[{"id":362,"title":"Ransomware \u0130ncelemelerinde Dosya Eri\u015fim Analizi Nas\u0131l Yap\u0131l\u0131r?","content":"<p>Ransomware sald\u0131r\u0131lar\u0131 g&uuml;n&uuml;m&uuml;zde kurumlar\u0131n kar\u015f\u0131la\u015ft\u0131\u011f\u0131 en kritik tehditlerin ba\u015f\u0131nda geliyor. Modern fidye yaz\u0131l\u0131mlar\u0131 yaln\u0131zca verileri \u015fifrelemekle kalm\u0131yor; ayn\u0131 zamanda dosya sisteminde ola\u011fan d\u0131\u015f\u0131 bir aktivite b\u0131rakarak izlerini de saklamaya &ccedil;al\u0131\u015f\u0131yor. Bu nedenle bir ransomware vakas\u0131nda&nbsp;<strong>dosya eri\u015fim analizi (File Access Analysis)<\/strong>, sald\u0131r\u0131n\u0131n yay\u0131l\u0131m\u0131n\u0131 anlamak ve etki alan\u0131n\u0131 belirlemek i&ccedil;in en &ouml;nemli ad\u0131mlardan biridir.<\/p>\n<p>Bu yaz\u0131da, ransomware incelemelerinde dosya eri\u015fim analizinin nas\u0131l yap\u0131ld\u0131\u011f\u0131n\u0131, hangi ara&ccedil;lar\u0131n kullan\u0131ld\u0131\u011f\u0131n\u0131 ve ad\u0131m ad\u0131m uygulanabilir bir yakla\u015f\u0131m\u0131 ele alaca\u011f\u0131z.<\/p>\n<hr>\n<h2><iframe style=\"width: 704px; height: 395px;\" src=\"https:\/\/www.youtube.com\/embed\/m_NfVxUCm4E?si=M8daD8Ow4IvfppNs\" width=\"811\" height=\"455\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/h2>\n<h2>Dosya Eri\u015fim Analizi Nedir?<\/h2>\n<p>Dosya eri\u015fim analizi; bir sistemde ransomware taraf\u0131ndan eri\u015filen, de\u011fi\u015ftirilen, olu\u015fturulan veya silinen dosyalar\u0131n tespit edilmesini sa\u011flayan inceleme s&uuml;recidir. Bu analiz sayesinde:<\/p>\n<ul>\n<li>\n<p>Hangi dosyalar\u0131n \u015fifrelendi\u011fi,<\/p>\n<\/li>\n<li>\n<p>Hangi klas&ouml;rlerin hedef al\u0131nd\u0131\u011f\u0131,<\/p>\n<\/li>\n<li>\n<p>Sald\u0131r\u0131n\u0131n ne zaman ba\u015flad\u0131\u011f\u0131,<\/p>\n<\/li>\n<li>\n<p>Hangi kullan\u0131c\u0131 veya i\u015flem taraf\u0131ndan tetiklendi\u011fi,<\/p>\n<\/li>\n<li>\n<p>Yan etkilerin (data exfiltration, dosya &ccedil;al\u0131nmas\u0131 vb.) olup olmad\u0131\u011f\u0131<\/p>\n<\/li>\n<\/ul>\n<p>gibi kritik bilgiler elde edilir.<\/p>\n<hr>\n<h1>1. Ad\u0131m: Log Kaynaklar\u0131n\u0131n Belirlenmesi<\/h1>\n<p>Ransomware incelemelerinde en &ouml;nemli nokta, do\u011fru log kaynaklar\u0131n\u0131 toplamakt\u0131r. Dosya eri\u015fim analizi i&ccedil;in genellikle \u015fu kaynaklar incelenir:<\/p>\n<h3>\u2714 Windows Event Logs<\/h3>\n<ul>\n<li>\n<p><strong>Security Logs (Event ID 4663, 4656)<\/strong><br>Dosya eri\u015fimi, izinsiz de\u011fi\u015fiklikler, handle a&ccedil;ma gibi aktiviteler burada g&ouml;r&uuml;l&uuml;r.