<th><strong>LOLBin<\/strong><\/th>\r\n<th><strong>Risk Seviyesi<\/strong><\/th>\r\n<th><strong>K&ouml;t&uuml;ye Kullan\u0131m Senaryolar\u0131<\/strong><\/th>\r\n<\/tr>\r\n<\/thead>\r\n<tbody>\r\n<tr>\r\n<td><strong>PowerShell.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f Kritik<\/td>\r\n<td>Malware indirme, C2 ileti\u015fimi, kod &ccedil;al\u0131\u015ft\u0131rma<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Certutil.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f Y&uuml;ksek<\/td>\r\n<td>Base64 decode, dosya indirme, sertifika manip&uuml;lasyonu<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Regsvr32.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f Y&uuml;ksek<\/td>\r\n<td>Proxy execution, DLL y&uuml;kleme, bypass teknikleri<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Rundll32.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f Y&uuml;ksek<\/td>\r\n<td>DLL &ccedil;al\u0131\u015ft\u0131rma, process injection<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>MSBuild.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f Orta<\/td>\r\n<td>Kod derleme ve &ccedil;al\u0131\u015ft\u0131rma<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Wmic.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f Y&uuml;ksek<\/td>\r\n<td>WMI komut &ccedil;al\u0131\u015ft\u0131rma, bilgi toplama<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Wscript\/Cscript<\/strong><\/td>\r\n<td>\u26a0\ufe0f Y&uuml;ksek<\/td>\r\n<td>VBS\/JS malware &ccedil;al\u0131\u015ft\u0131rma<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>BitsAdmin.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f Orta<\/td>\r\n<td>Dosya transferi, persistence<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>Curl.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f Orta<\/td>\r\n<td>Veri s\u0131zd\u0131rma, dosya indirme<\/td>\r\n<\/tr>\r\n<tr>\r\n<td><strong>FTP.exe<\/strong><\/td>\r\n<td>\u26a0\ufe0f D&uuml;\u015f&uuml;k<\/td>\r\n<td>Dosya transferi<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<h2>Script'i G&uuml;venli Uygulama<\/h2>\r\n<h3>&Ouml;n Haz\u0131rl\u0131k<\/h3>\r\n<pre><code class=\"language-powershell\"># 1. Mevcut kurallar\u0131 yedekle\r\nnetsh advfirewall export \"C:\\Backup\\firewall_backup.wfw\"\r\n\r\n# 2. Script'i test ortam\u0131nda dene\r\n# Test VM'de &ccedil;al\u0131\u015ft\u0131r ve sonu&ccedil;lar\u0131 g&ouml;zlemle\r\n\r\n# 3. \u0130zin verilecek sunucular\u0131 tan\u0131mla\r\n$AllowedSMBServers = @(\r\n    \"192.168.1.10\",  # Domain Controller\r\n    \"192.168.1.20\"   # File Server\r\n)\r\n<\/code><\/pre>\r\n<h3>&Ouml;zelle\u015ftirilmi\u015f Uygulama<\/h3>\r\n<pre><code class=\"language-powershell\"># Organizasyona &ouml;zel LOLBin ekleme\r\n$CustomLOLBins = @(\r\n    @{ Name = \"Block TeamViewer\"; Path = \"C:\\Program Files\\TeamViewer\\TeamViewer.exe\" },\r\n    @{ Name = \"Block AnyDesk\"; Path = \"C:\\Program Files\\AnyDesk\\AnyDesk.exe\" }\r\n)\r\n\r\n# Script'e ekle\r\nforeach ($item in $CustomLOLBins) {\r\n    Ensure-ProgramBlockRule -Name $item.Name -ProgramPath $item.Path\r\n}\r\n<\/code><\/pre>\r\n<h2>Monitoring ve Logging<\/h2>\r\n<h3>PowerShell ile Log Analizi<\/h3>\r\n<pre><code class=\"language-powershell\"># Engellenen trafi\u011fi izleme\r\nfunction Get-BlockedTraffic {\r\n    $logPath = \"$env:windir\\system32\\LogFiles\\Firewall\\pfirewall.log\"\r\n    Get-Content $logPath -Tail 100 | \r\n        Where-Object {$_ -match \"DROP\"} |\r\n        ConvertFrom-Csv -Delimiter \" \" |\r\n        Select-Object date, time, action, protocol, src-ip, dst-ip, dst-port\r\n}\r\n\r\n# Rapor olu\u015fturma\r\nGet-BlockedTraffic | \r\n    Group-Object dst-port | \r\n    Sort-Object Count -Descending |\r\n    Select-Object Count, Name |\r\n    Export-Csv \"C:\\Reports\\blocked_traffic.csv\"\r\n<\/code><\/pre>\r\n<h2>Potansiyel Sorunlar ve &Ccedil;&ouml;z&uuml;mleri<\/h2>\r\n<h3>1. <strong>Me\u015fru Uygulama Engellemeleri<\/strong><\/h3>\r\n<pre><code class=\"language-powershell\"># Whitelist olu\u015fturma\r\n$WhitelistApps = @(\r\n    \"C:\\Program Files\\Microsoft\\Exchange Server\\*\",\r\n    \"C:\\Program Files\\SQL Server\\*\"\r\n)\r\n\r\n# \u0130stisna kural\u0131 ekleme\r\nforeach ($app in $WhitelistApps) {\r\n    New-NetFirewallRule -DisplayName \"Allow $app\" `\r\n        -Direction Outbound `\r\n        -Program $app `\r\n        -Action Allow `\r\n        -Priority 1\r\n}\r\n<\/code><\/pre>\r\n<h3>2. <strong>PowerShell Gereksinimi<\/strong><\/h3>\r\n<pre><code class=\"language-powershell\"># G&uuml;venilir host'lar i&ccedil;in izin\r\n$TrustedHosts = @(\"10.0.0.5\", \"10.0.0.10\")\r\nforeach ($host in $TrustedHosts) {\r\n    New-NetFirewallRule -DisplayName \"Allow PowerShell to $host\" `\r\n        -Direction Outbound `\r\n        -Program \"$env:windir\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" `\r\n        -RemoteAddress $host `\r\n        -Action Allow\r\n}\r\n<\/code><\/pre>\r\n<h2>Alternatif Yakla\u015f\u0131mlar<\/h2>\r\n<h3>1. <strong>AppLocker Entegrasyonu<\/strong><\/h3>\r\n<pre><code class=\"language-xml\"><!-- AppLocker politikas\u0131 ile birlikte kullan\u0131m -->\r\n\r\n  \r\n    \r\n      \r\n        \r\n      \r\n    \r\n  \r\n\r\n<\/code><\/pre>\r\n<h3>2. <strong>WDAC (Windows Defender Application Control)<\/strong><\/h3>\r\n<pre><code class=\"language-powershell\"># WDAC politikas\u0131 olu\u015fturma\r\nNew-CIPolicy -Level Publisher `\r\n    -FilePath \".\\WDAC-Policy.xml\" `\r\n    -UserPEs `\r\n    -Deny \"C:\\Windows\\System32\\certutil.exe\"\r\n<\/code><\/pre>\r\n<h2>Performans Etkisi ve Optimizasyon<\/h2>\r\n<pre><code class=\"language-powershell\"># Kural say\u0131s\u0131n\u0131 kontrol et\r\n(Get-NetFirewallRule | Where-Object {$_.DisplayName -like \"W11-HARDENING*\"}).Count\r\n\r\n# Performans metrikleri\r\nMeasure-Command {\r\n    Get-NetFirewallRule | Where-Object {$_.Enabled -eq $true}\r\n} | Select-Object TotalMilliseconds\r\n\r\n# Optimize edilmi\u015f kural gruplamas\u0131\r\n# Tek tek kural yerine grup halinde uygulama\r\n$LOLBinPaths = @(\r\n    \"$env:windir\\System32\\certutil.exe\",\r\n    \"$env:windir\\System32\\regsvr32.exe\",\r\n    \"$env:windir\\System32\\rundll32.exe\"\r\n)\r\n\r\nNew-NetFirewallRule -DisplayName \"Block All LOLBins\" `\r\n    -Direction Outbound `\r\n    -Program $LOLBinPaths `\r\n    -Action Block\r\n<\/code><\/pre>\r\n<h2>De\u011ferlendirme Metrikleri<\/h2>\r\n<h3>Script Etkinli\u011fi Kontrol&uuml;<\/h3>\r\n<pre><code class=\"language-powershell\"># Test senaryolar\u0131\r\nfunction Test-LOLBinBlocking {\r\n    $tests = @{\r\n        \"Certutil\" = { certutil.exe -urlcache -f http:\/\/example.com\/test.txt }\r\n        \"PowerShell\" = { Invoke-WebRequest -Uri http:\/\/example.com }\r\n        \"BitsAdmin\" = { bitsadmin \/transfer test http:\/\/example.com\/file C:\\temp\\file }\r\n    }\r\n    \r\n    foreach ($test in $tests.GetEnumerator()) {\r\n        try {\r\n            &amp; $test.Value\r\n            Write-Host \"\u274c $($test.Key) - BLOCKED FAILED\" -ForegroundColor Red\r\n        } catch {\r\n            Write-Host \"\u2705 $($test.Key) - Successfully Blocked\" -ForegroundColor Green\r\n        }\r\n    }\r\n}\r\n<\/code><\/pre>\r\n<h2>G&uuml;venlik En \u0130yi Uygulamalar\u0131<\/h2>\r\n<ol>\r\n<li>\r\n<p><strong>Kademeli Da\u011f\u0131t\u0131m<\/strong><\/p>\r\n<ul>\r\n<li>&Ouml;nce test ortam\u0131nda uygula<\/li>\r\n<li>Pilot grup ile ba\u015fla<\/li>\r\n<li>Log'lar\u0131 analiz et<\/li>\r\n<li>T&uuml;m sisteme yay<\/li>\r\n<\/ul>\r\n<\/li>\r\n<li>\r\n<p><strong>D&uuml;zenli G&uuml;ncelleme<\/strong><\/p>\r\n<ul>\r\n<li>Yeni LOLBin'leri takip et<\/li>\r\n<li>MITRE ATT&amp;CK g&uuml;ncellemelerini kontrol et<\/li>\r\n<li>Ayl\u0131k