[{"id":362,"title":"Ransomware \u0130ncelemelerinde Dosya Eri\u015fim Analizi Nas\u0131l Yap\u0131l\u0131r?","content":"<p>Ransomware sald\u0131r\u0131lar\u0131 g&uuml;n&uuml;m&uuml;zde kurumlar\u0131n kar\u015f\u0131la\u015ft\u0131\u011f\u0131 en kritik tehditlerin ba\u015f\u0131nda geliyor. Modern fidye yaz\u0131l\u0131mlar\u0131 yaln\u0131zca verileri \u015fifrelemekle kalm\u0131yor; ayn\u0131 zamanda dosya sisteminde ola\u011fan d\u0131\u015f\u0131 bir aktivite b\u0131rakarak izlerini de saklamaya &ccedil;al\u0131\u015f\u0131yor. Bu nedenle bir ransomware vakas\u0131nda&nbsp;<strong>dosya eri\u015fim analizi (File Access Analysis)<\/strong>, sald\u0131r\u0131n\u0131n yay\u0131l\u0131m\u0131n\u0131 anlamak ve etki alan\u0131n\u0131 belirlemek i&ccedil;in en &ouml;nemli ad\u0131mlardan biridir.<\/p>\n<p>Bu yaz\u0131da, ransomware incelemelerinde dosya eri\u015fim analizinin nas\u0131l yap\u0131ld\u0131\u011f\u0131n\u0131, hangi ara&ccedil;lar\u0131n kullan\u0131ld\u0131\u011f\u0131n\u0131 ve ad\u0131m ad\u0131m uygulanabilir bir yakla\u015f\u0131m\u0131 ele alaca\u011f\u0131z.<\/p>\n<hr>\n<h2><iframe style=\"width: 704px; height: 395px;\" src=\"https:\/\/www.youtube.com\/embed\/m_NfVxUCm4E?si=M8daD8Ow4IvfppNs\" width=\"811\" height=\"455\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/h2>\n<h2>Dosya Eri\u015fim Analizi Nedir?<\/h2>\n<p>Dosya eri\u015fim analizi; bir sistemde ransomware taraf\u0131ndan eri\u015filen, de\u011fi\u015ftirilen, olu\u015fturulan veya silinen dosyalar\u0131n tespit edilmesini sa\u011flayan inceleme s&uuml;recidir. Bu analiz sayesinde:<\/p>\n<ul>\n<li>\n<p>Hangi dosyalar\u0131n \u015fifrelendi\u011fi,<\/p>\n<\/li>\n<li>\n<p>Hangi klas&ouml;rlerin hedef al\u0131nd\u0131\u011f\u0131,<\/p>\n<\/li>\n<li>\n<p>Sald\u0131r\u0131n\u0131n ne zaman ba\u015flad\u0131\u011f\u0131,<\/p>\n<\/li>\n<li>\n<p>Hangi kullan\u0131c\u0131 veya i\u015flem taraf\u0131ndan tetiklendi\u011fi,<\/p>\n<\/li>\n<li>\n<p>Yan etkilerin (data exfiltration, dosya &ccedil;al\u0131nmas\u0131 vb.) olup olmad\u0131\u011f\u0131<\/p>\n<\/li>\n<\/ul>\n<p>gibi kritik bilgiler elde edilir.<\/p>\n<hr>\n<h1>1. Ad\u0131m: Log Kaynaklar\u0131n\u0131n Belirlenmesi<\/h1>\n<p>Ransomware incelemelerinde en &ouml;nemli nokta, do\u011fru log kaynaklar\u0131n\u0131 toplamakt\u0131r. Dosya eri\u015fim analizi i&ccedil;in genellikle \u015fu kaynaklar incelenir:<\/p>\n<h3>\u2714 Windows Event Logs<\/h3>\n<ul>\n<li>\n<p><strong>Security Logs (Event ID 4663, 4656)<\/strong><br>Dosya eri\u015fimi, izinsiz de\u011fi\u015fiklikler, handle a&ccedil;ma gibi aktiviteler burada g&ouml;r&uuml;l&uuml;r.<\/p>\n<\/li>\n<li>\n<p><strong>Sysmon Logs (Event ID 1, 11, 13)<\/strong><\/p>\n<ul>\n<li>\n<p>Process creation<\/p>\n<\/li>\n<li>\n<p>File creation time change<\/p>\n<\/li>\n<li>\n<p>Registry modification<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Sysmon etkinse analiz &ccedil;ok daha kolay olur.<\/p>\n<h3>\u2714 NTFS MFT (Master File Table)<\/h3>\n<ul>\n<li>\n<p>Dosya olu\u015fturma, yeniden adland\u0131rma, silme gibi t&uuml;m olaylar\u0131n d&uuml;\u015f&uuml;k seviyede kaydedildi\u011fi yerdir.<\/p>\n<\/li>\n<li>\n<p>Ransomware'ler MFT &uuml;zerinde iz b\u0131rak\u0131r.