<\/p>\n<\/li>\n<li>\n<p><strong>Sysmon Logs (Event ID 1, 11, 13)<\/strong><\/p>\n<ul>\n<li>\n<p>Process creation<\/p>\n<\/li>\n<li>\n<p>File creation time change<\/p>\n<\/li>\n<li>\n<p>Registry modification<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Sysmon etkinse analiz &ccedil;ok daha kolay olur.<\/p>\n<h3>\u2714 NTFS MFT (Master File Table)<\/h3>\n<ul>\n<li>\n<p>Dosya olu\u015fturma, yeniden adland\u0131rma, silme gibi t&uuml;m olaylar\u0131n d&uuml;\u015f&uuml;k seviyede kaydedildi\u011fi yerdir.<\/p>\n<\/li>\n<li>\n<p>Ransomware'ler MFT &uuml;zerinde iz b\u0131rak\u0131r.<\/p>\n<\/li>\n<\/ul>\n<h3>\u2714 USN Journal<\/h3>\n<ul>\n<li>\n<p>Dosya de\u011fi\u015fikliklerinin neredeyse ger&ccedil;ek zamanl\u0131 kayd\u0131<\/p>\n<\/li>\n<li>\n<p>\u015eifreleme i\u015flemleri milyonlarca sat\u0131r log &uuml;retir<\/p>\n<\/li>\n<\/ul>\n<h3>\u2714 Antivirus \/ EDR Loglar\u0131<\/h3>\n<ul>\n<li>\n<p>Impacted files<\/p>\n<\/li>\n<li>\n<p>Blocked actions<\/p>\n<\/li>\n<li>\n<p>Quarantine kay\u0131tlar\u0131<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1>2. Ad\u0131m: Sald\u0131r\u0131n\u0131n Zaman Aral\u0131\u011f\u0131n\u0131 Belirleme<\/h1>\n<p>Dosya eri\u015fim analizine ba\u015flamadan &ouml;nce sald\u0131r\u0131n\u0131n zaman &ccedil;izelgesi &ccedil;\u0131kar\u0131l\u0131r:<\/p>\n<ul>\n<li>\n<p>\u0130lk \u015fifrelenen dosya zaman\u0131<\/p>\n<\/li>\n<li>\n<p>Ransom note olu\u015fturulma zaman\u0131<\/p>\n<\/li>\n<li>\n<p>\u015e&uuml;pheli s&uuml;re&ccedil; ba\u015flang\u0131c\u0131 (Sysmon Event ID 1)<\/p>\n<\/li>\n<li>\n<p>Volume Shadow Copy silme komutlar\u0131 (wmic, vssadmin)<\/p>\n<\/li>\n<\/ul>\n<p>Bu zaman aral\u0131\u011f\u0131 daralt\u0131l\u0131r ve t&uuml;m analiz bu timeframe &uuml;zerinde yap\u0131l\u0131r.<\/p>\n<hr>\n<h1>3. Ad\u0131m: Dosya Eri\u015fim &Ouml;r&uuml;nt&uuml;lerinin Tespiti<\/h1>\n<p>Ransomware karakteristik dosya eri\u015fim davran\u0131\u015flar\u0131 sergiler:<\/p>\n<h3>\ud83d\udccc Anormal Dosya Olu\u015fturma<\/h3>\n<ul>\n<li>\n<p>ayn\u0131 anda y&uuml;zlerce dosyan\u0131n yeniden adland\u0131r\u0131lmas\u0131 (file.ext &rarr; file.ext.locked)<\/p>\n<\/li>\n<li>\n<p>.README.txt, <em>R3ADME<\/em>.html gibi not dosyalar\u0131<\/p>\n<\/li>\n<\/ul>\n<h3>\ud83d\udccc Uzant\u0131 De\u011fi\u015fiklikleri<\/h3>\n<ul>\n<li>\n<p>AES \u015fifreleme sonras\u0131 yeni bir uzant\u0131 eklenmesi (.dark, .encrypted vb.)