[{"id":362,"title":"Ransomware \u0130ncelemelerinde Dosya Eri\u015fim Analizi Nas\u0131l Yap\u0131l\u0131r?","content":"<p>Ransomware sald\u0131r\u0131lar\u0131 g&uuml;n&uuml;m&uuml;zde kurumlar\u0131n kar\u015f\u0131la\u015ft\u0131\u011f\u0131 en kritik tehditlerin ba\u015f\u0131nda geliyor. Modern fidye yaz\u0131l\u0131mlar\u0131 yaln\u0131zca verileri \u015fifrelemekle kalm\u0131yor; ayn\u0131 zamanda dosya sisteminde ola\u011fan d\u0131\u015f\u0131 bir aktivite b\u0131rakarak izlerini de saklamaya &ccedil;al\u0131\u015f\u0131yor. Bu nedenle bir ransomware vakas\u0131nda&nbsp;<strong>dosya eri\u015fim analizi (File Access Analysis)<\/strong>, sald\u0131r\u0131n\u0131n yay\u0131l\u0131m\u0131n\u0131 anlamak ve etki alan\u0131n\u0131 belirlemek i&ccedil;in en &ouml;nemli ad\u0131mlardan biridir.<\/p>\n<p>Bu yaz\u0131da, ransomware incelemelerinde dosya eri\u015fim analizinin nas\u0131l yap\u0131ld\u0131\u011f\u0131n\u0131, hangi ara&ccedil;lar\u0131n kullan\u0131ld\u0131\u011f\u0131n\u0131 ve ad\u0131m ad\u0131m uygulanabilir bir yakla\u015f\u0131m\u0131 ele alaca\u011f\u0131z.<\/p>\n<hr>\n<h2><iframe style=\"width: 704px; height: 395px;\" src=\"https:\/\/www.youtube.com\/embed\/m_NfVxUCm4E?si=M8daD8Ow4IvfppNs\" width=\"811\" height=\"455\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/h2>\n<h2>Dosya Eri\u015fim Analizi Nedir?<\/h2>\n<p>Dosya eri\u015fim analizi; bir sistemde ransomware taraf\u0131ndan eri\u015filen, de\u011fi\u015ftirilen, olu\u015fturulan veya silinen dosyalar\u0131n tespit edilmesini sa\u011flayan inceleme s&uuml;recidir. Bu analiz sayesinde:<\/p>\n<ul>\n<li>\n<p>Hangi dosyalar\u0131n \u015fifrelendi\u011fi,<\/p>\n<\/li>\n<li>\n<p>Hangi klas&ouml;rlerin hedef al\u0131nd\u0131\u011f\u0131,<\/p>\n<\/li>\n<li>\n<p>Sald\u0131r\u0131n\u0131n ne zaman ba\u015flad\u0131\u011f\u0131,<\/p>\n<\/li>\n<li>\n<p>Hangi kullan\u0131c\u0131 veya i\u015flem taraf\u0131ndan tetiklendi\u011fi,<\/p>\n<\/li>\n<li>\n<p>Yan etkilerin (data exfiltration, dosya &ccedil;al\u0131nmas\u0131 vb.) olup olmad\u0131\u011f\u0131<\/p>\n<\/li>\n<\/ul>\n<p>gibi kritik bilgiler elde edilir.<\/p>\n<hr>\n<h1>1. Ad\u0131m: Log Kaynaklar\u0131n\u0131n Belirlenmesi<\/h1>\n<p>Ransomware incelemelerinde en &ouml;nemli nokta, do\u011fru log kaynaklar\u0131n\u0131 toplamakt\u0131r. Dosya eri\u015fim analizi i&ccedil;in genellikle \u015fu kaynaklar incelenir:<\/p>\n<h3>\u2714 Windows Event Logs<\/h3>\n<ul>\n<li>\n<p><strong>Security Logs (Event ID 4663, 4656)<\/strong><br>Dosya eri\u015fimi, izinsiz de\u011fi\u015fiklikler, handle a&ccedil;ma gibi aktiviteler burada g&ouml;r&uuml;l&uuml;r.<\/p>\n<\/li>\n<li>\n<p><strong>Sysmon Logs (Event ID 1, 11, 13)<\/strong><\/p>\n<ul>\n<li>\n<p>Process creation<\/p>\n<\/li>\n<li>\n<p>File creation time change<\/p>\n<\/li>\n<li>\n<p>Registry modification<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Sysmon etkinse analiz &ccedil;ok daha kolay olur.<\/p>\n<h3>\u2714 NTFS MFT (Master File Table)<\/h3>\n<ul>\n<li>\n<p>Dosya olu\u015fturma, yeniden adland\u0131rma, silme gibi t&uuml;m olaylar\u0131n d&uuml;\u015f&uuml;k seviyede kaydedildi\u011fi yerdir.<\/p>\n<\/li>\n<li>\n<p>Ransomware'ler MFT &uuml;zerinde iz b\u0131rak\u0131r.<\/p>\n<\/li>\n<\/ul>\n<h3>\u2714 USN Journal<\/h3>\n<ul>\n<li>\n<p>Dosya de\u011fi\u015fikliklerinin neredeyse ger&ccedil;ek zamanl\u0131 kayd\u0131<\/p>\n<\/li>\n<li>\n<p>\u015eifreleme i\u015flemleri milyonlarca sat\u0131r log &uuml;retir<\/p>\n<\/li>\n<\/ul>\n<h3>\u2714 Antivirus \/ EDR Loglar\u0131<\/h3>\n<ul>\n<li>\n<p>Impacted files<\/p>\n<\/li>\n<li>\n<p>Blocked actions<\/p>\n<\/li>\n<li>\n<p>Quarantine kay\u0131tlar\u0131<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1>2. Ad\u0131m: Sald\u0131r\u0131n\u0131n Zaman Aral\u0131\u011f\u0131n\u0131 Belirleme<\/h1>\n<p>Dosya eri\u015fim analizine ba\u015flamadan &ouml;nce sald\u0131r\u0131n\u0131n zaman &ccedil;izelgesi &ccedil;\u0131kar\u0131l\u0131r:<\/p>\n<ul>\n<li>\n<p>\u0130lk \u015fifrelenen dosya zaman\u0131<\/p>\n<\/li>\n<li>\n<p>Ransom note olu\u015fturulma zaman\u0131<\/p>\n<\/li>\n<li>\n<p>\u015e&uuml;pheli s&uuml;re&ccedil; ba\u015flang\u0131c\u0131 (Sysmon Event ID 1)<\/p>\n<\/li>\n<li>\n<p>Volume Shadow Copy silme komutlar\u0131 (wmic, vssadmin)<\/p>\n<\/li>\n<\/ul>\n<p>Bu zaman aral\u0131\u011f\u0131 daralt\u0131l\u0131r ve t&uuml;m analiz bu timeframe &uuml;zerinde yap\u0131l\u0131r.<\/p>\n<hr>\n<h1>3. Ad\u0131m: Dosya Eri\u015fim &Ouml;r&uuml;nt&uuml;lerinin Tespiti<\/h1>\n<p>Ransomware karakteristik dosya eri\u015fim davran\u0131\u015flar\u0131 sergiler:<\/p>\n<h3>\ud83d\udccc Anormal Dosya Olu\u015fturma<\/h3>\n<ul>\n<li>\n<p>ayn\u0131 anda y&uuml;zlerce dosyan\u0131n yeniden adland\u0131r\u0131lmas\u0131 (file.ext &rarr; file.ext.locked)<\/p>\n<\/li>\n<li>\n<p>.README.txt, <em>R3ADME<\/em>.html gibi not dosyalar\u0131<\/p>\n<\/li>\n<\/ul>\n<h3>\ud83d\udccc Uzant\u0131 De\u011fi\u015fiklikleri<\/h3>\n<ul>\n<li>\n<p>AES \u015fifreleme sonras\u0131 yeni bir uzant\u0131 eklenmesi (.dark, .encrypted vb.)<\/p>\n<\/li>\n<\/ul>\n<h3>\ud83d\udccc Y&uuml;ksek I\/O Aktivitesi<\/h3>\n<ul>\n<li>\n<p>K\u0131sa s&uuml;rede binlerce dosya olu\u015fturma\/silme<\/p>\n<\/li>\n<li>\n<p>Sysinternals Process Monitor ile kolayca tespit edilir<\/p>\n<\/li>\n<\/ul>\n<h3>\ud83d\udccc Dosya Metadata Manip&uuml;lasyonu<\/h3>\n<ul>\n<li>\n<p>CreationTime \/ ModifiedTime de\u011fi\u015ftirmeleri<\/p>\n<\/li>\n<li>\n<p>Sysmon Event ID 2 \/ 11 ile tespit edilebilir<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1>4. Ad\u0131m: USN Journal Analizi<\/h1>\n<p>Ransomware davran\u0131\u015f\u0131n\u0131 en net g&ouml;steren alanlardan biri <strong>USN Journal<\/strong>&rsquo;d\u0131r. &Ccedil;&uuml;nk&uuml; \u015fifreleme s\u0131ras\u0131nda y&uuml;zlerce:<\/p>\n<ul>\n<li>\n<p><code>USN_REASON_DATA_TRUNCATION<\/code><\/p>\n<\/li>\n<li>\n<p><code>USN_REASON_FILE_CREATE<\/code><\/p>\n<\/li>\n<li>\n<p><code>USN_REASON_RENAME_OLD_NAME<\/code><\/p>\n<\/li>\n<li>\n<p><code>USN_REASON_RENAME_NEW_NAME<\/code><\/p>\n<\/li>\n<\/ul>\n<p>olay\u0131 g&ouml;r&uuml;n&uuml;r.<\/p>\n<h3>Kullan\u0131lan Ara&ccedil;lar:<\/h3>\n<ul>\n<li>\n<p><strong>AnalyzeMFT<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>MFTECmd (Eric Zimmerman)<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>UsnJrnl2Csv<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Velociraptor Forensics<\/strong><\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1>5. Ad\u0131m: MFT Analizi<\/h1>\n<p>MFT analizi ile:<\/p>\n<ul>\n<li>\n<p>\u015eifrelenen dosyalar\u0131n tam listesi<\/p>\n<\/li>\n<li>\n<p>Ransomware&rsquo;in olu\u015fturdu\u011fu ge&ccedil;ici dosyalar<\/p>\n<\/li>\n<li>\n<p>Silinmi\u015f fakat h&acirc;l&acirc; referans\u0131 bulunan dosyalar<\/p>\n<\/li>\n<li>\n<p>Yo\u011fun eri\u015fim yap\u0131lan dizinler<\/p>\n<\/li>\n<\/ul>\n<p>gibi bilgiler &ccedil;\u0131kar\u0131labilir.<\/p>\n<h3>Komut:<\/h3>\n<pre><code>MFTECmd.exe -f $MFT --csv .\\output\\\n<\/code><\/pre>\n<hr>\n<h1>6. Ad\u0131m: S&uuml;re&ccedil; (Process) Tespiti<\/h1>\n<p>Dosya eri\u015fimlerinin arkas\u0131nda hangi i\u015flem var?