g&ouml;zden ge&ccedil;irme yap<\/li>\r\n<\/ul>\r\n<\/li>\r\n<li>\r\n<p><strong>Kompansatuar Kontroller<\/strong><\/p>\r\n<ul>\r\n<li>EDR &ccedil;&ouml;z&uuml;m&uuml; kullan<\/li>\r\n<li>Sysmon loglama aktif et<\/li>\r\n<li>SIEM entegrasyonu sa\u011fla<\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ol>\r\n<p>Bu script,&nbsp;<strong>Defense in Depth<\/strong> stratejisinin &ouml;nemli bir par&ccedil;as\u0131d\u0131r ve:<\/p>\r\n<ul>\r\n<li>\u2705 C2 ileti\u015fimini zorla\u015ft\u0131r\u0131r<\/li>\r\n<li>\u2705 Veri s\u0131zd\u0131rma riskini azalt\u0131r<\/li>\r\n<li>\u2705 APT sald\u0131r\u0131lar\u0131na kar\u015f\u0131 diren&ccedil; sa\u011flar<\/li>\r\n<li>\u2705 CIS ve Microsoft Security Baseline ile uyumludur<\/li>\r\n<\/ul>\r\n<p><strong>Kritik Not<\/strong>: Script'i uygulamadan &ouml;nce mutlaka:<\/p>\r\n<ol>\r\n<li>Test ortam\u0131nda deneyin<\/li>\r\n<li>\u0130\u015f kritik uygulamalar\u0131 belirleyin<\/li>\r\n<li>Rollback plan\u0131 haz\u0131rlay\u0131n<\/li>\r\n<li>Monitoring altyap\u0131s\u0131n\u0131 kurun<\/li>\r\n<\/ol>\r\n<p>Bu yakla\u015f\u0131m, &ouml;zellikle <strong>Zero Trust<\/strong> mimarisi benimseyen organizasyonlar i&ccedil;in g&uuml;&ccedil;l&uuml; bir g&uuml;venlik katman\u0131 sa\u011flamaktad\u0131r.<\/p>\r\n<pre class=\"language-csharp\"><code>&lt;#\r\n\r\n.SYNOPSIS\r\n\r\n Windows 11 Pro Firewall Hardening Script\r\n\r\n.DESCRIPTION\r\n\r\n Implements firewall hardening recommendations:\r\n\r\n - Secure profile defaults (Domain\/Private\/Public)\r\n\r\n - Block high-risk inbound ports (SMB, RDP, WinRM, WMI\/DCOM, discovery protocols)\r\n\r\n - Restrict outbound SMB to approved servers\r\n\r\n - Block outbound traffic from commonly abused Windows binaries (LOLBins)\r\n\r\n - Disable local firewall rule overrides\r\n\r\n.NOTES\r\n\r\n Run as Administrator.\r\n\r\n Test in a lab before broad deployment.\r\n\r\n#&gt;\r\n\r\n$ErrorActionPreference = \"Stop\"\r\n\r\n# ============================\r\n\r\n# CONFIGURABLE SETTINGS\r\n\r\n# ============================\r\n\r\n# List of file servers allowed to receive outbound SMB (TCP 445) from this workstation.\r\n\r\n# Use IP addresses or CIDR ranges. Leave empty to block all outbound SMB. Include Domain Controllers and File Servers here:\r\n\r\n$AllowedSMBServers = @(\r\n\r\n # \"192.168.10.10\",\r\n\r\n # \"10.0.0.5\"\r\n\r\n)\r\n\r\n# Whether to block inbound RDP (recommended unless you explicitly use RDP to this PC)\r\n\r\n$BlockRDPInbound = $true\r\n\r\n# Name prefix for all rules this script manages\r\n\r\n$RulePrefix = \"W11-HARDEN - \"\r\n\r\n# ============================\r\n\r\n# HELPER FUNCTIONS\r\n\r\n# ============================\r\n\r\nfunction Set-FirewallProfileSecure {\r\n\r\n param(\r\n\r\n [Parameter(Mandatory)][ValidateSet(\"Domain\",\"Private\",\"Public\")]\r\n\r\n [string]$ProfileName\r\n\r\n )\r\n\r\n Write-Host \"Configuring firewall profile: $ProfileName\"\r\n\r\n Set-NetFirewallProfile -Profile $ProfileName `\r\n\r\n -Enabled True `\r\n\r\n -DefaultInboundAction Block `\r\n\r\n -DefaultOutboundAction Allow `\r\n\r\n -NotifyOnListen False `\r\n\r\n -AllowLocalFirewallRules False `\r\n\r\n -AllowLocalIPsecRules False `\r\n\r\n -Verbose:$false\r\n\r\n}\r\n\r\nfunction Ensure-PortRule {\r\n\r\n param(\r\n\r\n [Parameter(Mandatory)][string]$Name,\r\n\r\n [Parameter(Mandatory)][ValidateSet(\"Inbound\",\"Outbound\")][string]$Direction,\r\n\r\n [Parameter(Mandatory)][ValidateSet(\"Allow\",\"Block\")][string]$Action,\r\n\r\n [Parameter(Mandatory)][string]$Protocol,\r\n\r\n [Parameter()][string]$LocalPort = \"\",\r\n\r\n [Parameter()][string]$RemotePort = \"\",\r\n\r\n [Parameter()][string]$RemoteAddress = \"Any\"\r\n\r\n )\r\n\r\n $displayName = \"$RulePrefix$Name\"\r\n\r\n $existing = Get-NetFirewallRule -DisplayName $displayName -ErrorAction SilentlyContinue\r\n\r\n $baseParams = @{\r\n\r\n