<\/p>\n<\/li>\n<\/ul>\n<h3>\u2714 USN Journal<\/h3>\n<ul>\n<li>\n<p>Dosya de\u011fi\u015fikliklerinin neredeyse ger&ccedil;ek zamanl\u0131 kayd\u0131<\/p>\n<\/li>\n<li>\n<p>\u015eifreleme i\u015flemleri milyonlarca sat\u0131r log &uuml;retir<\/p>\n<\/li>\n<\/ul>\n<h3>\u2714 Antivirus \/ EDR Loglar\u0131<\/h3>\n<ul>\n<li>\n<p>Impacted files<\/p>\n<\/li>\n<li>\n<p>Blocked actions<\/p>\n<\/li>\n<li>\n<p>Quarantine kay\u0131tlar\u0131<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1>2. Ad\u0131m: Sald\u0131r\u0131n\u0131n Zaman Aral\u0131\u011f\u0131n\u0131 Belirleme<\/h1>\n<p>Dosya eri\u015fim analizine ba\u015flamadan &ouml;nce sald\u0131r\u0131n\u0131n zaman &ccedil;izelgesi &ccedil;\u0131kar\u0131l\u0131r:<\/p>\n<ul>\n<li>\n<p>\u0130lk \u015fifrelenen dosya zaman\u0131<\/p>\n<\/li>\n<li>\n<p>Ransom note olu\u015fturulma zaman\u0131<\/p>\n<\/li>\n<li>\n<p>\u015e&uuml;pheli s&uuml;re&ccedil; ba\u015flang\u0131c\u0131 (Sysmon Event ID 1)<\/p>\n<\/li>\n<li>\n<p>Volume Shadow Copy silme komutlar\u0131 (wmic, vssadmin)<\/p>\n<\/li>\n<\/ul>\n<p>Bu zaman aral\u0131\u011f\u0131 daralt\u0131l\u0131r ve t&uuml;m analiz bu timeframe &uuml;zerinde yap\u0131l\u0131r.<\/p>\n<hr>\n<h1>3. Ad\u0131m: Dosya Eri\u015fim &Ouml;r&uuml;nt&uuml;lerinin Tespiti<\/h1>\n<p>Ransomware karakteristik dosya eri\u015fim davran\u0131\u015flar\u0131 sergiler:<\/p>\n<h3>\ud83d\udccc Anormal Dosya Olu\u015fturma<\/h3>\n<ul>\n<li>\n<p>ayn\u0131 anda y&uuml;zlerce dosyan\u0131n yeniden adland\u0131r\u0131lmas\u0131 (file.ext &rarr; file.ext.locked)<\/p>\n<\/li>\n<li>\n<p>.README.txt, <em>R3ADME<\/em>.html gibi not dosyalar\u0131<\/p>\n<\/li>\n<\/ul>\n<h3>\ud83d\udccc Uzant\u0131 De\u011fi\u015fiklikleri<\/h3>\n<ul>\n<li>\n<p>AES \u015fifreleme sonras\u0131 yeni bir uzant\u0131 eklenmesi (.dark, .encrypted vb.)<\/p>\n<\/li>\n<\/ul>\n<h3>\ud83d\udccc Y&uuml;ksek I\/O Aktivitesi<\/h3>\n<ul>\n<li>\n<p>K\u0131sa s&uuml;rede binlerce dosya olu\u015fturma\/silme<\/p>\n<\/li>\n<li>\n<p>Sysinternals Process Monitor ile kolayca tespit edilir<\/p>\n<\/li>\n<\/ul>\n<h3>\ud83d\udccc Dosya Metadata Manip&uuml;lasyonu<\/h3>\n<ul>\n<li>\n<p>CreationTime \/ ModifiedTime de\u011fi\u015ftirmeleri<\/p>\n<\/li>\n<li>\n<p>Sysmon Event ID 2 \/ 11 ile tespit edilebilir<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1>4. Ad\u0131m: USN Journal Analizi<\/h1>\n<p>Ransomware davran\u0131\u015f\u0131n\u0131 en net g&ouml;steren alanlardan biri <strong>USN Journal<\/strong>&rsquo;d\u0131r. &Ccedil;&uuml;nk&uuml; \u015fifreleme s\u0131ras\u0131nda y&uuml;zlerce:<\/p>\n<ul>\n<li>\n<p><code>USN_REASON_DATA_TRUNCATION<\/code><\/p>\n<\/li>\n<li>\n<p><code>USN_REASON_FILE_CREATE<\/code><\/p>\n<\/li>\n<li>\n<p><code>USN_REASON_RENAME_OLD_NAME<\/code><\/p>\n<\/li>\n<li>\n<p><code>USN_REASON_RENAME_NEW_NAME<\/code><\/p>\n<\/li>\n<\/ul>\n<p>olay\u0131 g&ouml;r&uuml;n&uuml;r.<\/p>\n<h3>Kullan\u0131lan Ara&ccedil;lar:<\/h3>\n<ul>\n<li>\n<p><strong>AnalyzeMFT<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>MFTECmd (Eric Zimmerman)<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>UsnJrnl2Csv<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Velociraptor Forensics<\/strong><\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1>5. Ad\u0131m: MFT Analizi<\/h1>\n<p>MFT analizi ile:<\/p>\n<ul>\n<li>\n<p>\u015eifrelenen dosyalar\u0131n tam listesi<\/p>\n<\/li>\n<li>\n<p>Ransomware&rsquo;in olu\u015fturdu\u011fu ge&ccedil;ici dosyalar<\/p>\n<\/li>\n<li>\n<p>Silinmi\u015f fakat h&acirc;l&acirc; referans\u0131 bulunan dosyalar<\/p>\n<\/li>\n<li>\n<p>Yo\u011fun eri\u015fim yap\u0131lan dizinler<\/p>\n<\/li>\n<\/ul>\n<p>gibi bilgiler &ccedil;\u0131kar\u0131labilir.