<\/p>\n<p>Bunu bulmak i&ccedil;in a\u015fa\u011f\u0131daki kaynaklar incelenir:<\/p>\n<h3>\u2714 Sysmon - Event ID 1 (Process Create)<\/h3>\n<ul>\n<li>\n<p>\u015e&uuml;pheli EXE dosyalar\u0131<\/p>\n<\/li>\n<li>\n<p>Temp, AppData, Roaming alt\u0131ndan &ccedil;al\u0131\u015fan uygulamalar<\/p>\n<\/li>\n<li>\n<p>Powershell, cmd, wscript &ccedil;a\u011fr\u0131lar\u0131<\/p>\n<\/li>\n<\/ul>\n<h3>\u2714 Handle Analizi (Ransomware o an &ccedil;al\u0131\u015f\u0131yorsa)<\/h3>\n<ul>\n<li>\n<p>Sysinternals <strong>handle.exe<\/strong><\/p>\n<\/li>\n<li>\n<p>Hangi proses hangi dosyalar\u0131 kilitliyor?<\/p>\n<\/li>\n<\/ul>\n<h3>\u2714 Parent-Child Chain<\/h3>\n<p>&Ouml;rnek k&ouml;t&uuml; zincir:<\/p>\n<pre><code>outlook.exe &rarr; winword.exe &rarr; powershell.exe &rarr; payload.exe\n<\/code><\/pre>\n<hr>\n<h1>7. Ad\u0131m: Etkilenen Dosyalar\u0131n Haritalanmas\u0131<\/h1>\n<p>Toplanan t&uuml;m log kaynaklar\u0131 birle\u015ftirilerek:<\/p>\n<ul>\n<li>\n<p>Etkilenen dizinler<\/p>\n<\/li>\n<li>\n<p>\u015eifrelenen dosya say\u0131s\u0131<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131c\u0131 bazl\u0131 eri\u015fim<\/p>\n<\/li>\n<li>\n<p>Dosya boyutu de\u011fi\u015fimi<\/p>\n<\/li>\n<li>\n<p>En son eri\u015fim zamanlar\u0131<\/p>\n<\/li>\n<\/ul>\n<p>gibi bilgiler bir rapor haline getirilir.<\/p>\n<h3>&Ouml;rnek CSV &Ccedil;\u0131kt\u0131s\u0131:<\/h3>\n<table>\n<thead>\n<tr>\n<th>Dosya<\/th>\n<th>Eski Ad<\/th>\n<th>Yeni Ad<\/th>\n<th>Son Eri\u015fim<\/th>\n<th>\u0130\u015flem<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>C:\\data\\report.xlsx<\/td>\n<td>report.xlsx<\/td>\n<td>report.xlsx.locked<\/td>\n<td>12:41<\/td>\n<td>Rename + Write<\/td>\n<\/tr>\n<tr>\n<td>C:\\data\\finances.db<\/td>\n<td>finances.db<\/td>\n<td>finances.db.enc<\/td>\n<td>12:42<\/td>\n<td>Overwrite<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h1>8. Ad\u0131m: Data Exfiltration Kontrol&uuml; (Varsa)<\/h1>\n<p>Baz\u0131 modern ransomware gruplar\u0131 &ouml;nce <strong>verileri &ccedil;alar<\/strong>, sonra \u015fifreleme yapar.<\/p>\n<p>\u015eu kaynaklara bak\u0131l\u0131r:<\/p>\n<ul>\n<li>\n<p>Powershell Invoke-WebRequest kay\u0131tlar\u0131<\/p>\n<\/li>\n<li>\n<p>Browser download\/upload ge&ccedil;mi\u015fi<\/p>\n<\/li>\n<li>\n<p>Cloud depolama istemcileri (Mega, Dropbox CLI)<\/p>\n<\/li>\n<li>\n<p>SMB transfer loglar\u0131<\/p>\n<\/li>\n<li>\n<p>WinRar \/ 7zip ile b&uuml;y&uuml;k ar\u015fiv olu\u015fturma loglar\u0131<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1>9. Ad\u0131m: Otomatikle\u015ftirilmi\u015f Ara&ccedil;lar<\/h1>\n<h3>\ud83d\udd27 Eric Zimmerman Tools<\/h3>\n<ul>\n<li>\n<p>MFTECmd<\/p>\n<\/li>\n<li>\n<p>SrumECmd<\/p>\n<\/li>\n<li>\n<p>EvtxECmd<\/p>\n<\/li>\n<li>\n<p>UsnJrnl2Csv<\/p>\n<\/li>\n<\/ul>\n<h3>\ud83d\udd27 Velociraptor<\/h3>\n<ul>\n<li>\n<p>Ransomware IOC templatelar\u0131<\/p>\n<\/li>\n<li>\n<p>USN\/MFT Collector<\/p>\n<\/li>\n<\/ul>\n<h3>\ud83d\udd27 KAPE<\/h3>\n<p>H\u0131zl\u0131 triage i&ccedil;in ideal.<\/p>\n<hr>\n<p>Ransomware incelemelerinde dosya eri\u015fim analizi, sald\u0131r\u0131n\u0131n etkisini ortaya &ccedil;\u0131karmak i&ccedil;in kritik &ouml;neme sahiptir. Log kaynaklar\u0131n\u0131n toplanmas\u0131, MFT\/USN journal analizi, process takibi ve zaman &ccedil;izelgesi olu\u015fturulmas\u0131 sayesinde:<\/p>\n<ul>\n<li>\n<p>Etkilenen dosyalar<\/p>\n<\/li>\n<li>\n<p>Sald\u0131r\u0131 zinciri<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131lan ara&ccedil;lar<\/p>\n<\/li>\n<li>\n<p>Sald\u0131r\u0131n\u0131n ba\u015flang\u0131&ccedil; zaman\u0131<\/p>\n<\/li>\n<\/ul>\n<p>net bi&ccedil;imde tespit edilir.<\/p>\n<p>Bu analizler yaln\u0131zca olay m&uuml;dahale ekipleri i&ccedil;in de\u011fil, ayn\u0131 zamanda gelecekte benzer sald\u0131r\u0131lar\u0131 &ouml;nlemek isteyen kurumlar i&ccedil;in de b&uuml;y&uuml;k de\u011ferlidir.<\/p>\n<p>&nbsp;<\/p>\n<h1><strong>WHITEPAPER<\/strong><\/h1>\n<h2><strong>Ransomware \u0130ncelemelerinde Dosya Eri\u015fim Analizi<\/strong><\/h2>\n<h3><em>Tehdit Av\u0131, Adli Bili\u015fim ve Olay M&uuml;dahale Perspektifi<\/em><\/h3>\n<hr>\n<h3>&nbsp;<\/h3>\n<p>Ransomware, modern siber sald\u0131r\u0131 ekosisteminin en y\u0131k\u0131c\u0131 tehditlerinden biri h&acirc;line gelmi\u015ftir. Klasik \u015fifreleme odakl\u0131 varianlar yerini, &ccedil;ok a\u015famal\u0131 (multi-stage), veri s\u0131z\u0131nt\u0131l\u0131 (double\/triple extortion) fidye yaz\u0131l\u0131mlar\u0131na b\u0131rakm\u0131\u015ft\u0131r. Bu sald\u0131r\u0131lar yaln\u0131zca veri \u015fifrelemekle kalmaz; sistem &uuml;zerinde geni\u015f dosya eri\u015fim aktivitelerine ve belirgin bir artefakt yo\u011funlu\u011funa neden olur.<\/p>\n<p>Bu whitepaper, ransomware olay m&uuml;dahalesi s\u0131ras\u0131nda <strong>dosya eri\u015fim analizi (File Access Analysis)<\/strong> s&uuml;re&ccedil;lerinin teknik derinli\u011fini aktarmak amac\u0131yla haz\u0131rlanm\u0131\u015ft\u0131r. Analiz; NTFS meta verileri, Windows Event Logs, Sysmon kay\u0131tlar\u0131, USN Journal, MFT, SRUM ve EDR telemetry verileri &uuml;zerinden b&uuml;t&uuml;nle\u015fik bir y&ouml;ntem sunar.<\/p>\n<hr>\n<h1><strong>2. Dosya Eri\u015fim Analizinin Amac\u0131<\/strong><\/h1>\n<p>Dosya eri\u015fim analizi, ransomware sald\u0131r\u0131s\u0131n\u0131n:<\/p>\n<ul>\n<li>\n<p>Ba\u015flang\u0131&ccedil; noktas\u0131n\u0131<\/p>\n<\/li>\n<li>\n<p>Yay\u0131l\u0131m vekt&ouml;r&uuml;n&uuml;<\/p>\n<\/li>\n<li>\n<p>Hangi dosyalar\u0131n manip&uuml;le edildi\u011fini<\/p>\n<\/li>\n<li>\n<p>Hangi kullan\u0131c\u0131\/i\u015flem taraf\u0131ndan tetiklendi\u011fini<\/p>\n<\/li>\n<li>\n<p>Ne kadar veri \u015fifrelendi\u011fini<\/p>\n<\/li>\n<li>\n<p>Veri s\u0131z\u0131nt\u0131s\u0131 olup olmad\u0131\u011f\u0131n\u0131<\/p>\n<\/li>\n<li>\n<p>\u015eifreleme davran\u0131\u015f\u0131n\u0131n metodolojisini<\/p>\n<\/li>\n<\/ul>\n<p>tespit etmek i&ccedil;in uygulan\u0131r.<\/p>\n<p>Bu sayede hem sald\u0131r\u0131n\u0131n boyutu belirlenir hem de hukuki s&uuml;re&ccedil;lerde (SIGORTA, KVKK, GDPR) gerekli olan teknik kan\u0131tlar toplan\u0131r.<\/p>\n<hr>\n<h1><strong>3. Ransomware Dosya Manip&uuml;lasyon Davran\u0131\u015flar\u0131<\/strong><\/h1>\n<p>Ransomware'in dosya sisteminde b\u0131rakt\u0131\u011f\u0131 kal\u0131nt\u0131lar belirli bir paterne sahiptir.<\/p>\n<h3><strong>3.1. Y&uuml;ksek hacimli I\/O operasyonlar\u0131<\/strong><\/h3>\n<ul>\n<li>\n<p>K\u0131sa s&uuml;rede binlerce dosyaya eri\u015fim<\/p>\n<\/li>\n<li>\n<p>&Ccedil;ok say\u0131da <code>CreateFile<\/code>, <code>WriteFile<\/code>, <code>RenameFile<\/code>, <code>SetInformationFile<\/code><\/p>\n<\/li>\n<\/ul>\n<h3><strong>3.2. Uzant\u0131 de\u011fi\u015fikli\u011fi<\/strong><\/h3>\n<ul>\n<li>\n<p><code>*.docx<\/code> &rarr; <code>*.docx.locked<\/code><\/p>\n<\/li>\n<li>\n<p><code>*.pdf<\/code> &rarr; <code>*.encrypted<\/code><\/p>\n<\/li>\n<\/ul>\n<h3><strong>3.3. Metadata manip&uuml;lasyonu<\/strong><\/h3>\n<ul>\n<li>\n<p>CreationTime resetlenmesi<\/p>\n<\/li>\n<li>\n<p>LastWriteTime&rsquo;\u0131n ayn\u0131 saniyede ard\u0131\u015f\u0131k y&uuml;zlerce dosyada g&ouml;r&uuml;nmesi<\/p>\n<\/li>\n<\/ul>\n<h3><strong>3.4. Ransom note olu\u015fturma<\/strong><\/h3>\n<ul>\n<li>\n<p>Ayn\u0131 dizinlere y&uuml;zlerce <code>.txt<\/code> veya <code>.html<\/code> dosyas\u0131 d&uuml;\u015f&uuml;rme<\/p>\n<\/li>\n<li>\n<p>&Ccedil;oklu dizin traversesi<\/p>\n<\/li>\n<\/ul>\n<h3><strong>3.5. Shadow Copy silme<\/strong><\/h3>\n<pre><code>vssadmin delete shadows \/all \/quiet\nwmic shadowcopy delete\n<\/code><\/pre>\n<hr>\n<h1><strong>4. Analiz \u0130&ccedil;in Kullan\u0131lan Temel Kaynaklar<\/strong><\/h1>\n<p>Dosya eri\u015fim analizinin ba\u015far\u0131s\u0131, do\u011fru artefaktlar\u0131n toplanmas\u0131na ba\u011fl\u0131d\u0131r.