DisplayName = $displayName\r\n\r\n Direction = $Direction\r\n\r\n Action = $Action\r\n\r\n Enabled = 'True'\r\n\r\n Profile = 'Any'\r\n\r\n }\r\n\r\n if ($existing) {\r\n\r\n Write-Host \"Updating rule: $displayName\"\r\n\r\n Set-NetFirewallRule -DisplayName $displayName @baseParams -ErrorAction SilentlyContinue | Out-Null\r\n\r\n # Update port filter\r\n\r\n $filterParams = @{\r\n\r\n Protocol = $Protocol\r\n\r\n }\r\n\r\n if ($LocalPort) { $filterParams.LocalPort = $LocalPort }\r\n\r\n if ($RemotePort) { $filterParams.RemotePort = $RemotePort }\r\n\r\n Get-NetFirewallRule -DisplayName $displayName |\r\n\r\n Set-NetFirewallPortFilter @filterParams -ErrorAction SilentlyContinue | Out-Null\r\n\r\n # Update remote address if applicable\r\n\r\n if ($RemoteAddress -and $RemoteAddress -ne \"Any\") {\r\n\r\n Set-NetFirewallRule -DisplayName $displayName -RemoteAddress $RemoteAddress | Out-Null\r\n\r\n } else {\r\n\r\n Set-NetFirewallRule -DisplayName $displayName -RemoteAddress Any | Out-Null\r\n\r\n }\r\n\r\n }\r\n\r\n else {\r\n\r\n Write-Host \"Creating rule: $displayName\"\r\n\r\n $newParams = $baseParams.Clone()\r\n\r\n $newParams[\"Protocol\"] = $Protocol\r\n\r\n if ($LocalPort) { $newParams[\"LocalPort\"] = $LocalPort }\r\n\r\n if ($RemotePort) { $newParams[\"RemotePort\"] = $RemotePort }\r\n\r\n if ($RemoteAddress) { $newParams[\"RemoteAddress\"] = $RemoteAddress }\r\n\r\n New-NetFirewallRule @newParams | Out-Null\r\n\r\n }\r\n\r\n}\r\n\r\nfunction Ensure-ProgramBlockRule {\r\n\r\n param(\r\n\r\n [Parameter(Mandatory)][string]$Name,\r\n\r\n [Parameter(Mandatory)][string]$ProgramPath\r\n\r\n )\r\n\r\n if (-not (Test-Path $ProgramPath)) {\r\n\r\n Write-Host \"Skipping (file not found): $ProgramPath\"\r\n\r\n return\r\n\r\n }\r\n\r\n $displayName = \"$RulePrefix$Name\"\r\n\r\n $existing = Get-NetFirewallRule -DisplayName $displayName -ErrorAction SilentlyContinue\r\n\r\n if ($existing) {\r\n\r\n Write-Host \"Updating program block rule: $displayName\"\r\n\r\n Set-NetFirewallRule -DisplayName $displayName `\r\n\r\n -Direction Outbound `\r\n\r\n -Action Block `\r\n\r\n -Enabled True `\r\n\r\n -Profile Any `\r\n\r\n -Program $ProgramPath | Out-Null\r\n\r\n }\r\n\r\n else {\r\n\r\n Write-Host \"Creating program block rule: $displayName\"\r\n\r\n New-NetFirewallRule -DisplayName $displayName `\r\n\r\n -Direction Outbound `\r\n\r\n -Action Block `\r\n\r\n -Enabled True `\r\n\r\n -Profile Any `\r\n\r\n -Program $ProgramPath | Out-Null\r\n\r\n }\r\n\r\n}\r\n\r\n# ============================\r\n\r\n# 1. SECURE FIREWALL PROFILES\r\n\r\n# ============================\r\n\r\nSet-FirewallProfileSecure -ProfileName Domain\r\n\r\nSet-FirewallProfileSecure -ProfileName Private\r\n\r\nSet-FirewallProfileSecure -ProfileName Public\r\n\r\n# Enable basic logging (you can adjust paths\/sizes as needed)\r\n\r\nWrite-Host \"Enabling firewall logging...\"\r\n\r\nSet-NetFirewallProfile -Profile Domain,Private,Public `\r\n\r\n -LogFileName '%systemroot%\\system32\\LogFiles\\Firewall\\pfirewall.log' `\r\n\r\n -LogMaxSizeKilobytes 16384 `\r\n\r\n -LogAllowed True `\r\n\r\n -LogBlocked True | Out-Null\r\n\r\n# ============================\r\n\r\n# 2. INBOUND HARDENING RULES\r\n\r\n# ============================\r\n\r\nWrite-Host \"`nConfiguring inbound hardening rules...