<\/p>\n<h3>Komut:<\/h3>\n<pre><code>MFTECmd.exe -f $MFT --csv .\\output\\\n<\/code><\/pre>\n<hr>\n<h1>6. Ad\u0131m: S&uuml;re&ccedil; (Process) Tespiti<\/h1>\n<p>Dosya eri\u015fimlerinin arkas\u0131nda hangi i\u015flem var?<\/p>\n<p>Bunu bulmak i&ccedil;in a\u015fa\u011f\u0131daki kaynaklar incelenir:<\/p>\n<h3>\u2714 Sysmon - Event ID 1 (Process Create)<\/h3>\n<ul>\n<li>\n<p>\u015e&uuml;pheli EXE dosyalar\u0131<\/p>\n<\/li>\n<li>\n<p>Temp, AppData, Roaming alt\u0131ndan &ccedil;al\u0131\u015fan uygulamalar<\/p>\n<\/li>\n<li>\n<p>Powershell, cmd, wscript &ccedil;a\u011fr\u0131lar\u0131<\/p>\n<\/li>\n<\/ul>\n<h3>\u2714 Handle Analizi (Ransomware o an &ccedil;al\u0131\u015f\u0131yorsa)<\/h3>\n<ul>\n<li>\n<p>Sysinternals <strong>handle.exe<\/strong><\/p>\n<\/li>\n<li>\n<p>Hangi proses hangi dosyalar\u0131 kilitliyor?<\/p>\n<\/li>\n<\/ul>\n<h3>\u2714 Parent-Child Chain<\/h3>\n<p>&Ouml;rnek k&ouml;t&uuml; zincir:<\/p>\n<pre><code>outlook.exe &rarr; winword.exe &rarr; powershell.exe &rarr; payload.exe\n<\/code><\/pre>\n<hr>\n<h1>7. Ad\u0131m: Etkilenen Dosyalar\u0131n Haritalanmas\u0131<\/h1>\n<p>Toplanan t&uuml;m log kaynaklar\u0131 birle\u015ftirilerek:<\/p>\n<ul>\n<li>\n<p>Etkilenen dizinler<\/p>\n<\/li>\n<li>\n<p>\u015eifrelenen dosya say\u0131s\u0131<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131c\u0131 bazl\u0131 eri\u015fim<\/p>\n<\/li>\n<li>\n<p>Dosya boyutu de\u011fi\u015fimi<\/p>\n<\/li>\n<li>\n<p>En son eri\u015fim zamanlar\u0131<\/p>\n<\/li>\n<\/ul>\n<p>gibi bilgiler bir rapor haline getirilir.<\/p>\n<h3>&Ouml;rnek CSV &Ccedil;\u0131kt\u0131s\u0131:<\/h3>\n<table>\n<thead>\n<tr>\n<th>Dosya<\/th>\n<th>Eski Ad<\/th>\n<th>Yeni Ad<\/th>\n<th>Son Eri\u015fim<\/th>\n<th>\u0130\u015flem<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>C:\\data\\report.xlsx<\/td>\n<td>report.xlsx<\/td>\n<td>report.xlsx.locked<\/td>\n<td>12:41<\/td>\n<td>Rename + Write<\/td>\n<\/tr>\n<tr>\n<td>C:\\data\\finances.db<\/td>\n<td>finances.db<\/td>\n<td>finances.db.enc<\/td>\n<td>12:42<\/td>\n<td>Overwrite<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h1>8. Ad\u0131m: Data Exfiltration Kontrol&uuml; (Varsa)<\/h1>\n<p>Baz\u0131 modern ransomware gruplar\u0131 &ouml;nce <strong>verileri &ccedil;alar<\/strong>, sonra \u015fifreleme yapar.<\/p>\n<p>\u015eu kaynaklara bak\u0131l\u0131r:<\/p>\n<ul>\n<li>\n<p>Powershell Invoke-WebRequest kay\u0131tlar\u0131<\/p>\n<\/li>\n<li>\n<p>Browser download\/upload ge&ccedil;mi\u015fi<\/p>\n<\/li>\n<li>\n<p>Cloud depolama istemcileri (Mega, Dropbox CLI)<\/p>\n<\/li>\n<li>\n<p>SMB transfer loglar\u0131<\/p>\n<\/li>\n<li>\n<p>WinRar \/ 7zip ile b&uuml;y&uuml;k ar\u015fiv olu\u015fturma loglar\u0131<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1>9. Ad\u0131m: Otomatikle\u015ftirilmi\u015f Ara&ccedil;lar<\/h1>\n<h3>\ud83d\udd27 Eric Zimmerman Tools<\/h3>\n<ul>\n<li>\n<p>MFTECmd<\/p>\n<\/li>\n<li>\n<p>SrumECmd<\/p>\n<\/li>\n<li>\n<p>EvtxECmd<\/p>\n<\/li>\n<li>\n<p>UsnJrnl2Csv<\/p>\n<\/li>\n<\/ul>\n<h3>\ud83d\udd27 Velociraptor<\/h3>\n<ul>\n<li>\n<p>Ransomware IOC templatelar\u0131<\/p>\n<\/li>\n<li>\n<p>USN\/MFT Collector<\/p>\n<\/li>\n<\/ul>\n<h3>\ud83d\udd27 KAPE<\/h3>\n<p>H\u0131zl\u0131 triage i&ccedil;in ideal.