<\/p>\n<h2><strong>4.1. Windows Event Logs<\/strong><\/h2>\n<h3><strong>Security.evtx<\/strong><\/h3>\n<ul>\n<li>\n<p><strong>4663<\/strong> &rarr; Dosya eri\u015fim denetimi<\/p>\n<\/li>\n<li>\n<p><strong>4656<\/strong> &rarr; Handle a&ccedil;ma giri\u015fimi<\/p>\n<\/li>\n<li>\n<p><strong>4670<\/strong> &rarr; ACL de\u011fi\u015fikli\u011fi<\/p>\n<\/li>\n<li>\n<p><strong>5145<\/strong> &rarr; SMB &uuml;zerinden dosya eri\u015fimi<\/p>\n<\/li>\n<\/ul>\n<h3><strong>Sysmon.evtx<\/strong><\/h3>\n<ul>\n<li>\n<p><strong>1<\/strong> &rarr; Process Create<\/p>\n<\/li>\n<li>\n<p><strong>11<\/strong> &rarr; File Create<\/p>\n<\/li>\n<li>\n<p><strong>13<\/strong> &rarr; Registry Set<\/p>\n<\/li>\n<li>\n<p><strong>2, 17, 18<\/strong> &rarr; Dosya time-stamp manip&uuml;lasyonu<\/p>\n<\/li>\n<li>\n<p><strong>7<\/strong> &rarr; Image Load (crypto library y&uuml;klemeleri)<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2><strong>4.2. NTFS Artefaktlar\u0131<\/strong><\/h2>\n<h3><strong>4.2.1. MFT ($MFT)<\/strong><\/h3>\n<p>Ransomware faaliyetinin en g&uuml;venilir kan\u0131t\u0131d\u0131r.<\/p>\n<p>Tespit edilebilir:<\/p>\n<ul>\n<li>\n<p>\u015eifrelenen t&uuml;m dosyalar<\/p>\n<\/li>\n<li>\n<p>Silinen ancak iz b\u0131rakan dosya kay\u0131tlar\u0131<\/p>\n<\/li>\n<li>\n<p>Yo\u011fun rename operasyonlar\u0131<\/p>\n<\/li>\n<li>\n<p>Ransom note da\u011f\u0131l\u0131m\u0131<\/p>\n<\/li>\n<\/ul>\n<h3><strong>4.2.2. USN Journal ($UsnJrnl:$J)<\/strong><\/h3>\n<p>Ransomware \u015fifreleme s\u0131ras\u0131nda tipik olarak milyonlarca sat\u0131r aktivite &uuml;retir.<\/p>\n<p>&Ouml;ne &ccedil;\u0131kan USN reason kodlar\u0131:<\/p>\n<ul>\n<li>\n<p><code>0x00000020<\/code> &ndash; File Create<\/p>\n<\/li>\n<li>\n<p><code>0x00000002<\/code> &ndash; Data Overwrite<\/p>\n<\/li>\n<li>\n<p><code>0x00001000<\/code> &ndash; Rename Old Name<\/p>\n<\/li>\n<li>\n<p><code>0x00002000<\/code> &ndash; Rename New Name<\/p>\n<\/li>\n<\/ul>\n<h3><strong>4.2.3. $LogFile<\/strong><\/h3>\n<ul>\n<li>\n<p>Transaction-based kay\u0131t<\/p>\n<\/li>\n<li>\n<p>Ani dosya de\u011fi\u015fiklik paternleri (I\/O spike)<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2><strong>4.3. SRUM (System Resource Usage Monitor)<\/strong><\/h2>\n<ul>\n<li>\n<p>S&uuml;recin ne kadar I\/O t&uuml;ketti\u011fini<\/p>\n<\/li>\n<li>\n<p>Hangi saatlerde yo\u011fun i\u015flem ger&ccedil;ekle\u015ftirdi\u011fini<\/p>\n<\/li>\n<\/ul>\n<p>g&ouml;sterir.<\/p>\n<hr>\n<h2><strong>4.4. EDR Telemetry<\/strong><\/h2>\n<p>Kurumsal yap\u0131larda en kritik kaynak:<\/p>\n<ul>\n<li>\n<p>File write events<\/p>\n<\/li>\n<li>\n<p>File rename events<\/p>\n<\/li>\n<li>\n<p>Process ancestry<\/p>\n<\/li>\n<li>\n<p>Injection teknikleri<\/p>\n<\/li>\n<li>\n<p>Network exfiltration<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1><strong>5. Dosya Eri\u015fim Analiz Metodolojisi<\/strong><\/h1>\n<p>Bu b&ouml;l&uuml;m DFIR ekiplerinin kulland\u0131\u011f\u0131 tam metodolojik yakla\u015f\u0131m\u0131 i&ccedil;erir.<\/p>\n<hr>\n<h2><strong>5.1. Zaman &Ccedil;izelgesi (Timeline) Olu\u015fturma<\/strong><\/h2>\n<p>En kritik ad\u0131m <strong>attack window<\/strong>'u belirlemektir.<\/p>\n<p>Zaman aral\u0131\u011f\u0131 \u015fu artefaktlarla belirlenir:<\/p>\n<ul>\n<li>\n<p>\u0130lk \u015fifrelenen dosyan\u0131n <code>MFT LastWriteTime<\/code> bilgisi<\/p>\n<\/li>\n<li>\n<p>\u0130lk ransom note olu\u015fturulma zaman\u0131<\/p>\n<\/li>\n<li>\n<p>Sysmon Process Create (event ID 1) &ndash; Payload ba\u015flatma<\/p>\n<\/li>\n<li>\n<p>SRUM I\/O spike ba\u015flang\u0131c\u0131<\/p>\n<\/li>\n<li>\n<p>EDR taraf\u0131ndan bloklanan ilk event<\/p>\n<\/li>\n<\/ul>\n<p><strong>Ama&ccedil;:<\/strong> Analizi milyonlarca logtan yaln\u0131zca sald\u0131r\u0131 aral\u0131\u011f\u0131na indirgemek.<\/p>\n<hr>\n<h2><strong>5.2. S&uuml;re&ccedil; (Process Tree) Analizi<\/strong><\/h2>\n<h3>&Ouml;rnek malicious zincir:<\/h3>\n<pre><code>outlook.exe\n  \u2514\u2500\u2500 winword.exe\n         \u2514\u2500\u2500 powershell.exe\n               \u2514\u2500\u2500 payload.exe\n<\/code><\/pre>\n<p>\u0130ncelenecekler:<\/p>\n<ul>\n<li>\n<p>Parent PID<\/p>\n<\/li>\n<li>\n<p>Komut sat\u0131r\u0131 arg&uuml;manlar\u0131<\/p>\n<\/li>\n<li>\n<p>Signed\/unsigned binary kontrol&uuml;<\/p>\n<\/li>\n<li>\n<p>Image path (AppData\\Roaming yayg\u0131n)<\/p>\n<\/li>\n<li>\n<p>Masquerading (svch0st.exe gibi)<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2><strong>5.3. Dosya Manip&uuml;lasyon Haritas\u0131<\/strong><\/h2>\n<h3>3 temel metot uygulan\u0131r:<\/h3>\n<ol>\n<li>\n<p><strong>USN Journal diffs<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>MFT Entry Correlation<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>LastWriteTime s\u0131ralamas\u0131<\/strong><\/p>\n<\/li>\n<\/ol>\n<p>Bu sayede:<\/p>\n<ul>\n<li>\n<p>Ka&ccedil; dosya \u015fifrelendi?<\/p>\n<\/li>\n<li>\n<p>Hangi klas&ouml;rler etkilendi?<\/p>\n<\/li>\n<li>\n<p>Hangi kullan\u0131c\u0131 tokeni kullan\u0131ld\u0131?<\/p>\n<\/li>\n<li>\n<p>Eri\u015fim yo\u011funlu\u011fu hangi drive&rsquo;da?<\/p>\n<\/li>\n<\/ul>\n<p>net olarak &ccedil;\u0131kar.<\/p>\n<hr>\n<h2><strong>5.4. Output Normalizasyon<\/strong><\/h2>\n<p>Toplanan ham veriler CSV\/JSON format\u0131na normalize edilir.<\/p>\n<h3>&Ouml;rnek olay &ccedil;\u0131kt\u0131s\u0131:<\/h3>\n<table>\n<thead>\n<tr>\n<th>Path<\/th>\n<th>Operation<\/th>\n<th>Old Name<\/th>\n<th>New Name<\/th>\n<th>Process<\/th>\n<th>Timestamp<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>C:\\Share\\finance.xlsx<\/td>\n<td>Rename<\/td>\n<td>finance.xlsx<\/td>\n<td>finance.xlsx.enc<\/td>\n<td>payload.exe<\/td>\n<td>2025-01-12 12:41<\/td>\n<\/tr>\n<tr>\n<td>C:\\Share\\db.db<\/td>\n<td>Data Overwrite<\/td>\n<td>-<\/td>\n<td>-<\/td>\n<td>payload.exe<\/td>\n<td>2025-01-12 12:42<\/td>\n<\/tr>\n<tr>\n<td>C:\\Share\\READ_ME.txt<\/td>\n<td>Create<\/td>\n<td>-<\/td>\n<td>-<\/td>\n<td>payload.exe<\/td>\n<td>2025-01-12 12:43<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h1><strong>6. Veri S\u0131z\u0131nt\u0131s\u0131 (Exfiltration) Analizi<\/strong><\/h1>\n<p>Modern ransomware gruplar\u0131n\u0131n %84&rsquo;&uuml;* veriyi \u015fifrelemeden &ouml;nce &ccedil;alar.<\/p>\n<p>Kontrol edilmesi gerekenler:<\/p>\n<h3><strong>6.1. Network Artefaktlar\u0131<\/strong><\/h3>\n<ul>\n<li>\n<p>Powershell upload komutlar\u0131<\/p>\n<\/li>\n<li>\n<p>Cloud API &ccedil;a\u011fr\u0131lar\u0131<\/p>\n<\/li>\n<li>\n<p>TLS &uuml;zerinden b&uuml;y&uuml;k outbound trafik<\/p>\n<\/li>\n<li>\n<p>C2 ileti\u015fimi (HTTP POST \/ chunked transfer)<\/p>\n<\/li>\n<\/ul>\n<h3><strong>6.2. Ar\u015fivleme G&ouml;stergeleri<\/strong><\/h3>\n<p>Dosya eri\u015fim analizi ile birle\u015fti\u011finde tespit edilir:<\/p>\n<ul>\n<li>\n<p><code>winrar.exe<\/code> &ccedil;al\u0131\u015ft\u0131rma<\/p>\n<\/li>\n<li>\n<p><code>7z.exe a archive.7z<\/code><\/p>\n<\/li>\n<li>\n<p>&Ccedil;ok b&uuml;y&uuml;k boyutlu ge&ccedil;ici dosya olu\u015fumu (&ldquo;collection artifact&rdquo;)<\/p>\n<\/li>\n<\/ul>\n<h3><strong>6.3. SMB Transferleri<\/strong><\/h3>\n<p>Event ID 5145 &uuml;zerinden:<\/p>\n<ul>\n<li>\n<p>Ba\u015fka bir makineye b&uuml;y&uuml;k dosya kopyalama<\/p>\n<\/li>\n<li>\n<p>Y&uuml;ksek hacimli &ldquo;Read&rdquo; operasyonlar\u0131<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1><strong>7. Ara&ccedil;lar ve Otomasyon<\/strong><\/h1>\n<h2><strong>7.1. Eric