<\/p>\n<\/li>\n<\/ul>\n<h3>\ud83d\udccc Y&uuml;ksek I\/O Aktivitesi<\/h3>\n<ul>\n<li>\n<p>K\u0131sa s&uuml;rede binlerce dosya olu\u015fturma\/silme<\/p>\n<\/li>\n<li>\n<p>Sysinternals Process Monitor ile kolayca tespit edilir<\/p>\n<\/li>\n<\/ul>\n<h3>\ud83d\udccc Dosya Metadata Manip&uuml;lasyonu<\/h3>\n<ul>\n<li>\n<p>CreationTime \/ ModifiedTime de\u011fi\u015ftirmeleri<\/p>\n<\/li>\n<li>\n<p>Sysmon Event ID 2 \/ 11 ile tespit edilebilir<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1>4. Ad\u0131m: USN Journal Analizi<\/h1>\n<p>Ransomware davran\u0131\u015f\u0131n\u0131 en net g&ouml;steren alanlardan biri <strong>USN Journal<\/strong>&rsquo;d\u0131r. &Ccedil;&uuml;nk&uuml; \u015fifreleme s\u0131ras\u0131nda y&uuml;zlerce:<\/p>\n<ul>\n<li>\n<p><code>USN_REASON_DATA_TRUNCATION<\/code><\/p>\n<\/li>\n<li>\n<p><code>USN_REASON_FILE_CREATE<\/code><\/p>\n<\/li>\n<li>\n<p><code>USN_REASON_RENAME_OLD_NAME<\/code><\/p>\n<\/li>\n<li>\n<p><code>USN_REASON_RENAME_NEW_NAME<\/code><\/p>\n<\/li>\n<\/ul>\n<p>olay\u0131 g&ouml;r&uuml;n&uuml;r.<\/p>\n<h3>Kullan\u0131lan Ara&ccedil;lar:<\/h3>\n<ul>\n<li>\n<p><strong>AnalyzeMFT<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>MFTECmd (Eric Zimmerman)<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>UsnJrnl2Csv<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Velociraptor Forensics<\/strong><\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1>5. Ad\u0131m: MFT Analizi<\/h1>\n<p>MFT analizi ile:<\/p>\n<ul>\n<li>\n<p>\u015eifrelenen dosyalar\u0131n tam listesi<\/p>\n<\/li>\n<li>\n<p>Ransomware&rsquo;in olu\u015fturdu\u011fu ge&ccedil;ici dosyalar<\/p>\n<\/li>\n<li>\n<p>Silinmi\u015f fakat h&acirc;l&acirc; referans\u0131 bulunan dosyalar<\/p>\n<\/li>\n<li>\n<p>Yo\u011fun eri\u015fim yap\u0131lan dizinler<\/p>\n<\/li>\n<\/ul>\n<p>gibi bilgiler &ccedil;\u0131kar\u0131labilir.<\/p>\n<h3>Komut:<\/h3>\n<pre><code>MFTECmd.exe -f $MFT --csv .\\output\\\n<\/code><\/pre>\n<hr>\n<h1>6. Ad\u0131m: S&uuml;re&ccedil; (Process) Tespiti<\/h1>\n<p>Dosya eri\u015fimlerinin arkas\u0131nda hangi i\u015flem var?<\/p>\n<p>Bunu bulmak i&ccedil;in a\u015fa\u011f\u0131daki kaynaklar incelenir:<\/p>\n<h3>\u2714 Sysmon - Event ID 1 (Process Create)<\/h3>\n<ul>\n<li>\n<p>\u015e&uuml;pheli EXE dosyalar\u0131<\/p>\n<\/li>\n<li>\n<p>Temp, AppData, Roaming alt\u0131ndan &ccedil;al\u0131\u015fan uygulamalar<\/p>\n<\/li>\n<li>\n<p>Powershell, cmd, wscript &ccedil;a\u011fr\u0131lar\u0131<\/p>\n<\/li>\n<\/ul>\n<h3>\u2714 Handle Analizi (Ransomware o an &ccedil;al\u0131\u015f\u0131yorsa)<\/h3>\n<ul>\n<li>\n<p>Sysinternals <strong>handle.exe<\/strong><\/p>\n<\/li>\n<li>\n<p>Hangi proses hangi dosyalar\u0131 kilitliyor?