\"\r\n\r\n# SMB\/CIFS inbound: block\r\n\r\nEnsure-PortRule -Name \"Inbound Block SMB TCP 445\" -Direction Inbound -Action Block -Protocol TCP -LocalPort 445\r\n\r\nEnsure-PortRule -Name \"Inbound Block SMB TCP 139\" -Direction Inbound -Action Block -Protocol TCP -LocalPort 139\r\n\r\nEnsure-PortRule -Name \"Inbound Block NetBIOS UDP 137\" -Direction Inbound -Action Block -Protocol UDP -LocalPort 137\r\n\r\nEnsure-PortRule -Name \"Inbound Block NetBIOS UDP 138\" -Direction Inbound -Action Block -Protocol UDP -LocalPort 138\r\n\r\n# RDP inbound (TCP 3389)\r\n\r\nif ($BlockRDPInbound) {\r\n\r\n Ensure-PortRule -Name \"Inbound Block RDP TCP 3389\" -Direction Inbound -Action Block -Protocol TCP -LocalPort 3389\r\n\r\n}\r\n\r\n# WinRM inbound (5985\/5986)\r\n\r\nEnsure-PortRule -Name \"Inbound Block WinRM TCP 5985\" -Direction Inbound -Action Block -Protocol TCP -LocalPort 5985\r\n\r\nEnsure-PortRule -Name \"Inbound Block WinRM TCP 5986\" -Direction Inbound -Action Block -Protocol TCP -LocalPort 5986\r\n\r\n# WMI\/DCOM RPC endpoint (TCP 135)\r\n\r\nEnsure-PortRule -Name \"Inbound Block RPC Endpoint Mapper TCP 135\" -Direction Inbound -Action Block -Protocol TCP -LocalPort 135\r\n\r\n# Discovery \/ legacy protocols\r\n\r\nEnsure-PortRule -Name \"Inbound Block SSDP UDP 1900\" -Direction Inbound -Action Block -Protocol UDP -LocalPort 1900\r\n\r\nEnsure-PortRule -Name \"Inbound Block mDNS UDP 5353\" -Direction Inbound -Action Block -Protocol UDP -LocalPort 5353\r\n\r\nEnsure-PortRule -Name \"Inbound Block LLMNR UDP 5355\" -Direction Inbound -Action Block -Protocol UDP -LocalPort 5355\r\n\r\nEnsure-PortRule -Name \"Inbound Block WSD UDP 3702\" -Direction Inbound -Action Block -Protocol UDP -LocalPort 3702\r\n\r\nEnsure-PortRule -Name \"Inbound Block TFTP UDP 69\" -Direction Inbound -Action Block -Protocol UDP -LocalPort 69\r\n\r\n# (Optional) ICMP echo blocking could be added here if desired.\r\n\r\n# ============================\r\n\r\n# 3. OUTBOUND SMB RESTRICTIONS\r\n\r\n# ============================\r\n\r\nWrite-Host \"`nConfiguring outbound SMB controls...\"\r\n\r\n# Allow outbound SMB only to approved servers\r\n\r\nif ($AllowedSMBServers.Count -gt 0) {\r\n\r\n foreach ($server in $AllowedSMBServers) {\r\n\r\n Ensure-PortRule -Name \"Outbound Allow SMB to $server\" `\r\n\r\n -Direction Outbound -Action Allow -Protocol TCP -RemotePort 445 -RemoteAddress $server\r\n\r\n }\r\n\r\n}\r\n\r\n# Block all other outbound SMB\r\n\r\nEnsure-PortRule -Name \"Outbound Block SMB TCP 445 All\" `\r\n\r\n -Direction Outbound -Action Block -Protocol TCP -RemotePort 445 -RemoteAddress \"Any\"\r\n\r\n# ============================\r\n\r\n# 4. OUTBOUND DISCOVERY \/ LEGACY PROTOCOL BLOCKS\r\n\r\n# ============================\r\n\r\nWrite-Host \"`nConfiguring outbound discovery protocol blocks...\"\r\n\r\nEnsure-PortRule -Name \"Outbound Block SSDP UDP 1900\" -Direction Outbound -Action Block -Protocol UDP -RemotePort 1900\r\n\r\nEnsure-PortRule -Name \"Outbound Block mDNS UDP 5353\" -Direction Outbound -Action Block -Protocol UDP -RemotePort 5353\r\n\r\nEnsure-PortRule -Name \"Outbound Block LLMNR UDP 5355\" -Direction Outbound -Action Block -Protocol UDP -RemotePort 5355\r\n\r\nEnsure-PortRule -Name \"Outbound Block WSD UDP 3702\" -Direction Outbound -Action Block -Protocol UDP -RemotePort 3702\r\n\r\nEnsure-PortRule -Name \"Outbound Block TFTP UDP 69\" -Direction Outbound -Action Block -Protocol UDP -RemotePort 69\r\n\r\n# ============================\r\n\r\n# 5. OUTBOUND PROGRAM-LEVEL BLOCKS (LOLBINS)\r\n\r\n# ============================\r\n\r\nWrite-Host \"`nConfiguring outbound program-level blocks (LOLBins)...\"\r\n\r\n$system32 = Join-Path $env:WINDIR \"System32\"\r\n\r\n$syswow64 = Join-Path $env:WINDIR \"SysWOW64\"\r\n\r\n$psv1Path = Join-Path $system32 \"WindowsPowerShell\\v1.0\"\r\n\r\n$pswowv1 = Join-Path $syswow64 \"WindowsPowerShell\\v1.0\"\r\n\r\n$ProgramBlockList = @(\r\n\r\n # PowerShell\r\n\r\n @{ Name = \"Block Outbound PowerShell (x64)\"; Path = Join-Path $psv1Path \"powershell.exe\" },\r\n\r\n @{ Name = \"Block Outbound PowerShell ISE (x64)\"; Path = Join-Path $psv1Path \"powershell_ise.exe\" },\r\n\r\n @{ Name = \"Block Outbound PowerShell (x86)\"; Path = Join-Path $pswowv1 \"powershell.exe\" },\r\n\r\n @{ Name = \"Block Outbound PowerShell ISE (x86)\"; Path = Join-Path $pswowv1 \"powershell_ise.exe\" },\r\n\r\n # Windows scripting\r\n\r\n @{ Name = \"Block Outbound wscript\"; Path = Join-Path $system32 \"wscript.exe\" },\r\n\r\n @{ Name = \"Block Outbound cscript\"; Path = Join-Path $system32 \"cscript.exe\" },\r\n\r\n @{ Name = \"Block Outbound mshta\"; Path = Join-Path $system32 \"mshta.exe\" },\r\n\r\n # Downloaders \/ transfer tools\r\n\r\n @{ Name = \"Block Outbound certutil\"; Path = Join-Path $system32 \"certutil.exe\" },\r\n\r\n @{ Name = \"Block Outbound bitsadmin\"; Path = Join-Path $system32 \"bitsadmin.exe\" },\r\n\r\n @{ Name = \"Block Outbound curl\"; Path = Join-Path $system32 \"curl.exe\" },\r\n\r\n @{ Name = \"Block Outbound ftp\"; Path = Join-Path $system32 \"ftp.exe\" },\r\n\r\n @{ Name = \"Block Outbound tftp\"; Path = Join-Path $system32 \"tftp.exe\" },\r\n\r\n # WMI and management\r\n\r\n @{ Name = \"Block Outbound wmic\"; Path = Join-Path $system32 \"wbem\\wmic.exe\" },\r\n\r\n # LOLBins commonly abused for code execution\r\n\r\n @{ Name = \"Block Outbound regsvr32\"; Path = Join-Path $system32 \"regsvr32.exe\" },\r\n\r\n @{ Name = \"Block Outbound rundll32\"; Path = Join-Path $system32 \"rundll32.exe\" },\r\n\r\n # Dev \/ build tools\r\n\r\n @{ Name = \"Block Outbound MSBuild\"; Path = Join-Path $system32 \"MSBuild.exe\" },\r\n\r\n @{ Name = \"Block Outbound msxsl\"; Path = Join-Path $system32 \"msxsl.exe\" },\r\n\r\n # Injection &amp; remote tools\r\n\r\n @{ Name = \"Block Outbound mavinject\"; Path = Join-Path $system32 \"mavinject.exe\" },\r\n\r\n # Remote admin \/ post-ex tools (if present)\r\n\r\n @{ Name = \"Block Outbound PsExec\"; Path = \"C:\\Windows\\System32\\psexec.exe\" },\r\n\r\n @{ Name = \"Block Outbound PAExec\"; Path = \"C:\\Windows\\System32\\paexec.exe\" },\r\n\r\n # Quick Assist (if present)\r\n\r\n @{ Name = \"Block Outbound Quick Assist\"; Path = Join-Path $system32 \"quickassist.exe\" }\r\n\r\n)\r\n\r\nforeach ($item in $ProgramBlockList) {\r\n\r\n Ensure-ProgramBlockRule -Name $item.Name -ProgramPath $item.Path\r\n\r\n}\r\n\r\nWrite-Host \"`nFirewall hardening complete.\" -ForegroundColor Green<\/code><\/pre>","excerpt":"","created_at":"2025-11-26 17:34:05","updated_at":"2026-09-07 06:59:33","category_id":7,"view_count":735,"reading_time":10,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-11-26 14:34:00","featured_image":"2120641a2116dffa518b171cb74b0a1e.png","slug":"windows-11-guvenlik-duvari-lolbin-engelleme-scripti","category_name":"Cyber Security","category_slug":"cyber-security","category_color":"#10b981"},{"id":323,"title":" Windows Art\u0131k Entra ID Grup ve Rol SID'lerini Ger\u00e7ek \u0130simlere \u00c7eviriyor!","content":"<p class=\"ds-markdown-paragraph\">Merhaba! Microsoft'un yeni g&uuml;ncellemesi, g&uuml;venlik loglar\u0131n\u0131 okumay\u0131 &ccedil;ok daha kolay hale getirdi. \ud83c\udf89<\/p>\r\n<h2 class=\"ds-markdown-paragraph\"><strong>Eskiden Ne Gibi Sorunlar Ya\u015f\u0131yorduk?<\/strong><\/h2>\r\n<p class=\"ds-markdown-paragraph\">Geleneksel Windows ortamlar\u0131nda bir g&uuml;venlik olay\u0131n\u0131 incelerken \u015f&ouml;yle SID'lerle kar\u015f\u0131la\u015f\u0131yorduk:<\/p>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\"><img src=\"..\/..\/..\/uploads\/editor\/690633a6592bb_1762014118.png\"><\/span><\/div>\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">Tek g&ouml;rd&uuml;\u011f&uuml;n&uuml;z garip SID'lerdi ve ne anlama geldiklerini bilmek istiyorsan\u0131z, onlar\u0131 okunabilir bir \u015feye d&ouml;n&uuml;\u015ft&uuml;rmek i&ccedil;in&nbsp;<a href=\"https:\/\/oliverkieselbach.com\/2020\/05\/13\/powershell-helpers-to-convert-azure-ad-object-ids-and-sids\/\">Oliver Kieselbach'\u0131n PowerShell yard\u0131mc\u0131lar\u0131<\/a> gibi &uuml;&ccedil;&uuml;nc&uuml; taraf ara&ccedil;lara g&uuml;venmeniz gerekiyordu.<\/span><\/div>\r\n<div class=\"d2a24f03\"><span class=\"d813de27\"><img src=\"..\/..\/..