Zimmerman Tools<\/strong><\/h2>\n<ul>\n<li>\n<p><strong>MFTECmd.exe<\/strong> &rarr; MFT analizi<\/p>\n<\/li>\n<li>\n<p><strong>UsnJrnl2Csv.exe<\/strong> &rarr; USN analizi<\/p>\n<\/li>\n<li>\n<p><strong>SrumECmd.exe<\/strong> &rarr; I\/O activity<\/p>\n<\/li>\n<li>\n<p><strong>EvtxECmd.exe<\/strong> &rarr; Event log parsing<\/p>\n<\/li>\n<\/ul>\n<h2><strong>7.2. Velociraptor<\/strong><\/h2>\n<ul>\n<li>\n<p>Ransomware IOC pack<\/p>\n<\/li>\n<li>\n<p>Live forensic acquisition<\/p>\n<\/li>\n<li>\n<p>USN\/MFT real-time timeline &ccedil;\u0131karma<\/p>\n<\/li>\n<\/ul>\n<h2><strong>7.3. KAPE (Triage Arac\u0131)<\/strong><\/h2>\n<ul>\n<li>\n<p>Minimal zamanda gerekli t&uuml;m artefaktlar\u0131 toplar<\/p>\n<\/li>\n<\/ul>\n<h2><strong>7.4. Sysinternals Tools<\/strong><\/h2>\n<ul>\n<li>\n<p>Procmon &rarr; Ger&ccedil;ek zamanl\u0131 I\/O<\/p>\n<\/li>\n<li>\n<p>Handle.exe &rarr; Dosya kilidi tespiti<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1><strong>8. Bulgular\u0131n Raporlanmas\u0131<\/strong><\/h1>\n<p>Whitepaper i&ccedil;eri\u011fi kurum i&ccedil;i forensik ve hukuk ekipleri taraf\u0131ndan kullan\u0131labilir hale getirilmelidir.<\/p>\n<p>Rapor \u015fu b&ouml;l&uuml;mleri i&ccedil;ermelidir:<\/p>\n<ol>\n<li>\n<p><strong>&Ouml;zet<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Sald\u0131r\u0131 Zaman &Ccedil;izelgesi<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Bula\u015fma Y&ouml;ntemi<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Etkilenen Dosya Say\u0131s\u0131<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Etkilenen Kullan\u0131c\u0131lar<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Veri S\u0131z\u0131nt\u0131s\u0131 Bulgular\u0131<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>\u0130yile\u015ftirme &Ouml;nerileri<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Gelecek Sald\u0131r\u0131lara Kar\u015f\u0131 &Ouml;nlem Seti<\/strong><\/p>\n<\/li>\n<\/ol>\n<hr>\n<h1><strong>9. &Ouml;rnek Ransomware \u015eifreleme Ak\u0131\u015f Diyagram\u0131<\/strong><\/h1>\n<pre><code>[Initial Access]\n      &darr;\n[Payload Execution]\n      &darr;\n[Privilege Escalation]\n      &darr;\n[Shadow Copy Deletion]\n      &darr;\n[Mass File Enumeration]\n      &darr;\n[File Read &rarr; Encrypt &rarr; Write]\n      &darr;\n[File Rename (extension append)]\n      &darr;\n[Ransom Note Deployment]\n      &darr;\n[Optional: Data Exfiltration]\n<\/code><\/pre>\n<hr>\n<p>Bu whitepaper, ransomware sald\u0131r\u0131lar\u0131nda&nbsp;<strong>dosya eri\u015fim analizi<\/strong> i&ccedil;in profesyonel seviyede bir metodoloji sunmaktad\u0131r. MFT, USN Journal, Sysmon, SRUM ve EDR telemetry gibi birden fazla artefakt\u0131n korelasyonu sald\u0131r\u0131n\u0131n:<\/p>\n<ul>\n<li>\n<p>Etki alan\u0131n\u0131n,<\/p>\n<\/li>\n<li>\n<p>Zincirinin,<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131lan ara&ccedil;lar\u0131n,<\/p>\n<\/li>\n<li>\n<p>Sald\u0131rgan davran\u0131\u015f paterni,<\/p>\n<\/li>\n<li>\n<p>Veri kayb\u0131 seviyesinin<\/p>\n<\/li>\n<\/ul>\n<p>tam olarak anla\u015f\u0131lmas\u0131n\u0131 sa\u011flar.<\/p>\n<p>Bu analiz, olaya m&uuml;dahale ekiplerinin hem teknik hem de reg&uuml;lasyon uyumlu bir m&uuml;dahale yapabilmesi i&ccedil;in kritik &ouml;nemdedir.<\/p>\n<hr>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>","excerpt":"Ransomware sald\u0131r\u0131lar\u0131 g\u00fcn\u00fcm\u00fczde kurumlar\u0131n kar\u015f\u0131la\u015ft\u0131\u011f\u0131 en kritik tehditlerin ba\u015f\u0131nda geliyor. Modern fidye yaz\u0131l\u0131mlar\u0131 yaln\u0131zca verileri \u015fifrelemekle kalm\u0131yor; ayn\u0131 zamanda dosya sisteminde ola\u011fan d\u0131\u015f\u0131 bir aktivite b\u0131rakarak izlerini de saklamaya \u00e7al\u0131\u015f\u0131yor.","created_at":"2025-12-03 18:32:07","updated_at":"2026-09-23 14:12:18","category_id":7,"view_count":603,"reading_time":12,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-12-03 15:32:00","featured_image":"db630c443d86206b0661160a894eb1d5.png","slug":"ransomware-incelemelerinde-dosya-erisim-analizi-nasil-yapilir","category_name":"Cyber Security","category_slug":"cyber-security","category_color":"#10b981"},{"id":361,"title":"Windows Sunucularda SMB Ba\u011flant\u0131lar\u0131n\u0131n Derin Analizi","content":"<h2>PID 4, Netstat &Ccedil;\u0131kt\u0131lar\u0131 ve Hangi Dosyalara Eri\u015fildi\u011finin Tespiti<\/h2>\r\n<p><iframe src=\"https:\/\/www.youtube.com\/embed\/P_R3bEC5TME?si=rdq0wSKw0vVeMS72\" width=\"560\" height=\"314\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\r\n<p>Kurumsal a\u011flarda dosya sunucular\u0131 h&acirc;l&acirc; kritik &ouml;neme sahip bile\u015fenlerdir. Kullan\u0131c\u0131lar\u0131n g&uuml;nl&uuml;k i\u015flemleri, payla\u015f\u0131lan klas&ouml;r yap\u0131lar\u0131, departman dizinleri, otomasyon yaz\u0131l\u0131mlar\u0131n\u0131n dosya tabanl\u0131 s&uuml;re&ccedil;leri gibi pek &ccedil;ok aktivite, SMB (Server Message Block) protokol&uuml; &uuml;zerinden ger&ccedil;ekle\u015fir.<\/p>\r\n<p>Bir sistem y&ouml;neticisi olarak, dosya sunucular\u0131n\u0131 incelerken kar\u015f\u0131m\u0131za s\u0131k s\u0131k baz\u0131 sorular &ccedil;\u0131kar:<\/p>\r\n<p>&nbsp;Hangi istemci sunucuma ba\u011flan\u0131yor?<br>&nbsp;Bu istemci hangi payla\u015f\u0131m klas&ouml;rlerine eri\u015fiyor?<br>&nbsp;A&ccedil;t\u0131\u011f\u0131 dosyalar neler?<br>&nbsp;Bu ba\u011flant\u0131 hangi uygulama &uuml;zerinden geliyor?<br>&nbsp;Neden PID 4 g&ouml;r&uuml;n&uuml;yor? bu bir problem mi? k&ouml;t&uuml; ama&ccedil;l\u0131 bir \u015fey mi?<\/p>\r\n<p>\u0130\u015fte bu blog yaz\u0131s\u0131nda, bu sorular\u0131n tamam\u0131n\u0131 ger&ccedil;ek bir &ouml;rnek &uuml;zerinden ad\u0131m ad\u0131m ele al\u0131yoruz.<\/p>\r\n<h2>Bir Durum \u0130ncelemesi: Netstat &Ccedil;\u0131kt\u0131s\u0131nda PID 4<\/h2>\r\n<p>&Ouml;rnek senaryomuzda, dosya sunucusunda \u015fu komut &ccedil;al\u0131\u015ft\u0131r\u0131l\u0131yor:<\/p>\r\n<p>cmd<br><code>netstat ano | findstr 10.20.30.5<\/code><\/p>\r\n<p><br>Ve sonu&ccedil; \u015fu \u015fekilde geliyor:<\/p>\r\n<p><br><code>TCP &nbsp; &nbsp;10.20.30.9:445 &nbsp; &nbsp;10.20.30.5:51795 &nbsp; &nbsp;ESTABLISHED &nbsp; &nbsp; 4<\/code><br><code>TCP &nbsp; &nbsp;10.20.30.9:445 &nbsp; &nbsp;10.20.30.5:51797 &nbsp; &nbsp;ESTABLISHED &nbsp; &nbsp; 4<\/code><br><code>TCP &nbsp; &nbsp;10.20.30.9:445 &nbsp; &nbsp;10.20.30.5:51798 &nbsp; &nbsp;ESTABLISHED &nbsp; &nbsp; 4<\/code><\/p>\r\n<p><br>\u0130lk bak\u0131\u015fta anlaml\u0131 olan \u015fey:<br>10.20.30.5, sunucuya 445 numaral\u0131 port &uuml;zerinden ba\u011flan\u0131yor.<br>Bu port, SMBv2\/v3 protokollerinin standart ba\u011flant\u0131 noktas\u0131d\u0131r.<\/p>\r\n<p><strong>Dikkat &ccedil;eken \u015fey ise: PID 4.<\/strong><\/p>\r\n<p>PID 4 Neden &Ouml;zel Bir PID'dir?<\/p>\r\n<p>Windows&rsquo;ta PID 4, d&uuml;nyada yaln\u0131zca bir tek s&uuml;re&ccedil; i&ccedil;in ayr\u0131lm\u0131\u015ft\u0131r:<\/p>\r\n<p><strong>SYSTEM (NT Kernel &amp; System Process)<\/strong><\/p>\r\n<p>Bu s&uuml;re&ccedil;, i\u015fletim sisteminin &ccedil;ekirde\u011finin &ccedil;al\u0131\u015fmas\u0131n\u0131 sa\u011flar.<br>\u0130&ccedil;inde:<\/p>\r\n<p>&nbsp;SMB sunucusu s&uuml;r&uuml;c&uuml;leri<br>&nbsp;Dosya payla\u015f\u0131m\u0131 bile\u015fenleri<br>&nbsp;NFS \/ CIFS i\u015fleyicileri<br>&nbsp;Kernelmode network stack<br>&nbsp;Windows Defender&rsquo;\u0131n baz\u0131 &ccedil;ekirdek eklentileri<br>&nbsp;I\/O scheduler y&ouml;netimi<br>&nbsp;Bellek y&ouml;netiminin b&uuml;y&uuml;k k\u0131sm\u0131<\/p>\r\n<p>gibi en d&uuml;\u015f&uuml;k seviyeli bile\u015fenler vard\u0131r.