<\/p>\n<\/li>\n<\/ul>\n<h3>\u2714 Parent-Child Chain<\/h3>\n<p>&Ouml;rnek k&ouml;t&uuml; zincir:<\/p>\n<pre><code>outlook.exe &rarr; winword.exe &rarr; powershell.exe &rarr; payload.exe\n<\/code><\/pre>\n<hr>\n<h1>7. Ad\u0131m: Etkilenen Dosyalar\u0131n Haritalanmas\u0131<\/h1>\n<p>Toplanan t&uuml;m log kaynaklar\u0131 birle\u015ftirilerek:<\/p>\n<ul>\n<li>\n<p>Etkilenen dizinler<\/p>\n<\/li>\n<li>\n<p>\u015eifrelenen dosya say\u0131s\u0131<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131c\u0131 bazl\u0131 eri\u015fim<\/p>\n<\/li>\n<li>\n<p>Dosya boyutu de\u011fi\u015fimi<\/p>\n<\/li>\n<li>\n<p>En son eri\u015fim zamanlar\u0131<\/p>\n<\/li>\n<\/ul>\n<p>gibi bilgiler bir rapor haline getirilir.<\/p>\n<h3>&Ouml;rnek CSV &Ccedil;\u0131kt\u0131s\u0131:<\/h3>\n<table>\n<thead>\n<tr>\n<th>Dosya<\/th>\n<th>Eski Ad<\/th>\n<th>Yeni Ad<\/th>\n<th>Son Eri\u015fim<\/th>\n<th>\u0130\u015flem<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>C:\\data\\report.xlsx<\/td>\n<td>report.xlsx<\/td>\n<td>report.xlsx.locked<\/td>\n<td>12:41<\/td>\n<td>Rename + Write<\/td>\n<\/tr>\n<tr>\n<td>C:\\data\\finances.db<\/td>\n<td>finances.db<\/td>\n<td>finances.db.enc<\/td>\n<td>12:42<\/td>\n<td>Overwrite<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h1>8. Ad\u0131m: Data Exfiltration Kontrol&uuml; (Varsa)<\/h1>\n<p>Baz\u0131 modern ransomware gruplar\u0131 &ouml;nce <strong>verileri &ccedil;alar<\/strong>, sonra \u015fifreleme yapar.<\/p>\n<p>\u015eu kaynaklara bak\u0131l\u0131r:<\/p>\n<ul>\n<li>\n<p>Powershell Invoke-WebRequest kay\u0131tlar\u0131<\/p>\n<\/li>\n<li>\n<p>Browser download\/upload ge&ccedil;mi\u015fi<\/p>\n<\/li>\n<li>\n<p>Cloud depolama istemcileri (Mega, Dropbox CLI)<\/p>\n<\/li>\n<li>\n<p>SMB transfer loglar\u0131<\/p>\n<\/li>\n<li>\n<p>WinRar \/ 7zip ile b&uuml;y&uuml;k ar\u015fiv olu\u015fturma loglar\u0131<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1>9. Ad\u0131m: Otomatikle\u015ftirilmi\u015f Ara&ccedil;lar<\/h1>\n<h3>\ud83d\udd27 Eric Zimmerman Tools<\/h3>\n<ul>\n<li>\n<p>MFTECmd<\/p>\n<\/li>\n<li>\n<p>SrumECmd<\/p>\n<\/li>\n<li>\n<p>EvtxECmd<\/p>\n<\/li>\n<li>\n<p>UsnJrnl2Csv<\/p>\n<\/li>\n<\/ul>\n<h3>\ud83d\udd27 Velociraptor<\/h3>\n<ul>\n<li>\n<p>Ransomware IOC templatelar\u0131<\/p>\n<\/li>\n<li>\n<p>USN\/MFT Collector<\/p>\n<\/li>\n<\/ul>\n<h3>\ud83d\udd27 KAPE<\/h3>\n<p>H\u0131zl\u0131 triage i&ccedil;in ideal.<\/p>\n<hr>\n<p>Ransomware incelemelerinde dosya eri\u015fim analizi, sald\u0131r\u0131n\u0131n etkisini ortaya &ccedil;\u0131karmak i&ccedil;in kritik &ouml;neme sahiptir. Log kaynaklar\u0131n\u0131n toplanmas\u0131, MFT\/USN journal analizi, process takibi ve zaman &ccedil;izelgesi olu\u015fturulmas\u0131 sayesinde:<\/p>\n<ul>\n<li>\n<p>Etkilenen dosyalar<\/p>\n<\/li>\n<li>\n<p>Sald\u0131r\u0131 zinciri<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131lan ara&ccedil;lar<\/p>\n<\/li>\n<li>\n<p>Sald\u0131r\u0131n\u0131n ba\u015flang\u0131&ccedil; zaman\u0131<\/p>\n<\/li>\n<\/ul>\n<p>net bi&ccedil;imde tespit edilir.