\/uploads\/editor\/690633a659e9e_1762014118.png\"><\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre>S-1-12-1-1234567890-1234567890-1234567890-1234567<\/pre>\r\n<\/div>\r\n<p class=\"ds-markdown-paragraph\">Bu anlams\u0131z harf ve rakam dizileri:<\/p>\r\n<ul>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">\u274c Log analizini zorla\u015ft\u0131r\u0131yor<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">\u274c Sorun gidermeyi yava\u015flat\u0131yor<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">\u274c Yeni ba\u015flayanlar i&ccedil;in korkutucu oluyor<\/p>\r\n<\/li>\r\n<\/ul>\r\n<h2 class=\"ds-markdown-paragraph\"><strong>Yeni &Ouml;zellik Ne Getiriyor?<\/strong><\/h2>\r\n<p class=\"ds-markdown-paragraph\">Windows 11 ve Windows Server 2022'den itibaren:<\/p>\r\n<ul>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">\u2705 Entra ID (eski ad\u0131yla Azure AD) gruplar\u0131 art\u0131k SID yerine ger&ccedil;ek isimleriyle g&ouml;r&uuml;n&uuml;yor<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">\u2705 Bulut tabanl\u0131 g&uuml;venlik gruplar\u0131 okunabilir \u015fekilde loglara yaz\u0131l\u0131yor<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">\u2705 Hibrit ortamlarda sorunsuz &ccedil;al\u0131\u015f\u0131yor<\/p>\r\n<\/li>\r\n<\/ul>\r\n<h2 class=\"ds-markdown-paragraph\"><strong>Pratik &Ouml;rnekler<\/strong><\/h2>\r\n<p class=\"ds-markdown-paragraph\"><strong>ESK\u0130 DURUM:<\/strong><\/p>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\">&nbsp;<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre>Kullan\u0131c\u0131: S-1-12-1-1234567890-1234567890-1234567890-1234567\r\nEri\u015fim reddedildi<\/pre>\r\n<\/div>\r\n<p class=\"ds-markdown-paragraph\"><strong>YEN\u0130 DURUM:<\/strong><\/p>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<pre>Kullan\u0131c\u0131: \"Finans_Departmani_Okuma_Grubu\"\r\nEri\u015fim reddedildi<\/pre>\r\n<\/div>\r\n<h2 class=\"ds-markdown-paragraph\"><strong>Kurumsal Faydalar<\/strong><\/h2>\r\n<p class=\"ds-markdown-paragraph\"><strong>Sistem Y&ouml;neticileri \u0130&ccedil;in:<\/strong><\/p>\r\n<ul>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Log analizi 2-3 kat daha h\u0131zl\u0131<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Sorun giderme s&uuml;releri k\u0131sald\u0131<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">G&uuml;venlik olaylar\u0131 daha anla\u015f\u0131l\u0131r<\/p>\r\n<\/li>\r\n<\/ul>\r\n<p class=\"ds-markdown-paragraph\"><strong>G&uuml;venlik Ekipleri \u0130&ccedil;in:<\/strong><\/p>\r\n<ul>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">SIEM sistemlerinde daha temiz veri<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Anomali tespiti kolayla\u015ft\u0131<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Uyumluluk raporlamas\u0131 basitle\u015fti<\/p>\r\n<\/li>\r\n<\/ul>\r\n<p class=\"ds-markdown-paragraph\"><strong>IT Y&ouml;neticileri \u0130&ccedil;in:<\/strong><\/p>\r\n<ul>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Ekip e\u011fitimi kolayla\u015ft\u0131<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Operasyonel verimlilik artt\u0131<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Hata oranlar\u0131 azald\u0131<\/p>\r\n<\/li>\r\n<\/ul>\r\n<h2 class=\"ds-markdown-paragraph\"><strong>Teknik Detaylar<\/strong><\/h2>\r\n<p class=\"ds-markdown-paragraph\">&Ouml;zellik \u015fu bile\u015fenlerde aktif:<\/p>\r\n<ul>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Windows G&uuml;venlik Loglar\u0131<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Olay G&ouml;r&uuml;nt&uuml;leyici (Event Viewer)<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">PowerShell Get-WinEvent komutu<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Third-party SIEM &ccedil;&ouml;z&uuml;mleri<\/p>\r\n<\/li>\r\n<\/ul>\r\n<p class=\"ds-markdown-paragraph\"><strong>\ud83d\ude80 En \u0130yi