<\/p>\r\n<p>Dolay\u0131s\u0131yla bir SMB ba\u011flant\u0131s\u0131 geldi\u011finde Windows i\u015flem tablosu \u015fu \u015fekilde &ccedil;al\u0131\u015f\u0131r:<\/p>\r\n<p><code>&nbsp;\"Bu ba\u011flant\u0131y\u0131 kullan\u0131c\u0131 uygulamas\u0131 ba\u015flatm\u0131yor. SMB protokol&uuml; kernel seviyesinden i\u015fleniyor. O h&acirc;lde bu ba\u011flant\u0131 PID 4 &uuml;zerinden g&ouml;r&uuml;necek.\"<\/code><\/p>\r\n<p>Ve bu tamamen do\u011fru, beklenen, ola\u011fan bir durumdur.<br>Bir uygulaman\u0131n k&ouml;t&uuml; ama&ccedil;l\u0131 oldu\u011funa i\u015faret etmez.<\/p>\r\n<h2>SMB Trafi\u011fi Neden Kernel (PID 4) &Uuml;zerinden Y&ouml;netilir?<\/h2>\r\n<p>SMB &ccedil;ok s\u0131k kullan\u0131lan ve performans a&ccedil;\u0131s\u0131ndan kritik bir protokold&uuml;r. Bu nedenle Microsoft, SMBv2&rsquo;den itibaren protokol&uuml; kullan\u0131c\u0131 modundan &ccedil;\u0131kar\u0131p kernel seviyesine ta\u015f\u0131m\u0131\u015ft\u0131r.<\/p>\r\n<p>Bu sayede:<\/p>\r\n<p>&nbsp;Daha d&uuml;\u015f&uuml;k gecikme<br>&nbsp;Daha h\u0131zl\u0131 dosya listeleme<br>&nbsp;Daha az CPU kullan\u0131m\u0131<br>&nbsp;Y&uuml;ksek yo\u011funluklu ba\u011flant\u0131larda kararl\u0131l\u0131k<br>&nbsp;Kaya gibi sa\u011flam bir g&uuml;venlik modeli<\/p>\r\n<p>elde edilir.<\/p>\r\n<p>Bu y&uuml;zden SMB ba\u011flant\u0131s\u0131n\u0131n PID 4 olarak g&ouml;r&uuml;nmesi:<\/p>\r\n<p>\u2714 Do\u011fru<br>\u2714 G&uuml;venli<br>\u2714 Tasar\u0131msal bir davran\u0131\u015ft\u0131r<\/p>\r\n<p>&gt; &ldquo;Sunucuma bir \u015fey mi bula\u015ft\u0131?&rdquo;<br>&gt; Hay\u0131r. Bu davran\u0131\u015f Windows Server&rsquo;\u0131n do\u011fal &ccedil;al\u0131\u015fma \u015feklidir.<\/p>\r\n<p>&nbsp;<\/p>\r\n<p><strong>10.20.30.5 Hangi Dosyalara Eri\u015fiyor?<\/strong><\/p>\r\n<p>\u0130\u015fte i\u015fin teknik olarak ilgin&ccedil; k\u0131sm\u0131 burada ba\u015fl\u0131yor.<br>Netstat yaln\u0131zca ba\u011flant\u0131n\u0131n oldu\u011funu g&ouml;sterir.<br>Ama ba\u011flant\u0131n\u0131n i&ccedil;eri\u011fi hakk\u0131nda hi&ccedil;bir \u015fey s&ouml;ylemez.<\/p>\r\n<p>Yani:<\/p>\r\n<p>&nbsp;Hangi klas&ouml;r?<br>&nbsp;Hangi dosya?<br>&nbsp;Ne zaman a&ccedil;t\u0131?<br>&nbsp;Ne kadar s&uuml;re a&ccedil;\u0131k kald\u0131?<br>&nbsp;Kullan\u0131c\u0131 kimli\u011fi ne?<br>&nbsp;Okuma m\u0131 yapt\u0131 yazma m\u0131 yapt\u0131?<\/p>\r\n<p>Bunlar\u0131n hi&ccedil;birini netstat ile g&ouml;remezsiniz.<\/p>\r\n<p><strong>Peki nas\u0131l g&ouml;r&uuml;r&uuml;z?<\/strong><\/p>\r\n<p>Windows Server bize bunun i&ccedil;in &ccedil;ok g&uuml;&ccedil;l&uuml; ara&ccedil;lar sunuyor.<\/p>\r\n<p>&nbsp;<\/p>\r\n<p><strong>1. SMB Oturumlar\u0131n\u0131 G&ouml;rme &ndash; Ba\u011flant\u0131n\u0131n Kimli\u011fi<\/strong><\/p>\r\n<p>\u0130lk ad\u0131m, istemcinin sunucuda aktif bir oturumu olup olmad\u0131\u011f\u0131n\u0131 g&ouml;rmek:<\/p>\r\n<p>powershell<br>GetSmbSession | Select ClientComputerName, ClientUserName, NumOpens<\/p>\r\n<p><br>Bu komut size \u015funu s&ouml;yler:<\/p>\r\n<p>&nbsp;10.20.30.5 \u015fu kullan\u0131c\u0131 ile ba\u011fl\u0131<br>&nbsp;Bu oturumda X adet dosya a&ccedil;\u0131k<br>&nbsp;Ba\u011flant\u0131 SMBv2 mi SMBv3 m&uuml;<br>&nbsp;Oturum trafi\u011fi ka&ccedil; MB<\/p>\r\n<p>&nbsp;<\/p>\r\n<p><strong>&nbsp;2. En Kritik Ad\u0131m: A&ccedil;\u0131k Dosyalar\u0131 Listeme &ndash; Ger&ccedil;ekleri G&ouml;rme<\/strong><\/p>\r\n<p>Bu komut, bir istemcinin o anda hangi dosyalar\u0131 a&ccedil;t\u0131\u011f\u0131n\u0131 birebir g&ouml;sterir:<\/p>\r\n<p>powershell<br>GetSmbOpenFile | WhereObject {$_.ClientComputerName eq \"10.20.30.5\"} |<br>&nbsp; &nbsp; Select ClientComputerName, Path, ClientUserName<\/p>\r\n<p><br>Bu sayede direkt olarak:<\/p>\r\n<p>&nbsp;&ldquo;Hangi payla\u015f\u0131m klas&ouml;r&uuml;ne girilmi\u015f?&rdquo;<br>&nbsp;&ldquo;Hangi dosya a&ccedil;\u0131lm\u0131\u015f?&rdquo;<br>&nbsp;&ldquo;Okuma m\u0131 yazma m\u0131 yap\u0131lm\u0131\u015f?&rdquo;<br>&nbsp;&ldquo;Kim eri\u015fmi\u015f?&rdquo;<\/p>\r\n<p>hepsini net bir \u015fekilde g&ouml;r&uuml;r&uuml;z.<\/p>\r\n<p><strong>&Ouml;rnek bir &ccedil;\u0131kt\u0131:<\/strong><\/p>\r\n<p><br><code>ClientComputerName : 10.20.30.5<\/code><br><code>Path &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : \\\\10.20.30.9\\Shared\\HR\\salary.xlsx<\/code><br><code>ClientUserName &nbsp; &nbsp; : corpintra\\user1<\/code><\/p>\r\n<p><br>Bu noktada art\u0131k b&uuml;t&uuml;n tablo netle\u015fmi\u015f olur:<\/p>\r\n<p><code>&nbsp;\u0130stemci &rarr; 10.20.30.5<\/code><br><code>&nbsp;Eri\u015filen dosya &rarr; salary.xlsx<\/code><br><code>&nbsp;Payla\u015f\u0131m yolu &rarr; HR<\/code><br><code>&nbsp;Kullan\u0131c\u0131 &rarr; user1<\/code><\/p>\r\n<p>&nbsp;<\/p>\r\n<p>&nbsp;\ud83d\udfe7 3. Ger&ccedil;ek Zamanl\u0131 \u0130zleme &ndash; ShareMonitor \/ Sysinternals<\/p>\r\n<p>E\u011fer canl\u0131 olarak:<\/p>\r\n<p>&nbsp;kim hangi klas&ouml;r&uuml; a&ccedil;t\u0131,<br>&nbsp;dosyan\u0131n ad\u0131 neydi,<br>&nbsp;payla\u015f\u0131mdan ne okundu ne yaz\u0131ld\u0131<\/p>\r\n<p>g&ouml;rmek istiyorsan\u0131z Sysinternals&rsquo;\u0131n &ldquo;ShareMonitor&rdquo; arac\u0131 bunu anl\u0131k g&ouml;sterir.<\/p>\r\n<p>Her a&ccedil;\u0131lan dosya \u015f&ouml;yle g&ouml;r&uuml;n&uuml;r:<\/p>\r\n<p><br><code>10.20.30.5 opened \\\\10.20.30.9\\Accounting\\Rapor.xlsx<\/code><br><code>10.20.30.5 read &nbsp; \\\\10.20.30.9\\Shared\\TaskList.docx<\/code><\/p>\r\n<p><br>A\u011f trafi\u011fini canl\u0131 takip etmek, &ouml;zellikle de b&uuml;y&uuml;k \u015firket ortamlar\u0131nda &ccedil;ok de\u011ferli bir yetenektir.<\/p>\r\n<h2>\u0130leri Seviye: Event Viewer &ndash; SMB Access Loglar\u0131<\/h2>\r\n<p>E\u011fer SMB Audit Log aktifse:<\/p>\r\n<p>Event Viewer &rarr; Microsoft &rarr; Windows &rarr; SMBServer &rarr; Operational<\/p>\r\n<p>Ba\u015fl\u0131klar alt\u0131nda:<\/p>\r\n<p>&nbsp;3000 &rarr; File Read<br>&nbsp;3001 &rarr; File Write<br>&nbsp;3002 &rarr; File Create<br>&nbsp;3003 &rarr; Directory Access<\/p>\r\n<p>gibi ID&rsquo;lerle t&uuml;m hareketler kaydedilir.<\/p>\r\n<p>Bu loglar:<\/p>\r\n<p>&nbsp;Forensic incelemelerde<br>&nbsp;Veri s\u0131z\u0131nt\u0131s\u0131 ara\u015ft\u0131rmalar\u0131nda<br>&nbsp;Kullan\u0131c\u0131 hareket analizlerinde<\/p>\r\n<p>&ccedil;ok i\u015fe yarar.<\/p>\r\n<h2>PID 4 G&ouml;rmek Normaldir, As\u0131l &Ouml;nemli Olan Dosya Eri\u015fimlerini \u0130zlemektir<\/h2>\r\n<p>Bir istemci dosya sunucusuna ba\u011fland\u0131\u011f\u0131nda ba\u011flant\u0131n\u0131n PID 4 alt\u0131nda g&ouml;r&uuml;nmesi tamamen ola\u011fan bir durumdur.<br>Bu SMB protokol&uuml;n&uuml;n Windows&rsquo;ta kernel seviyesinde &ccedil;al\u0131\u015fmas\u0131ndan kaynaklan\u0131r.<\/p>\r\n<p>&Ouml;nemli olan; istemcinin hangi dosyalara eri\u015fti\u011fini, hangi kullan\u0131c\u0131yla ba\u011fland\u0131\u011f\u0131n\u0131, hangi klas&ouml;r&uuml; a&ccedil;t\u0131\u011f\u0131n\u0131 do\u011fru ara&ccedil;larla tespit edebilmektir.<\/p>\r\n<p>Bu yaz\u0131da anlatt\u0131\u011f\u0131m\u0131z ara&ccedil;lar:<\/p>\r\n<p>&nbsp;GetSmbSession &rarr; Oturum kimli\u011fi<br>&nbsp;GetSmbOpenFile &rarr; A&ccedil;\u0131lan dosyalar<br>&nbsp;ShareMonitor &rarr; Canl\u0131 izleme<br>&nbsp;SMBServer Logs &rarr; Adli inceleme<\/p>\r\n<p>sistemin t&uuml;m resmini net \u015fekilde g&ouml;rmeyi sa\u011flar.