<\/p>\n<hr>\n<p>Ransomware incelemelerinde dosya eri\u015fim analizi, sald\u0131r\u0131n\u0131n etkisini ortaya &ccedil;\u0131karmak i&ccedil;in kritik &ouml;neme sahiptir. Log kaynaklar\u0131n\u0131n toplanmas\u0131, MFT\/USN journal analizi, process takibi ve zaman &ccedil;izelgesi olu\u015fturulmas\u0131 sayesinde:<\/p>\n<ul>\n<li>\n<p>Etkilenen dosyalar<\/p>\n<\/li>\n<li>\n<p>Sald\u0131r\u0131 zinciri<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131lan ara&ccedil;lar<\/p>\n<\/li>\n<li>\n<p>Sald\u0131r\u0131n\u0131n ba\u015flang\u0131&ccedil; zaman\u0131<\/p>\n<\/li>\n<\/ul>\n<p>net bi&ccedil;imde tespit edilir.<\/p>\n<p>Bu analizler yaln\u0131zca olay m&uuml;dahale ekipleri i&ccedil;in de\u011fil, ayn\u0131 zamanda gelecekte benzer sald\u0131r\u0131lar\u0131 &ouml;nlemek isteyen kurumlar i&ccedil;in de b&uuml;y&uuml;k de\u011ferlidir.<\/p>\n<p>&nbsp;<\/p>\n<h1><strong>WHITEPAPER<\/strong><\/h1>\n<h2><strong>Ransomware \u0130ncelemelerinde Dosya Eri\u015fim Analizi<\/strong><\/h2>\n<h3><em>Tehdit Av\u0131, Adli Bili\u015fim ve Olay M&uuml;dahale Perspektifi<\/em><\/h3>\n<hr>\n<h3>&nbsp;<\/h3>\n<p>Ransomware, modern siber sald\u0131r\u0131 ekosisteminin en y\u0131k\u0131c\u0131 tehditlerinden biri h&acirc;line gelmi\u015ftir. Klasik \u015fifreleme odakl\u0131 varianlar yerini, &ccedil;ok a\u015famal\u0131 (multi-stage), veri s\u0131z\u0131nt\u0131l\u0131 (double\/triple extortion) fidye yaz\u0131l\u0131mlar\u0131na b\u0131rakm\u0131\u015ft\u0131r. Bu sald\u0131r\u0131lar yaln\u0131zca veri \u015fifrelemekle kalmaz; sistem &uuml;zerinde geni\u015f dosya eri\u015fim aktivitelerine ve belirgin bir artefakt yo\u011funlu\u011funa neden olur.<\/p>\n<p>Bu whitepaper, ransomware olay m&uuml;dahalesi s\u0131ras\u0131nda <strong>dosya eri\u015fim analizi (File Access Analysis)<\/strong> s&uuml;re&ccedil;lerinin teknik derinli\u011fini aktarmak amac\u0131yla haz\u0131rlanm\u0131\u015ft\u0131r. Analiz; NTFS meta verileri, Windows Event Logs, Sysmon kay\u0131tlar\u0131, USN Journal, MFT, SRUM ve EDR telemetry verileri &uuml;zerinden b&uuml;t&uuml;nle\u015fik bir y&ouml;ntem sunar.<\/p>\n<hr>\n<h1><strong>2. Dosya Eri\u015fim Analizinin Amac\u0131<\/strong><\/h1>\n<p>Dosya eri\u015fim analizi, ransomware sald\u0131r\u0131s\u0131n\u0131n:<\/p>\n<ul>\n<li>\n<p>Ba\u015flang\u0131&ccedil; noktas\u0131n\u0131<\/p>\n<\/li>\n<li>\n<p>Yay\u0131l\u0131m vekt&ouml;r&uuml;n&uuml;<\/p>\n<\/li>\n<li>\n<p>Hangi dosyalar\u0131n manip&uuml;le edildi\u011fini<\/p>\n<\/li>\n<li>\n<p>Hangi kullan\u0131c\u0131\/i\u015flem taraf\u0131ndan tetiklendi\u011fini<\/p>\n<\/li>\n<li>\n<p>Ne kadar veri \u015fifrelendi\u011fini<\/p>\n<\/li>\n<li>\n<p>Veri s\u0131z\u0131nt\u0131s\u0131 olup olmad\u0131\u011f\u0131n\u0131<\/p>\n<\/li>\n<li>\n<p>\u015eifreleme davran\u0131\u015f\u0131n\u0131n metodolojisini<\/p>\n<\/li>\n<\/ul>\n<p>tespit etmek i&ccedil;in uygulan\u0131r.<\/p>\n<p>Bu sayede hem sald\u0131r\u0131n\u0131n boyutu belirlenir hem de hukuki s&uuml;re&ccedil;lerde (SIGORTA, KVKK, GDPR) gerekli olan teknik kan\u0131tlar toplan\u0131r.