Uygulamalar<\/strong><\/p>\r\n<ol start=\"1\">\r\n<li>\r\n<p class=\"ds-markdown-paragraph\"><strong>G&uuml;ncelleme Stratejinizi G&ouml;zden Ge&ccedil;irin<\/strong><\/p>\r\n<ul>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Windows 11\/Windows Server 2022'ye ge&ccedil;i\u015f planlar\u0131n\u0131z\u0131 h\u0131zland\u0131r\u0131n<\/p>\r\n<\/li>\r\n<\/ul>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\"><strong>Log Y&ouml;netimi Politikalar\u0131n\u0131z\u0131 G&uuml;ncelleyin<\/strong><\/p>\r\n<ul>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Yeni log format\u0131na g&ouml;re parsing kurallar\u0131n\u0131z\u0131 g&uuml;ncelleyin<\/p>\r\n<\/li>\r\n<\/ul>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\"><strong>Ekip E\u011fitimlerinizi Zenginle\u015ftirin<\/strong><\/p>\r\n<ul>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Yeni &ouml;zelli\u011fin faydalar\u0131n\u0131 ekibinizle payla\u015f\u0131n<\/p>\r\n<\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ol>\r\n<p class=\"ds-markdown-paragraph\"><strong>\ud83d\udcc8 Ger&ccedil;ek Hayat Senaryosu<\/strong><\/p>\r\n<p class=\"ds-markdown-paragraph\">Bir finans kurumunda ya\u015fanan &ouml;rnek:<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>&Ouml;NCES\u0130:<\/strong><br>\"G&uuml;venlik ekibi 2 saat boyunca SID'leri &ccedil;&ouml;z&uuml;mlemeye &ccedil;al\u0131\u015ft\u0131, hangi grubun eri\u015fim hatas\u0131 yapt\u0131\u011f\u0131n\u0131 anlayamad\u0131.\"<\/p>\r\n<p class=\"ds-markdown-paragraph\"><strong>SONRASI:<\/strong><br>\"Logda 'Muhasebe_Raporlari_SadeceOkuma' grubu hemen g&ouml;r&uuml;ld&uuml;, 5 dakikada sorun &ccedil;&ouml;z&uuml;ld&uuml;.\"<\/p>\r\n<h2 class=\"ds-markdown-paragraph\"><strong>Unutmay\u0131n<\/strong><\/h2>\r\n<p class=\"ds-markdown-paragraph\">Bu &ouml;zellik, Microsoft'un \"cloud-first\" stratejisinin &ouml;nemli bir par&ccedil;as\u0131. Hibrit ortamlarda &ccedil;al\u0131\u015f\u0131rken:<\/p>\r\n<ul>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">\u015eirket i&ccedil;i Active Directory gruplar\u0131 i&ccedil;in eski davran\u0131\u015f devam edebilir<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Entra ID gruplar\u0131 i&ccedil;in yeni &ouml;zellik otomatik aktif olur<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Ge&ccedil;i\u015f s&uuml;recinde her iki format\u0131 da g&ouml;rmeye haz\u0131rl\u0131kl\u0131 olun<\/p>\r\n<\/li>\r\n<\/ul>\r\n<h2 class=\"ds-markdown-paragraph\"><strong>Sonu&ccedil;<\/strong><\/h2>\r\n<p class=\"ds-markdown-paragraph\">Microsoft'un bu k&uuml;&ccedil;&uuml;k ama etkili g&uuml;ncellemesi, g&uuml;nl&uuml;k IT operasyonlar\u0131m\u0131z\u0131 &ouml;nemli &ouml;l&ccedil;&uuml;de kolayla\u015ft\u0131r\u0131yor. Art\u0131k log dosyalar\u0131nda kaybolmak yerine, ger&ccedil;ek sorunlara odaklanabilece\u011fiz!<\/p>\r\n<p class=\"ds-markdown-paragraph\">Bu geli\u015fme bize g&ouml;steriyor ki; Microsoft kullan\u0131c\u0131 deneyimini iyile\u015ftirmeye ve IT profesyonellerinin hayat\u0131n\u0131 kolayla\u015ft\u0131rmaya devam ediyor.<\/p>\r\n<p class=\"ds-markdown-paragraph\">#Windows11 #EntraID #AzureAD #SiberG&uuml;venlik #LogY&ouml;netimi #Microsoft #ITProfesyonelleri<\/p>","excerpt":"Microsoft'un bu k\u00fc\u00e7\u00fck ama etkili g\u00fcncellemesi, g\u00fcnl\u00fck IT operasyonlar\u0131m\u0131z\u0131 \u00f6nemli \u00f6l\u00e7\u00fcde kolayla\u015ft\u0131r\u0131yor. Art\u0131k log dosyalar\u0131nda kaybolmak yerine, ger\u00e7ek sorunlara odaklanabilece\u011fiz!","created_at":"2025-10-17 12:05:06","updated_at":"2026-09-07 05:51:19","category_id":6,"view_count":666,"reading_time":3,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-10-17 12:05:00","featured_image":"api_picsum_1762014166_690633d6d9aa9.jpg","slug":"windows-artik-entra-id-grup-ve-rol-sidlerini-gercek-isimlere-ceviriyor","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"}]