<\/p>\r\n<p>A\u015fa\u011f\u0131ya talep etti\u011fin &uuml;&ccedil; b&ouml;l&uuml;m&uuml; <strong>blog yaz\u0131s\u0131na ek i&ccedil;erik<\/strong> olarak haz\u0131rlad\u0131m.<br>Hepsi profesyonel &ndash; anla\u015f\u0131l\u0131r &ndash; teknik olarak do\u011fru \u015fekilde d&uuml;zenlendi.<\/p>\r\n<hr>\r\n<h1><strong>SMB Teknik Terimler S&ouml;zl&uuml;\u011f&uuml; (TR\/EN)<\/strong><\/h1>\r\n<p>SMB d&uuml;nyas\u0131nda s\u0131k ge&ccedil;en kavramlar\u0131n T&uuml;rk&ccedil;e&ndash;\u0130ngilizce kar\u015f\u0131l\u0131klar\u0131 ve k\u0131sa a&ccedil;\u0131klamalar\u0131:<\/p>\r\n<table>\r\n<thead>\r\n<tr>\r\n<th><strong>T&uuml;rk&ccedil;e Terim<\/strong><\/th>\r\n<th><strong>\u0130ngilizce Terim<\/strong><\/th>\r\n<th><strong>A&ccedil;\u0131klama<\/strong><\/th>\r\n<\/tr>\r\n<\/thead>\r\n<tbody>\r\n<tr>\r\n<td>Dosya Payla\u015f\u0131m\u0131<\/td>\r\n<td>File Sharing<\/td>\r\n<td>A\u011f &uuml;zerinden klas&ouml;r\/dosya payla\u015f\u0131m\u0131. SMB&rsquo;nin temel amac\u0131.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Payla\u015f\u0131m (Payla\u015ft\u0131r\u0131lm\u0131\u015f klas&ouml;r)<\/td>\r\n<td>Share \/ Shared Folder<\/td>\r\n<td>SMB ile eri\u015filebilen payla\u015ft\u0131r\u0131lm\u0131\u015f klas&ouml;r.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Oturum<\/td>\r\n<td>Session<\/td>\r\n<td>Bir istemcinin sunucuya kurdu\u011fu kimlik do\u011frulamal\u0131 ba\u011flant\u0131.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Oturum Kimli\u011fi<\/td>\r\n<td>Session ID<\/td>\r\n<td>Her SMB ba\u011flant\u0131s\u0131na verilen benzersiz numara.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Dosya Tan\u0131t\u0131c\u0131s\u0131<\/td>\r\n<td>File Handle<\/td>\r\n<td>A&ccedil;\u0131k bir dosyay\u0131 temsil eden sistem tan\u0131t\u0131c\u0131s\u0131.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Okuma \/ Yazma<\/td>\r\n<td>Read \/ Write<\/td>\r\n<td>SMB &uuml;zerinden dosya eri\u015fim t&uuml;rleri.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Payla\u015f\u0131m Yolu<\/td>\r\n<td>UNC Path<\/td>\r\n<td>\\server\\share\\ klas&ouml;r yap\u0131s\u0131n\u0131n tam yolu.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Kimlik Do\u011frulama<\/td>\r\n<td>Authentication<\/td>\r\n<td>Kullan\u0131c\u0131 giri\u015f kontrol&uuml; (NTLM\/Kerberos).<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Yetkilendirme<\/td>\r\n<td>Authorization<\/td>\r\n<td>Kullan\u0131c\u0131n\u0131n klas&ouml;r\/dosyaya eri\u015fim yetkisi.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>SMB Protokol&uuml;<\/td>\r\n<td>SMB Protocol<\/td>\r\n<td>Windows dosya payla\u015f\u0131m protokol&uuml; (CIFS olarak da bilinir).<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>SMBv1<\/td>\r\n<td>SMB Version 1<\/td>\r\n<td>G&uuml;vensiz, eski s&uuml;r&uuml;m. Art\u0131k devre d\u0131\u015f\u0131 b\u0131rak\u0131lmas\u0131 &ouml;nerilir.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>SMBv2<\/td>\r\n<td>SMB Version 2<\/td>\r\n<td>Performans ve g&uuml;venlik olarak b&uuml;y&uuml;k s\u0131&ccedil;rama, modern s&uuml;r&uuml;m.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>SMBv3<\/td>\r\n<td>SMB Version 3<\/td>\r\n<td>\u015eifreleme, kararl\u0131l\u0131k ve h\u0131z geli\u015ftirmeleri i&ccedil;erir.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Network Signed<\/td>\r\n<td>SMB Signing<\/td>\r\n<td>SMB paketlerinin imzalanmas\u0131, g&uuml;venlik art\u0131r\u0131r.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>SMB Encryption<\/td>\r\n<td>SMB \u015eifreleme<\/td>\r\n<td>Veri ak\u0131\u015f\u0131n\u0131 u&ccedil;tan uca \u015fifreler.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>SMB Session Key<\/td>\r\n<td>Oturum Anahtar\u0131<\/td>\r\n<td>\u0130stemci&ndash;sunucu aras\u0131ndaki \u015fifreleme anahtar\u0131.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Kernel-Mode Driver<\/td>\r\n<td>&Ccedil;ekirdek Modu S&uuml;r&uuml;c&uuml;s&uuml;<\/td>\r\n<td>SMB gibi trafiklerin PID 4 alt\u0131nda &ccedil;al\u0131\u015fmas\u0131n\u0131n nedeni.<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>File Locking<\/td>\r\n<td>Dosya Kilitleme<\/td>\r\n<td>&Ccedil;oklu kullan\u0131c\u0131 eri\u015fiminde &ccedil;ak\u0131\u015fmay\u0131 &ouml;nler.<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<p>Bu s&ouml;zl&uuml;k, blog yaz\u0131na ayr\u0131 bir b&ouml;l&uuml;m olarak eklenebilir.<\/p>\r\n<hr>\r\n<h1><strong>SMBv2 ve SMBv3 Aras\u0131ndaki Farklar (Detayl\u0131 Tablo)<\/strong><\/h1>\r\n<p>SMBv2 &rarr; Windows Vista\/Server 2008 ile geldi<br>SMBv3 &rarr; Windows 8\/Server 2012 ile geldi<\/p>\r\n<p>A\u015fa\u011f\u0131daki tablo, iki s&uuml;r&uuml;m aras\u0131ndaki farklar\u0131 net \u015fekilde ortaya koyar:<\/p>\r\n<table>\r\n<thead>\r\n<tr>\r\n<th>&Ouml;zellik<\/th>\r\n<th>SMBv2<\/th>\r\n<th>SMBv3<\/th>\r\n<\/tr>\r\n<\/thead>\r\n<tbody>\r\n<tr>\r\n<td>&Ccedil;\u0131k\u0131\u015f Y\u0131l\u0131<\/td>\r\n<td>2006<\/td>\r\n<td>2012<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Performans<\/td>\r\n<td>SMBv1&rsquo;e g&ouml;re &ccedil;ok daha h\u0131zl\u0131<\/td>\r\n<td>SMBv2&rsquo;den %20&ndash;40 daha h\u0131zl\u0131<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>G&uuml;venlik<\/td>\r\n<td>SMB Signing destekler<\/td>\r\n<td><strong>SMB Encryption destekler<\/strong> (b&uuml;y&uuml;k fark!)<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>\u015eifreleme<\/td>\r\n<td>Yok<\/td>\r\n<td><strong>AES-128-GCM \/ AES-128-CCM<\/strong><\/td>\r\n<\/tr>\r\n<tr>\r\n<td>&Ccedil;oklu Kanal<\/td>\r\n<td>Yok<\/td>\r\n<td><strong>Multichannel<\/strong> (birden fazla a\u011f aray&uuml;z&uuml; &rarr; y&uuml;ksek h\u0131z)<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Dayan\u0131kl\u0131l\u0131k<\/td>\r\n<td>Temel d&uuml;zeyde<\/td>\r\n<td><strong>SMB Durable Handles<\/strong> ile kesintisiz ba\u011flant\u0131<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Failover<\/td>\r\n<td>Yok<\/td>\r\n<td>Clustered Shared Volume deste\u011fi, kesintisiz failover<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>S\u0131k\u0131\u015ft\u0131rma<\/td>\r\n<td>Yok<\/td>\r\n<td><strong>SMB Compression (2020 g&uuml;ncellemesiyle)<\/strong><\/td>\r\n<\/tr>\r\n<tr>\r\n<td>OTOMAT\u0130K Y&uuml;k Payla\u015f\u0131m\u0131<\/td>\r\n<td>Yok<\/td>\r\n<td><strong>SMB Direct + RDMA deste\u011fi<\/strong><\/td>\r\n<\/tr>\r\n<tr>\r\n<td>Kullan\u0131m Alan\u0131<\/td>\r\n<td>Genel dosya payla\u015f\u0131m\u0131<\/td>\r\n<td>Veri merkezleri, y&uuml;ksek y&uuml;k, b&uuml;y&uuml;k dosya ak\u0131\u015f\u0131, Hyper-V<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<p><strong>SMBv3, hem h\u0131z hem g&uuml;venlik hem dayan\u0131kl\u0131l\u0131k a&ccedil;\u0131s\u0131ndan en ideal s&uuml;r&uuml;md&uuml;r.<\/strong><br>G&uuml;n&uuml;m&uuml;z sunucular\u0131nda <strong>SMBv1 kapal\u0131<\/strong>, <strong>SMBv2\/3 a&ccedil;\u0131k<\/strong> olarak &ccedil;al\u0131\u015fmas\u0131 &ouml;nerilir.<\/p>\r\n<hr>\r\n<h1><strong>Powershell ile Otomatik SMB \u0130zleme Scripti<\/strong><\/h1>\r\n<p>A\u015fa\u011f\u0131daki script, belirli bir istemci IP adresinin (&ouml;r: 10.1.0.24) hangi dosyalara eri\u015fti\u011fini <strong>otomatik izler<\/strong>, her 10 saniyede bir kontrol eder ve log kayd\u0131 olu\u015fturur.