<\/p>\n<hr>\n<h1><strong>3. Ransomware Dosya Manip&uuml;lasyon Davran\u0131\u015flar\u0131<\/strong><\/h1>\n<p>Ransomware'in dosya sisteminde b\u0131rakt\u0131\u011f\u0131 kal\u0131nt\u0131lar belirli bir paterne sahiptir.<\/p>\n<h3><strong>3.1. Y&uuml;ksek hacimli I\/O operasyonlar\u0131<\/strong><\/h3>\n<ul>\n<li>\n<p>K\u0131sa s&uuml;rede binlerce dosyaya eri\u015fim<\/p>\n<\/li>\n<li>\n<p>&Ccedil;ok say\u0131da <code>CreateFile<\/code>, <code>WriteFile<\/code>, <code>RenameFile<\/code>, <code>SetInformationFile<\/code><\/p>\n<\/li>\n<\/ul>\n<h3><strong>3.2. Uzant\u0131 de\u011fi\u015fikli\u011fi<\/strong><\/h3>\n<ul>\n<li>\n<p><code>*.docx<\/code> &rarr; <code>*.docx.locked<\/code><\/p>\n<\/li>\n<li>\n<p><code>*.pdf<\/code> &rarr; <code>*.encrypted<\/code><\/p>\n<\/li>\n<\/ul>\n<h3><strong>3.3. Metadata manip&uuml;lasyonu<\/strong><\/h3>\n<ul>\n<li>\n<p>CreationTime resetlenmesi<\/p>\n<\/li>\n<li>\n<p>LastWriteTime&rsquo;\u0131n ayn\u0131 saniyede ard\u0131\u015f\u0131k y&uuml;zlerce dosyada g&ouml;r&uuml;nmesi<\/p>\n<\/li>\n<\/ul>\n<h3><strong>3.4. Ransom note olu\u015fturma<\/strong><\/h3>\n<ul>\n<li>\n<p>Ayn\u0131 dizinlere y&uuml;zlerce <code>.txt<\/code> veya <code>.html<\/code> dosyas\u0131 d&uuml;\u015f&uuml;rme<\/p>\n<\/li>\n<li>\n<p>&Ccedil;oklu dizin traversesi<\/p>\n<\/li>\n<\/ul>\n<h3><strong>3.5. Shadow Copy silme<\/strong><\/h3>\n<pre><code>vssadmin delete shadows \/all \/quiet\nwmic shadowcopy delete\n<\/code><\/pre>\n<hr>\n<h1><strong>4. Analiz \u0130&ccedil;in Kullan\u0131lan Temel Kaynaklar<\/strong><\/h1>\n<p>Dosya eri\u015fim analizinin ba\u015far\u0131s\u0131, do\u011fru artefaktlar\u0131n toplanmas\u0131na ba\u011fl\u0131d\u0131r.<\/p>\n<h2><strong>4.1. Windows Event Logs<\/strong><\/h2>\n<h3><strong>Security.evtx<\/strong><\/h3>\n<ul>\n<li>\n<p><strong>4663<\/strong> &rarr; Dosya eri\u015fim denetimi<\/p>\n<\/li>\n<li>\n<p><strong>4656<\/strong> &rarr; Handle a&ccedil;ma giri\u015fimi<\/p>\n<\/li>\n<li>\n<p><strong>4670<\/strong> &rarr; ACL de\u011fi\u015fikli\u011fi<\/p>\n<\/li>\n<li>\n<p><strong>5145<\/strong> &rarr; SMB &uuml;zerinden dosya eri\u015fimi<\/p>\n<\/li>\n<\/ul>\n<h3><strong>Sysmon.evtx<\/strong><\/h3>\n<ul>\n<li>\n<p><strong>1<\/strong> &rarr; Process Create<\/p>\n<\/li>\n<li>\n<p><strong>11<\/strong> &rarr; File Create<\/p>\n<\/li>\n<li>\n<p><strong>13<\/strong> &rarr; Registry Set<\/p>\n<\/li>\n<li>\n<p><strong>2, 17, 18<\/strong> &rarr; Dosya time-stamp manip&uuml;lasyonu<\/p>\n<\/li>\n<li>\n<p><strong>7<\/strong> &rarr; Image Load (crypto library y&uuml;klemeleri)<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2><strong>4.2. NTFS Artefaktlar\u0131<\/strong><\/h2>\n<h3><strong>4.2.1. MFT ($MFT)<\/strong><\/h3>\n<p>Ransomware faaliyetinin en g&uuml;venilir kan\u0131t\u0131d\u0131r.<\/p>\n<p>Tespit edilebilir:<\/p>\n<ul>\n<li>\n<p>\u015eifrelenen t&uuml;m dosyalar<\/p>\n<\/li>\n<li>\n<p>Silinen ancak iz b\u0131rakan dosya kay\u0131tlar\u0131<\/p>\n<\/li>\n<li>\n<p>Yo\u011fun rename operasyonlar\u0131<\/p>\n<\/li>\n<li>\n<p>Ransom note da\u011f\u0131l\u0131m\u0131<\/p>\n<\/li>\n<\/ul>\n<h3><strong>4.2.2. USN Journal ($UsnJrnl:$J)<\/strong><\/h3>\n<p>Ransomware \u015fifreleme s\u0131ras\u0131nda tipik olarak milyonlarca sat\u0131r aktivite &uuml;retir.