<\/p>\n<p>Bu analizler yaln\u0131zca olay m&uuml;dahale ekipleri i&ccedil;in de\u011fil, ayn\u0131 zamanda gelecekte benzer sald\u0131r\u0131lar\u0131 &ouml;nlemek isteyen kurumlar i&ccedil;in de b&uuml;y&uuml;k de\u011ferlidir.<\/p>\n<p>&nbsp;<\/p>\n<h1><strong>WHITEPAPER<\/strong><\/h1>\n<h2><strong>Ransomware \u0130ncelemelerinde Dosya Eri\u015fim Analizi<\/strong><\/h2>\n<h3><em>Tehdit Av\u0131, Adli Bili\u015fim ve Olay M&uuml;dahale Perspektifi<\/em><\/h3>\n<hr>\n<h3>&nbsp;<\/h3>\n<p>Ransomware, modern siber sald\u0131r\u0131 ekosisteminin en y\u0131k\u0131c\u0131 tehditlerinden biri h&acirc;line gelmi\u015ftir. Klasik \u015fifreleme odakl\u0131 varianlar yerini, &ccedil;ok a\u015famal\u0131 (multi-stage), veri s\u0131z\u0131nt\u0131l\u0131 (double\/triple extortion) fidye yaz\u0131l\u0131mlar\u0131na b\u0131rakm\u0131\u015ft\u0131r. Bu sald\u0131r\u0131lar yaln\u0131zca veri \u015fifrelemekle kalmaz; sistem &uuml;zerinde geni\u015f dosya eri\u015fim aktivitelerine ve belirgin bir artefakt yo\u011funlu\u011funa neden olur.<\/p>\n<p>Bu whitepaper, ransomware olay m&uuml;dahalesi s\u0131ras\u0131nda <strong>dosya eri\u015fim analizi (File Access Analysis)<\/strong> s&uuml;re&ccedil;lerinin teknik derinli\u011fini aktarmak amac\u0131yla haz\u0131rlanm\u0131\u015ft\u0131r. Analiz; NTFS meta verileri, Windows Event Logs, Sysmon kay\u0131tlar\u0131, USN Journal, MFT, SRUM ve EDR telemetry verileri &uuml;zerinden b&uuml;t&uuml;nle\u015fik bir y&ouml;ntem sunar.<\/p>\n<hr>\n<h1><strong>2. Dosya Eri\u015fim Analizinin Amac\u0131<\/strong><\/h1>\n<p>Dosya eri\u015fim analizi, ransomware sald\u0131r\u0131s\u0131n\u0131n:<\/p>\n<ul>\n<li>\n<p>Ba\u015flang\u0131&ccedil; noktas\u0131n\u0131<\/p>\n<\/li>\n<li>\n<p>Yay\u0131l\u0131m vekt&ouml;r&uuml;n&uuml;<\/p>\n<\/li>\n<li>\n<p>Hangi dosyalar\u0131n manip&uuml;le edildi\u011fini<\/p>\n<\/li>\n<li>\n<p>Hangi kullan\u0131c\u0131\/i\u015flem taraf\u0131ndan tetiklendi\u011fini<\/p>\n<\/li>\n<li>\n<p>Ne kadar veri \u015fifrelendi\u011fini<\/p>\n<\/li>\n<li>\n<p>Veri s\u0131z\u0131nt\u0131s\u0131 olup olmad\u0131\u011f\u0131n\u0131<\/p>\n<\/li>\n<li>\n<p>\u015eifreleme davran\u0131\u015f\u0131n\u0131n metodolojisini<\/p>\n<\/li>\n<\/ul>\n<p>tespit etmek i&ccedil;in uygulan\u0131r.<\/p>\n<p>Bu sayede hem sald\u0131r\u0131n\u0131n boyutu belirlenir hem de hukuki s&uuml;re&ccedil;lerde (SIGORTA, KVKK, GDPR) gerekli olan teknik kan\u0131tlar toplan\u0131r.