<\/p>\r\n<h3>Script &Ouml;zellikleri<\/h3>\r\n<p>\u2714 Hangi dosyalara eri\u015fildi\u011fini bulur<br>\u2714 Kullan\u0131c\u0131 bilgisiyle birlikte log&rsquo;a yazar<br>\u2714 Tarih-saat damgas\u0131 ekler<br>\u2714 Ger&ccedil;ek zamanl\u0131 takip sa\u011flar<br>\u2714 Log dosyas\u0131n\u0131 CSV olarak &uuml;retir<\/p>\r\n<hr>\r\n<h2><strong>smb-monitor.ps1 &mdash; Otomatik SMB Dosya Eri\u015fim \u0130zleme Scripti<\/strong><\/h2>\r\n<pre><code class=\"language-powershell\"># ============================\r\n# SMB Otomatik \u0130zleme Scripti\r\n# ============================\r\n\r\n$TargetIP = \"10.1.0.24\"         # \u0130zlenecek istemci IP\r\n$LogFile = \"C:\\SMB_Logs\\smb_log.csv\"\r\n\r\n# Log dosyas\u0131 yoksa olu\u015ftur\r\nif (-Not (Test-Path $LogFile)) {\r\n    \"Timestamp,ClientIP,User,FilePath\" | Out-File -FilePath $LogFile -Encoding utf8\r\n}\r\n\r\nWrite-Host \"SMB izleme ba\u015flat\u0131ld\u0131... IP: $TargetIP\" -ForegroundColor Green\r\nWrite-Host \"Log dosyas\u0131: $LogFile\"\r\n\r\nwhile ($true) {\r\n\r\n    $files = Get-SmbOpenFile | Where-Object {\r\n        $_.ClientComputerName -eq $TargetIP\r\n    }\r\n\r\n    foreach ($file in $files) {\r\n        $timestamp = (Get-Date).ToString(\"yyyy-MM-dd HH:mm:ss\")\r\n        $entry = \"$timestamp,$($file.ClientComputerName),$($file.ClientUserName),$($file.Path)\"\r\n\r\n        # Log kayd\u0131n\u0131 yaz\r\n        Add-Content -Path $LogFile -Value $entry\r\n\r\n        Write-Host \"[KAYIT] $entry\" -ForegroundColor Yellow\r\n    }\r\n\r\n    Start-Sleep -Seconds 10  # Her 10 saniyede bir kontrol et\r\n}\r\n<\/code><\/pre>\r\n<hr>\r\n<h1>Kullan\u0131m Talimat\u0131<\/h1>\r\n<h3>1. Scripti bir dosyaya kaydet:<\/h3>\r\n<pre><code>C:\\Scripts\\smb-monitor.ps1\r\n<\/code><\/pre>\r\n<h3>2. Log klas&ouml;r&uuml; olu\u015ftur:<\/h3>\r\n<pre><code class=\"language-powershell\">mkdir C:\\SMB_Logs\r\n<\/code><\/pre>\r\n<h3>3. Scripti &ccedil;al\u0131\u015ft\u0131r:<\/h3>\r\n<pre><code class=\"language-powershell\">powershell -ExecutionPolicy Bypass -File C:\\Scripts\\smb-monitor.ps1\r\n<\/code><\/pre>\r\n<h3>4. Log dosyas\u0131na bak:<\/h3>\r\n<pre><code>C:\\SMB_Logs\\smb_log.csv\r\n<\/code><\/pre>\r\n<p>Her sat\u0131rda \u015funlar olacak:<\/p>\r\n<pre><code>2025-12-03 16:22:10,10.1.0.24,corpintra\\user1,\\\\10.1.0.9\\Shared\\Finance\\budget.xlsx\r\n<\/code><\/pre>\r\n<hr>\r\n<p>&nbsp;<\/p>","excerpt":"","created_at":"2025-12-03 18:22:46","updated_at":"2026-09-23 11:27:01","category_id":6,"view_count":645,"reading_time":11,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-12-03 15:22:00","featured_image":"dba84a63ff10af3e9be6cc63a30980ea.png","slug":"windows-sunucularda-smb-baglantilarinin-derin-analizi","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":341,"title":"GPO ile Ortak Klas\u00f6rleri Domain \u0130\u00e7indeki T\u00fcm Client'lara Otomatik Olarak Da\u011f\u0131tma","content":"<p>Active Directory ortamlar\u0131nda ortak klas&ouml;rlerin y&ouml;netimi, IT ekipleri i&ccedil;in s\u0131kl\u0131kla kar\u015f\u0131la\u015f\u0131lan bir zorluktur. Manuel olarak her bilgisayara gidip ortak klas&ouml;r eklemek hem zaman kayb\u0131d\u0131r hem de y&ouml;netilebilirlik a&ccedil;\u0131s\u0131ndan s&uuml;rd&uuml;r&uuml;lebilir bir y&ouml;ntem de\u011fildir. Bu yaz\u0131da, Group Policy (GPO) kullanarak ortak klas&ouml;rleri merkezi olarak nas\u0131l da\u011f\u0131taca\u011f\u0131n\u0131z\u0131 ve bu s&uuml;re&ccedil;te dikkat etmeniz gereken kritik noktalar\u0131 detayl\u0131ca ele alaca\u011f\u0131z.<\/p>\n<h2>Neden GPO ile Ortak Klas&ouml;r Da\u011f\u0131t\u0131m\u0131?<\/h2>\n<p>Manuel y&ouml;ntemlerin getirdi\u011fi operasyonel y&uuml;k, b&uuml;y&uuml;yen organizasyonlarda katlanarak artar. GPO tabanl\u0131 yakla\u015f\u0131m sayesinde:<\/p>\n<ul>\n<li><strong>Merkezi y&ouml;netim<\/strong> ile t&uuml;m de\u011fi\u015fiklikler tek noktadan yap\u0131l\u0131r<\/li>\n<li><strong>Tutarl\u0131l\u0131k<\/strong> sa\u011flanarak t&uuml;m kullan\u0131c\u0131lar ayn\u0131 yap\u0131land\u0131rmay\u0131 al\u0131r<\/li>\n<li><strong>G&uuml;venlik politikalar\u0131<\/strong> merkezi olarak uygulan\u0131r<\/li>\n<li><strong>Zaman tasarrufu<\/strong> ile IT ekibinin verimlili\u011fi artar<\/li>\n<li><strong>Hata riski<\/strong> minimuma indirilir<\/li>\n<\/ul>\n<h2>File Server &Uuml;zerinde Ortak Klas&ouml;r Haz\u0131rl\u0131\u011f\u0131<\/h2>\n<p>\u0130lk ad\u0131m, payla\u015f\u0131lacak klas&ouml;r&uuml;n do\u011fru \u015fekilde yap\u0131land\u0131r\u0131lmas\u0131d\u0131r. G&uuml;venlik ve eri\u015filebilirlik dengesi burada kritik &ouml;neme sahiptir.<\/p>\n<h3>Klas&ouml;r Yap\u0131s\u0131 Olu\u015fturma<\/h3>\n<pre><code>D:\\Ortak\\\n    \u251c\u2500\u2500 Departmanlar\\\n    \u2502   \u251c\u2500\u2500 Muhasebe\n    \u2502   \u251c\u2500\u2500 \u0130nsan_Kaynaklari\n    \u2502   \u2514\u2500\u2500 IT\n    \u2514\u2500\u2500 Genel\\\n        \u251c\u2500\u2500 Duyurular\n        \u2514\u2500\u2500 Formlar\n<\/code><\/pre>\n<h3>Payla\u015f\u0131m Yap\u0131land\u0131rmas\u0131<\/h3>\n<p>Payla\u015f\u0131m adland\u0131rmas\u0131nda gizli payla\u015f\u0131m i&ccedil;in <code>$<\/code> karakteri kullan\u0131labilir:<\/p>\n<ul>\n<li>Normal payla\u015f\u0131m: <code>\\\\FileServer\\Departman<\/code><\/li>\n<li>Gizli payla\u015f\u0131m: <code>\\\\FileServer\\Departman$<\/code><\/li>\n<\/ul>\n<p><strong>Share Permissions ayarlar\u0131:<\/strong><\/p>\n<ul>\n<li>Everyone &rarr; Read (Temel okuma eri\u015fimi)<\/li>\n<li>Domain Users &rarr; Change veya Modify (Kullan\u0131c\u0131 ihtiya&ccedil;lar\u0131na g&ouml;re)<\/li>\n<li>Domain Admins &rarr; Full Control<\/li>\n<\/ul>\n<p><strong>NTFS \u0130zinleri (Daha detayl\u0131 kontrol i&ccedil;in):<\/strong><\/p>\n<ul>\n<li>Authenticated Users &rarr; Read &amp; Execute<\/li>\n<li>\u0130lgili departman gruplar\u0131 &rarr; Modify<\/li>\n<li>CREATOR OWNER &rarr; Full Control (Sadece kendi dosyalar\u0131 i&ccedil;in)<\/li>\n<li>Domain Admins &rarr; Full Control<\/li>\n<\/ul>\n<h2>Active Directory'de G&uuml;venlik Gruplar\u0131n\u0131n Olu\u015fturulmas\u0131<\/h2>\n<p>Eri\u015fim kontrol&uuml;n&uuml; kolayla\u015ft\u0131rmak i&ccedil;in AD'de mant\u0131ksal gruplar olu\u015fturun:<\/p>\n<pre><code>GRP_OrtakKlasor_Muhasebe_Read\nGRP_OrtakKlasor_Muhasebe_Modify\nGRP_OrtakKlasor_IT_FullControl\nGRP_OrtakKlasor_Genel_Read\n<\/code><\/pre>\n<p>Bu yakla\u015f\u0131m\u0131n avantajlar\u0131:<\/p>\n<ul>\n<li>Kullan\u0131c\u0131 ekleme\/&ccedil;\u0131karma i\u015flemleri grup &uuml;zerinden yap\u0131l\u0131r<\/li>\n<li>\u0130zin de\u011fi\u015fiklikleri an\u0131nda uygulan\u0131r<\/li>\n<li>Denetim (audit) kolayla\u015f\u0131r<\/li>\n<\/ul>\n<h2>GPO Olu\u015fturma ve Yap\u0131land\u0131rma<\/h2>\n<h3>GPO Olu\u015fturma Ad\u0131mlar\u0131<\/h3>\n<ol>\n<li><strong>Group Policy Management Console<\/strong> a&ccedil;\u0131n<\/li>\n<li>\u0130lgili OU'ya sa\u011f t\u0131klay\u0131n &rarr; <strong>Create a GPO in this domain, and Link it here<\/strong><\/li>\n<li>GPO ad\u0131: <code>GPO - Ortak Klasor Dagitimi<\/code><\/li>\n<li>Olu\u015fturulan GPO'ya sa\u011f t\u0131klay\u0131n &rarr; <strong>Edit<\/strong><\/li>\n<\/ol>\n<h3>Drive Mapping Yap\u0131land\u0131rmas\u0131<\/h3>\n<pre><code>User Configuration \n  &rarr; Preferences \n    &rarr; Windows Settings \n      &rarr; Drive Maps\n<\/code><\/pre>\n<p>Yeni Drive Map eklerken dikkat edilecekler:<\/p>\n<p><strong>General Sekmesi:<\/strong><\/p>\n<ul>\n<li>Action: <strong>Create<\/strong> (\u0130lk kurulum) veya <strong>Replace<\/strong> (G&uuml;ncelleme)<\/li>\n<li>Location: <code>\\\\FileServer\\Departman$<\/code><\/li>\n<li>Label as: <code>Ortak - Departman<\/code><\/li>\n<li>Drive Letter: <strong>H:<\/strong> (&Ccedil;ak\u0131\u015fma olmamas\u0131 i&ccedil;in kontrol edin)<\/li>\n<li>Connect as: Bo\u015f b\u0131rak\u0131n (Kullan\u0131c\u0131 kimlik bilgileriyle ba\u011flanacak)<\/li>\n<\/ul>\n<p><strong>Common Sekmesi:<\/strong><\/p>\n<ul>\n<li>Run in logged-on user's security context: <strong>\u0130\u015faretli<\/strong><\/li>\n<li>Item-level targeting: <strong>\u0130\u015faretli<\/strong> (Hedefleme i&ccedil;in)<\/li>\n<\/ul>\n<h2>Item-Level Targeting ile Hassas Hedefleme<\/h2>\n<p>Item-level targeting, GPO'nun yaln\u0131zca belirli kriterlere uyan kullan\u0131c\u0131lara uygulanmas\u0131n\u0131 sa\u011flar.