<\/p>\n<p>&Ouml;ne &ccedil;\u0131kan USN reason kodlar\u0131:<\/p>\n<ul>\n<li>\n<p><code>0x00000020<\/code> &ndash; File Create<\/p>\n<\/li>\n<li>\n<p><code>0x00000002<\/code> &ndash; Data Overwrite<\/p>\n<\/li>\n<li>\n<p><code>0x00001000<\/code> &ndash; Rename Old Name<\/p>\n<\/li>\n<li>\n<p><code>0x00002000<\/code> &ndash; Rename New Name<\/p>\n<\/li>\n<\/ul>\n<h3><strong>4.2.3. $LogFile<\/strong><\/h3>\n<ul>\n<li>\n<p>Transaction-based kay\u0131t<\/p>\n<\/li>\n<li>\n<p>Ani dosya de\u011fi\u015fiklik paternleri (I\/O spike)<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2><strong>4.3. SRUM (System Resource Usage Monitor)<\/strong><\/h2>\n<ul>\n<li>\n<p>S&uuml;recin ne kadar I\/O t&uuml;ketti\u011fini<\/p>\n<\/li>\n<li>\n<p>Hangi saatlerde yo\u011fun i\u015flem ger&ccedil;ekle\u015ftirdi\u011fini<\/p>\n<\/li>\n<\/ul>\n<p>g&ouml;sterir.<\/p>\n<hr>\n<h2><strong>4.4. EDR Telemetry<\/strong><\/h2>\n<p>Kurumsal yap\u0131larda en kritik kaynak:<\/p>\n<ul>\n<li>\n<p>File write events<\/p>\n<\/li>\n<li>\n<p>File rename events<\/p>\n<\/li>\n<li>\n<p>Process ancestry<\/p>\n<\/li>\n<li>\n<p>Injection teknikleri<\/p>\n<\/li>\n<li>\n<p>Network exfiltration<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1><strong>5. Dosya Eri\u015fim Analiz Metodolojisi<\/strong><\/h1>\n<p>Bu b&ouml;l&uuml;m DFIR ekiplerinin kulland\u0131\u011f\u0131 tam metodolojik yakla\u015f\u0131m\u0131 i&ccedil;erir.<\/p>\n<hr>\n<h2><strong>5.1. Zaman &Ccedil;izelgesi (Timeline) Olu\u015fturma<\/strong><\/h2>\n<p>En kritik ad\u0131m <strong>attack window<\/strong>'u belirlemektir.<\/p>\n<p>Zaman aral\u0131\u011f\u0131 \u015fu artefaktlarla belirlenir:<\/p>\n<ul>\n<li>\n<p>\u0130lk \u015fifrelenen dosyan\u0131n <code>MFT LastWriteTime<\/code> bilgisi<\/p>\n<\/li>\n<li>\n<p>\u0130lk ransom note olu\u015fturulma zaman\u0131<\/p>\n<\/li>\n<li>\n<p>Sysmon Process Create (event ID 1) &ndash; Payload ba\u015flatma<\/p>\n<\/li>\n<li>\n<p>SRUM I\/O spike ba\u015flang\u0131c\u0131<\/p>\n<\/li>\n<li>\n<p>EDR taraf\u0131ndan bloklanan ilk event<\/p>\n<\/li>\n<\/ul>\n<p><strong>Ama&ccedil;:<\/strong> Analizi milyonlarca logtan yaln\u0131zca sald\u0131r\u0131 aral\u0131\u011f\u0131na indirgemek.<\/p>\n<hr>\n<h2><strong>5.2. S&uuml;re&ccedil; (Process Tree) Analizi<\/strong><\/h2>\n<h3>&Ouml;rnek malicious zincir:<\/h3>\n<pre><code>outlook.exe\n  \u2514\u2500\u2500 winword.exe\n         \u2514\u2500\u2500 powershell.exe\n               \u2514\u2500\u2500 payload.exe\n<\/code><\/pre>\n<p>\u0130ncelenecekler:<\/p>\n<ul>\n<li>\n<p>Parent PID<\/p>\n<\/li>\n<li>\n<p>Komut sat\u0131r\u0131 arg&uuml;manlar\u0131<\/p>\n<\/li>\n<li>\n<p>Signed\/unsigned binary kontrol&uuml;<\/p>\n<\/li>\n<li>\n<p>Image path (AppData\\Roaming yayg\u0131n)<\/p>\n<\/li>\n<li>\n<p>Masquerading (svch0st.exe gibi)<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2><strong>5.3. Dosya Manip&uuml;lasyon Haritas\u0131<\/strong><\/h2>\n<h3>3 temel metot uygulan\u0131r:<\/h3>\n<ol>\n<li>\n<p><strong>USN Journal diffs<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>MFT Entry Correlation<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>LastWriteTime s\u0131ralamas\u0131<\/strong><\/p>\n<\/li>\n<\/ol>\n<p>Bu sayede:<\/p>\n<ul>\n<li>\n<p>Ka&ccedil; dosya \u015fifrelendi?<\/p>\n<\/li>\n<li>\n<p>Hangi klas&ouml;rler etkilendi?<\/p>\n<\/li>\n<li>\n<p>Hangi kullan\u0131c\u0131 tokeni kullan\u0131ld\u0131?