<\/p>\n<hr>\n<h1><strong>3. Ransomware Dosya Manip&uuml;lasyon Davran\u0131\u015flar\u0131<\/strong><\/h1>\n<p>Ransomware'in dosya sisteminde b\u0131rakt\u0131\u011f\u0131 kal\u0131nt\u0131lar belirli bir paterne sahiptir.<\/p>\n<h3><strong>3.1. Y&uuml;ksek hacimli I\/O operasyonlar\u0131<\/strong><\/h3>\n<ul>\n<li>\n<p>K\u0131sa s&uuml;rede binlerce dosyaya eri\u015fim<\/p>\n<\/li>\n<li>\n<p>&Ccedil;ok say\u0131da <code>CreateFile<\/code>, <code>WriteFile<\/code>, <code>RenameFile<\/code>, <code>SetInformationFile<\/code><\/p>\n<\/li>\n<\/ul>\n<h3><strong>3.2. Uzant\u0131 de\u011fi\u015fikli\u011fi<\/strong><\/h3>\n<ul>\n<li>\n<p><code>*.docx<\/code> &rarr; <code>*.docx.locked<\/code><\/p>\n<\/li>\n<li>\n<p><code>*.pdf<\/code> &rarr; <code>*.encrypted<\/code><\/p>\n<\/li>\n<\/ul>\n<h3><strong>3.3. Metadata manip&uuml;lasyonu<\/strong><\/h3>\n<ul>\n<li>\n<p>CreationTime resetlenmesi<\/p>\n<\/li>\n<li>\n<p>LastWriteTime&rsquo;\u0131n ayn\u0131 saniyede ard\u0131\u015f\u0131k y&uuml;zlerce dosyada g&ouml;r&uuml;nmesi<\/p>\n<\/li>\n<\/ul>\n<h3><strong>3.4. Ransom note olu\u015fturma<\/strong><\/h3>\n<ul>\n<li>\n<p>Ayn\u0131 dizinlere y&uuml;zlerce <code>.txt<\/code> veya <code>.html<\/code> dosyas\u0131 d&uuml;\u015f&uuml;rme<\/p>\n<\/li>\n<li>\n<p>&Ccedil;oklu dizin traversesi<\/p>\n<\/li>\n<\/ul>\n<h3><strong>3.5. Shadow Copy silme<\/strong><\/h3>\n<pre><code>vssadmin delete shadows \/all \/quiet\nwmic shadowcopy delete\n<\/code><\/pre>\n<hr>\n<h1><strong>4. Analiz \u0130&ccedil;in Kullan\u0131lan Temel Kaynaklar<\/strong><\/h1>\n<p>Dosya eri\u015fim analizinin ba\u015far\u0131s\u0131, do\u011fru artefaktlar\u0131n toplanmas\u0131na ba\u011fl\u0131d\u0131r.<\/p>\n<h2><strong>4.1. Windows Event Logs<\/strong><\/h2>\n<h3><strong>Security.evtx<\/strong><\/h3>\n<ul>\n<li>\n<p><strong>4663<\/strong> &rarr; Dosya eri\u015fim denetimi<\/p>\n<\/li>\n<li>\n<p><strong>4656<\/strong> &rarr; Handle a&ccedil;ma giri\u015fimi<\/p>\n<\/li>\n<li>\n<p><strong>4670<\/strong> &rarr; ACL de\u011fi\u015fikli\u011fi<\/p>\n<\/li>\n<li>\n<p><strong>5145<\/strong> &rarr; SMB &uuml;zerinden dosya eri\u015fimi<\/p>\n<\/li>\n<\/ul>\n<h3><strong>Sysmon.evtx<\/strong><\/h3>\n<ul>\n<li>\n<p><strong>1<\/strong> &rarr; Process Create<\/p>\n<\/li>\n<li>\n<p><strong>11<\/strong> &rarr; File Create<\/p>\n<\/li>\n<li>\n<p><strong>13<\/strong> &rarr; Registry Set<\/p>\n<\/li>\n<li>\n<p><strong>2, 17, 18<\/strong> &rarr; Dosya time-stamp manip&uuml;lasyonu<\/p>\n<\/li>\n<li>\n<p><strong>7<\/strong> &rarr; Image Load (crypto library y&uuml;klemeleri)<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2><strong>4.2. NTFS Artefaktlar\u0131<\/strong><\/h2>\n<h3><strong>4.2.1. MFT ($MFT)<\/strong><\/h3>\n<p>Ransomware faaliyetinin en g&uuml;venilir kan\u0131t\u0131d\u0131r.