<\/p>\n<h3>Hedefleme Kriterleri &Ouml;rnekleri:<\/h3>\n<p><strong>G&uuml;venlik Grubu Bazl\u0131:<\/strong><\/p>\n<pre><code>Target: Security Group\nGroup: DOMAIN\\GRP_OrtakKlasor_Muhasebe_Modify\n<\/code><\/pre>\n<p><strong>Departman Bazl\u0131 (OU):<\/strong><\/p>\n<pre><code>Target: Organizational Unit\nOU: OU=Muhasebe,OU=Departmanlar,DC=sirket,DC=local\n<\/code><\/pre>\n<p><strong>Karma Hedefleme (AND\/OR mant\u0131\u011f\u0131):<\/strong><\/p>\n<pre><code>IF Member of GRP_OrtakKlasor_Read\nAND Computer Name like \"PC-MUH*\"\nTHEN Apply this setting\n<\/code><\/pre>\n<h2>GPO Uygulama ve Test S&uuml;reci<\/h2>\n<h3>Test Ortam\u0131nda Do\u011frulama<\/h3>\n<ol>\n<li>Test OU'su olu\u015fturun ve GPO'yu buraya linkleyin<\/li>\n<li>Test kullan\u0131c\u0131s\u0131 ile oturum a&ccedil;\u0131n<\/li>\n<li>A\u015fa\u011f\u0131daki komutlar\u0131 &ccedil;al\u0131\u015ft\u0131r\u0131n:<\/li>\n<\/ol>\n<pre><code class=\"language-powershell\"># GPO'yu manuel tetikleme\ngpupdate \/force\n\n# GPO uygulanma durumunu kontrol\ngpresult \/r\n\n# Detayl\u0131 GPO raporu (HTML format\u0131nda)\ngpresult \/h C:\\GPOReport.html\n<\/code><\/pre>\n<h3>Sorun Giderme Komutlar\u0131<\/h3>\n<pre><code class=\"language-powershell\"># Mapped drive'lar\u0131 listele\nnet use\n\n# Event log kontrol&uuml;\nGet-EventLog -LogName Application -Source \"Group Policy Drive Maps\"\n\n# GPO i\u015fleme detaylar\u0131\ngpresult \/z &gt; C:\\DetailedGPOReport.txt\n<\/code><\/pre>\n<h2>\u0130leri D&uuml;zey Yap\u0131land\u0131rmalar<\/h2>\n<h3>Dinamik De\u011fi\u015fkenler Kullan\u0131m\u0131<\/h3>\n<p>GPO'da ortam de\u011fi\u015fkenleri kullanarak dinamik yap\u0131lar olu\u015fturabilirsiniz:<\/p>\n<ul>\n<li><code>%USERNAME%<\/code> - Kullan\u0131c\u0131 ad\u0131<\/li>\n<li><code>%USERDOMAIN%<\/code> - Domain ad\u0131<\/li>\n<li><code>%COMPUTERNAME%<\/code> - Bilgisayar ad\u0131<\/li>\n<li><code>%LOGONSERVER%<\/code> - Oturum a&ccedil;\u0131lan DC<\/li>\n<\/ul>\n<p>&Ouml;rnek kullan\u0131m:<\/p>\n<pre><code>\\\\FileServer\\Kullanicilar\\%USERNAME%\n<\/code><\/pre>\n<h3>Script Tabanl\u0131 Alternatif<\/h3>\n<p>Daha karma\u015f\u0131k senaryolar i&ccedil;in PowerShell script'i GPO ile da\u011f\u0131t\u0131labilir:<\/p>\n<pre><code class=\"language-powershell\"># MapDrives.ps1\n$drives = @{\n    'H:' = '\\\\FileServer\\Departman'\n    'I:' = '\\\\FileServer\\Genel'\n    'P:' = \"\\\\FileServer\\Kullanicilar\\$env:USERNAME\"\n}\n\nforeach ($drive in $drives.GetEnumerator()) {\n    New-PSDrive -Name $drive.Key.TrimEnd(':') `\n                -PSProvider FileSystem `\n                -Root $drive.Value `\n                -Persist -Scope Global\n}\n<\/code><\/pre>\n<h2>G&uuml;venlik ve Performans &Ouml;nerileri<\/h2>\n<h3>G&uuml;venlik En \u0130yi Uygulamalar\u0131<\/h3>\n<ol>\n<li><strong>En az yetki prensibi:<\/strong> Kullan\u0131c\u0131lara sadece ihtiya&ccedil; duyduklar\u0131 eri\u015fimi verin<\/li>\n<li><strong>D&uuml;zenli denetim:<\/strong> Access logs'lar\u0131 d&uuml;zenli kontrol edin<\/li>\n<li><strong>\u015eifreleme:<\/strong> Hassas veriler i&ccedil;in EFS veya BitLocker kullan\u0131n<\/li>\n<li><strong>DFS kullan\u0131m\u0131:<\/strong> Y&uuml;k dengeleme ve yedekleme i&ccedil;in DFS namespace tercih edin<\/li>\n<\/ol>\n<h3>Performans Optimizasyonu<\/h3>\n<ul>\n<li><strong>Offline Files:<\/strong> S\u0131k kullan\u0131lan dosyalar i&ccedil;in aktifle\u015ftirin<\/li>\n<li><strong>Bant geni\u015fli\u011fi y&ouml;netimi:<\/strong> QoS politikalar\u0131 uygulay\u0131n<\/li>\n<li><strong>Site bazl\u0131 da\u011f\u0131t\u0131m:<\/strong> Farkl\u0131 lokasyonlar i&ccedil;in farkl\u0131 file server'lar kullan\u0131n<\/li>\n<\/ul>\n<h2>Yayg\u0131n Sorunlar ve &Ccedil;&ouml;z&uuml;mleri<\/h2>\n<h3>Sorun: Drive harfi &ccedil;ak\u0131\u015fmas\u0131<\/h3>\n<p><strong>&Ccedil;&ouml;z&uuml;m:<\/strong> GPO'da \"Replace\" action kullan\u0131n veya farkl\u0131 harf atay\u0131n<\/p>\n<h3>Sorun: Yava\u015f ba\u011flant\u0131<\/h3>\n<p><strong>&Ccedil;&ouml;z&uuml;m:<\/strong> DFS-R kullanarak yerel replikasyon yap\u0131n<\/p>\n<h3>Sorun: \u0130zin hatalar\u0131<\/h3>\n<p><strong>&Ccedil;&ouml;z&uuml;m:<\/strong> Effective permissions kontrol&uuml; yap\u0131n:<\/p>\n<pre><code class=\"language-powershell\">icacls \"\\\\FileServer\\Departman\" \/verify \/t\n<\/code><\/pre>\n<p>GPO ile ortak klas&ouml;r da\u011f\u0131t\u0131m\u0131, modern Active Directory ortamlar\u0131nda vazge&ccedil;ilmez bir y&ouml;netim arac\u0131d\u0131r. Do\u011fru yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131nda hem g&uuml;venlik hem de kullan\u0131labilirlik a&ccedil;\u0131s\u0131ndan optimal sonu&ccedil;lar elde edilir. Yukar\u0131da anlatt\u0131\u011f\u0131m ad\u0131mlar\u0131 takip ederek, organizasyonunuzda merkezi, g&uuml;venli ve &ouml;l&ccedil;eklenebilir bir dosya payla\u015f\u0131m altyap\u0131s\u0131 kurabilirsiniz.<\/p>\n<p>Unutmay\u0131n ki her organizasyonun kendine &ouml;zg&uuml; ihtiya&ccedil;lar\u0131 vard\u0131r. Bu temel yap\u0131y\u0131 kendi gereksinimlerinize g&ouml;re &ouml;zelle\u015ftirerek, daha verimli bir IT altyap\u0131s\u0131 olu\u015fturabilirsiniz. Test ortam\u0131nda deneyler yaparak &uuml;retim ortam\u0131na ge&ccedil;meden &ouml;nce t&uuml;m senaryolar\u0131 test etmenizi &ouml;nemle tavsiye ederim.<\/p>\n<hr>\n<p><em>Bu makale, Windows Server 2019\/2022 ve Active Directory Domain Services ortamlar\u0131 i&ccedil;in haz\u0131rlanm\u0131\u015ft\u0131r. Farkl\u0131 versiyonlarda k&uuml;&ccedil;&uuml;k farkl\u0131l\u0131klar olabilir.<\/em><\/p>","excerpt":"Active Directory ortamlar\u0131nda ortak klas\u00f6rlerin y\u00f6netimi, IT ekipleri i\u00e7in s\u0131kl\u0131kla kar\u015f\u0131la\u015f\u0131lan bir zorluktur. Manuel olarak her bilgisayara gidip ortak klas\u00f6r eklemek hem zaman kayb\u0131d\u0131r hem de y\u00f6netilebilirlik a\u00e7\u0131s\u0131ndan s\u00fcrd\u00fcr\u00fclebilir bir y\u00f6ntem de\u011fildir. Bu yaz\u0131da, Group Policy (GPO) kullanarak ortak klas\u00f6rleri merkezi olarak nas\u0131l da\u011f\u0131taca\u011f\u0131n\u0131z\u0131 ve bu s\u00fcre\u00e7te dikkat etmeniz gereken kritik noktalar\u0131 detayl\u0131ca ele alaca\u011f\u0131z.","created_at":"2025-11-25 16:08:00","updated_at":"2026-09-08 04:18:57","category_id":6,"view_count":474,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-11-25 13:08:00","featured_image":"45475b5e2a23555d3482d1a65bdf6831.jpg","slug":"gpo-ile-ortak-klasorleri-domain-icindeki-tum-client-lara-otomatik-olarak-dagitma","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"}]