<\/p>\n<\/li>\n<li>\n<p>Eri\u015fim yo\u011funlu\u011fu hangi drive&rsquo;da?<\/p>\n<\/li>\n<\/ul>\n<p>net olarak &ccedil;\u0131kar.<\/p>\n<hr>\n<h2><strong>5.4. Output Normalizasyon<\/strong><\/h2>\n<p>Toplanan ham veriler CSV\/JSON format\u0131na normalize edilir.<\/p>\n<h3>&Ouml;rnek olay &ccedil;\u0131kt\u0131s\u0131:<\/h3>\n<table>\n<thead>\n<tr>\n<th>Path<\/th>\n<th>Operation<\/th>\n<th>Old Name<\/th>\n<th>New Name<\/th>\n<th>Process<\/th>\n<th>Timestamp<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>C:\\Share\\finance.xlsx<\/td>\n<td>Rename<\/td>\n<td>finance.xlsx<\/td>\n<td>finance.xlsx.enc<\/td>\n<td>payload.exe<\/td>\n<td>2025-01-12 12:41<\/td>\n<\/tr>\n<tr>\n<td>C:\\Share\\db.db<\/td>\n<td>Data Overwrite<\/td>\n<td>-<\/td>\n<td>-<\/td>\n<td>payload.exe<\/td>\n<td>2025-01-12 12:42<\/td>\n<\/tr>\n<tr>\n<td>C:\\Share\\READ_ME.txt<\/td>\n<td>Create<\/td>\n<td>-<\/td>\n<td>-<\/td>\n<td>payload.exe<\/td>\n<td>2025-01-12 12:43<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h1><strong>6. Veri S\u0131z\u0131nt\u0131s\u0131 (Exfiltration) Analizi<\/strong><\/h1>\n<p>Modern ransomware gruplar\u0131n\u0131n %84&rsquo;&uuml;* veriyi \u015fifrelemeden &ouml;nce &ccedil;alar.<\/p>\n<p>Kontrol edilmesi gerekenler:<\/p>\n<h3><strong>6.1. Network Artefaktlar\u0131<\/strong><\/h3>\n<ul>\n<li>\n<p>Powershell upload komutlar\u0131<\/p>\n<\/li>\n<li>\n<p>Cloud API &ccedil;a\u011fr\u0131lar\u0131<\/p>\n<\/li>\n<li>\n<p>TLS &uuml;zerinden b&uuml;y&uuml;k outbound trafik<\/p>\n<\/li>\n<li>\n<p>C2 ileti\u015fimi (HTTP POST \/ chunked transfer)<\/p>\n<\/li>\n<\/ul>\n<h3><strong>6.2. Ar\u015fivleme G&ouml;stergeleri<\/strong><\/h3>\n<p>Dosya eri\u015fim analizi ile birle\u015fti\u011finde tespit edilir:<\/p>\n<ul>\n<li>\n<p><code>winrar.exe<\/code> &ccedil;al\u0131\u015ft\u0131rma<\/p>\n<\/li>\n<li>\n<p><code>7z.exe a archive.7z<\/code><\/p>\n<\/li>\n<li>\n<p>&Ccedil;ok b&uuml;y&uuml;k boyutlu ge&ccedil;ici dosya olu\u015fumu (&ldquo;collection artifact&rdquo;)<\/p>\n<\/li>\n<\/ul>\n<h3><strong>6.3. SMB Transferleri<\/strong><\/h3>\n<p>Event ID 5145 &uuml;zerinden:<\/p>\n<ul>\n<li>\n<p>Ba\u015fka bir makineye b&uuml;y&uuml;k dosya kopyalama<\/p>\n<\/li>\n<li>\n<p>Y&uuml;ksek hacimli &ldquo;Read&rdquo; operasyonlar\u0131<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1><strong>7. Ara&ccedil;lar ve Otomasyon<\/strong><\/h1>\n<h2><strong>7.1. Eric Zimmerman Tools<\/strong><\/h2>\n<ul>\n<li>\n<p><strong>MFTECmd.exe<\/strong> &rarr; MFT analizi<\/p>\n<\/li>\n<li>\n<p><strong>UsnJrnl2Csv.exe<\/strong> &rarr; USN analizi<\/p>\n<\/li>\n<li>\n<p><strong>SrumECmd.exe<\/strong> &rarr; I\/O activity<\/p>\n<\/li>\n<li>\n<p><strong>EvtxECmd.exe<\/strong> &rarr; Event log parsing<\/p>\n<\/li>\n<\/ul>\n<h2><strong>7.2. Velociraptor<\/strong><\/h2>\n<ul>\n<li>\n<p>Ransomware IOC pack<\/p>\n<\/li>\n<li>\n<p>Live forensic acquisition<\/p>\n<\/li>\n<li>\n<p>USN\/MFT real-time timeline &ccedil;\u0131karma<\/p>\n<\/li>\n<\/ul>\n<h2><strong>7.3. KAPE (Triage Arac\u0131)<\/strong><\/h2>\n<ul>\n<li>\n<p>Minimal zamanda gerekli t&uuml;m artefaktlar\u0131 toplar<\/p>\n<\/li>\n<\/ul>\n<h2><strong>7.4. Sysinternals Tools<\/strong><\/h2>\n<ul>\n<li>\n<p>Procmon &rarr; Ger&ccedil;ek zamanl\u0131 I\/O<\/p>\n<\/li>\n<li>\n<p>Handle.exe &rarr; Dosya kilidi tespiti<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1><strong>8. Bulgular\u0131n Raporlanmas\u0131<\/strong><\/h1>\n<p>Whitepaper i&ccedil;eri\u011fi kurum i&ccedil;i forensik ve hukuk ekipleri taraf\u0131ndan kullan\u0131labilir hale getirilmelidir.