<\/p>\n<p>Tespit edilebilir:<\/p>\n<ul>\n<li>\n<p>\u015eifrelenen t&uuml;m dosyalar<\/p>\n<\/li>\n<li>\n<p>Silinen ancak iz b\u0131rakan dosya kay\u0131tlar\u0131<\/p>\n<\/li>\n<li>\n<p>Yo\u011fun rename operasyonlar\u0131<\/p>\n<\/li>\n<li>\n<p>Ransom note da\u011f\u0131l\u0131m\u0131<\/p>\n<\/li>\n<\/ul>\n<h3><strong>4.2.2. USN Journal ($UsnJrnl:$J)<\/strong><\/h3>\n<p>Ransomware \u015fifreleme s\u0131ras\u0131nda tipik olarak milyonlarca sat\u0131r aktivite &uuml;retir.<\/p>\n<p>&Ouml;ne &ccedil;\u0131kan USN reason kodlar\u0131:<\/p>\n<ul>\n<li>\n<p><code>0x00000020<\/code> &ndash; File Create<\/p>\n<\/li>\n<li>\n<p><code>0x00000002<\/code> &ndash; Data Overwrite<\/p>\n<\/li>\n<li>\n<p><code>0x00001000<\/code> &ndash; Rename Old Name<\/p>\n<\/li>\n<li>\n<p><code>0x00002000<\/code> &ndash; Rename New Name<\/p>\n<\/li>\n<\/ul>\n<h3><strong>4.2.3. $LogFile<\/strong><\/h3>\n<ul>\n<li>\n<p>Transaction-based kay\u0131t<\/p>\n<\/li>\n<li>\n<p>Ani dosya de\u011fi\u015fiklik paternleri (I\/O spike)<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2><strong>4.3. SRUM (System Resource Usage Monitor)<\/strong><\/h2>\n<ul>\n<li>\n<p>S&uuml;recin ne kadar I\/O t&uuml;ketti\u011fini<\/p>\n<\/li>\n<li>\n<p>Hangi saatlerde yo\u011fun i\u015flem ger&ccedil;ekle\u015ftirdi\u011fini<\/p>\n<\/li>\n<\/ul>\n<p>g&ouml;sterir.<\/p>\n<hr>\n<h2><strong>4.4. EDR Telemetry<\/strong><\/h2>\n<p>Kurumsal yap\u0131larda en kritik kaynak:<\/p>\n<ul>\n<li>\n<p>File write events<\/p>\n<\/li>\n<li>\n<p>File rename events<\/p>\n<\/li>\n<li>\n<p>Process ancestry<\/p>\n<\/li>\n<li>\n<p>Injection teknikleri<\/p>\n<\/li>\n<li>\n<p>Network exfiltration<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1><strong>5. Dosya Eri\u015fim Analiz Metodolojisi<\/strong><\/h1>\n<p>Bu b&ouml;l&uuml;m DFIR ekiplerinin kulland\u0131\u011f\u0131 tam metodolojik yakla\u015f\u0131m\u0131 i&ccedil;erir.<\/p>\n<hr>\n<h2><strong>5.1. Zaman &Ccedil;izelgesi (Timeline) Olu\u015fturma<\/strong><\/h2>\n<p>En kritik ad\u0131m <strong>attack window<\/strong>'u belirlemektir.<\/p>\n<p>Zaman aral\u0131\u011f\u0131 \u015fu artefaktlarla belirlenir:<\/p>\n<ul>\n<li>\n<p>\u0130lk \u015fifrelenen dosyan\u0131n <code>MFT LastWriteTime<\/code> bilgisi<\/p>\n<\/li>\n<li>\n<p>\u0130lk ransom note olu\u015fturulma zaman\u0131<\/p>\n<\/li>\n<li>\n<p>Sysmon Process Create (event ID 1) &ndash; Payload ba\u015flatma<\/p>\n<\/li>\n<li>\n<p>SRUM I\/O spike ba\u015flang\u0131c\u0131<\/p>\n<\/li>\n<li>\n<p>EDR taraf\u0131ndan bloklanan ilk event<\/p>\n<\/li>\n<\/ul>\n<p><strong>Ama&ccedil;:<\/strong> Analizi milyonlarca logtan yaln\u0131zca sald\u0131r\u0131 aral\u0131\u011f\u0131na indirgemek.