<\/p>\n<p>Rapor \u015fu b&ouml;l&uuml;mleri i&ccedil;ermelidir:<\/p>\n<ol>\n<li>\n<p><strong>&Ouml;zet<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Sald\u0131r\u0131 Zaman &Ccedil;izelgesi<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Bula\u015fma Y&ouml;ntemi<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Etkilenen Dosya Say\u0131s\u0131<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Etkilenen Kullan\u0131c\u0131lar<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Veri S\u0131z\u0131nt\u0131s\u0131 Bulgular\u0131<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>\u0130yile\u015ftirme &Ouml;nerileri<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Gelecek Sald\u0131r\u0131lara Kar\u015f\u0131 &Ouml;nlem Seti<\/strong><\/p>\n<\/li>\n<\/ol>\n<hr>\n<h1><strong>9. &Ouml;rnek Ransomware \u015eifreleme Ak\u0131\u015f Diyagram\u0131<\/strong><\/h1>\n<pre><code>[Initial Access]\n      &darr;\n[Payload Execution]\n      &darr;\n[Privilege Escalation]\n      &darr;\n[Shadow Copy Deletion]\n      &darr;\n[Mass File Enumeration]\n      &darr;\n[File Read &rarr; Encrypt &rarr; Write]\n      &darr;\n[File Rename (extension append)]\n      &darr;\n[Ransom Note Deployment]\n      &darr;\n[Optional: Data Exfiltration]\n<\/code><\/pre>\n<hr>\n<p>Bu whitepaper, ransomware sald\u0131r\u0131lar\u0131nda&nbsp;<strong>dosya eri\u015fim analizi<\/strong> i&ccedil;in profesyonel seviyede bir metodoloji sunmaktad\u0131r. MFT, USN Journal, Sysmon, SRUM ve EDR telemetry gibi birden fazla artefakt\u0131n korelasyonu sald\u0131r\u0131n\u0131n:<\/p>\n<ul>\n<li>\n<p>Etki alan\u0131n\u0131n,<\/p>\n<\/li>\n<li>\n<p>Zincirinin,<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131lan ara&ccedil;lar\u0131n,<\/p>\n<\/li>\n<li>\n<p>Sald\u0131rgan davran\u0131\u015f paterni,<\/p>\n<\/li>\n<li>\n<p>Veri kayb\u0131 seviyesinin<\/p>\n<\/li>\n<\/ul>\n<p>tam olarak anla\u015f\u0131lmas\u0131n\u0131 sa\u011flar.<\/p>\n<p>Bu analiz, olaya m&uuml;dahale ekiplerinin hem teknik hem de reg&uuml;lasyon uyumlu bir m&uuml;dahale yapabilmesi i&ccedil;in kritik &ouml;nemdedir.<\/p>\n<hr>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>","excerpt":"Ransomware sald\u0131r\u0131lar\u0131 g\u00fcn\u00fcm\u00fczde kurumlar\u0131n kar\u015f\u0131la\u015ft\u0131\u011f\u0131 en kritik tehditlerin ba\u015f\u0131nda geliyor. Modern fidye yaz\u0131l\u0131mlar\u0131 yaln\u0131zca verileri \u015fifrelemekle kalm\u0131yor; ayn\u0131 zamanda dosya sisteminde ola\u011fan d\u0131\u015f\u0131 bir aktivite b\u0131rakarak izlerini de saklamaya \u00e7al\u0131\u015f\u0131yor.","created_at":"2025-12-03 18:32:07","updated_at":"2026-09-23 14:12:18","category_id":7,"view_count":603,"reading_time":12,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-12-03 15:32:00","featured_image":"db630c443d86206b0661160a894eb1d5.png","slug":"ransomware-incelemelerinde-dosya-erisim-analizi-nasil-yapilir","category_name":"Cyber Security","category_slug":"cyber-security","category_color":"#10b981"}]