<\/p>\n<hr>\n<h2><strong>5.2. S&uuml;re&ccedil; (Process Tree) Analizi<\/strong><\/h2>\n<h3>&Ouml;rnek malicious zincir:<\/h3>\n<pre><code>outlook.exe\n  \u2514\u2500\u2500 winword.exe\n         \u2514\u2500\u2500 powershell.exe\n               \u2514\u2500\u2500 payload.exe\n<\/code><\/pre>\n<p>\u0130ncelenecekler:<\/p>\n<ul>\n<li>\n<p>Parent PID<\/p>\n<\/li>\n<li>\n<p>Komut sat\u0131r\u0131 arg&uuml;manlar\u0131<\/p>\n<\/li>\n<li>\n<p>Signed\/unsigned binary kontrol&uuml;<\/p>\n<\/li>\n<li>\n<p>Image path (AppData\\Roaming yayg\u0131n)<\/p>\n<\/li>\n<li>\n<p>Masquerading (svch0st.exe gibi)<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2><strong>5.3. Dosya Manip&uuml;lasyon Haritas\u0131<\/strong><\/h2>\n<h3>3 temel metot uygulan\u0131r:<\/h3>\n<ol>\n<li>\n<p><strong>USN Journal diffs<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>MFT Entry Correlation<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>LastWriteTime s\u0131ralamas\u0131<\/strong><\/p>\n<\/li>\n<\/ol>\n<p>Bu sayede:<\/p>\n<ul>\n<li>\n<p>Ka&ccedil; dosya \u015fifrelendi?<\/p>\n<\/li>\n<li>\n<p>Hangi klas&ouml;rler etkilendi?<\/p>\n<\/li>\n<li>\n<p>Hangi kullan\u0131c\u0131 tokeni kullan\u0131ld\u0131?<\/p>\n<\/li>\n<li>\n<p>Eri\u015fim yo\u011funlu\u011fu hangi drive&rsquo;da?<\/p>\n<\/li>\n<\/ul>\n<p>net olarak &ccedil;\u0131kar.<\/p>\n<hr>\n<h2><strong>5.4. Output Normalizasyon<\/strong><\/h2>\n<p>Toplanan ham veriler CSV\/JSON format\u0131na normalize edilir.<\/p>\n<h3>&Ouml;rnek olay &ccedil;\u0131kt\u0131s\u0131:<\/h3>\n<table>\n<thead>\n<tr>\n<th>Path<\/th>\n<th>Operation<\/th>\n<th>Old Name<\/th>\n<th>New Name<\/th>\n<th>Process<\/th>\n<th>Timestamp<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>C:\\Share\\finance.xlsx<\/td>\n<td>Rename<\/td>\n<td>finance.xlsx<\/td>\n<td>finance.xlsx.enc<\/td>\n<td>payload.exe<\/td>\n<td>2025-01-12 12:41<\/td>\n<\/tr>\n<tr>\n<td>C:\\Share\\db.db<\/td>\n<td>Data Overwrite<\/td>\n<td>-<\/td>\n<td>-<\/td>\n<td>payload.exe<\/td>\n<td>2025-01-12 12:42<\/td>\n<\/tr>\n<tr>\n<td>C:\\Share\\READ_ME.txt<\/td>\n<td>Create<\/td>\n<td>-<\/td>\n<td>-<\/td>\n<td>payload.exe<\/td>\n<td>2025-01-12 12:43<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h1><strong>6. Veri S\u0131z\u0131nt\u0131s\u0131 (Exfiltration) Analizi<\/strong><\/h1>\n<p>Modern ransomware gruplar\u0131n\u0131n %84&rsquo;&uuml;* veriyi \u015fifrelemeden &ouml;nce &ccedil;alar.<\/p>\n<p>Kontrol edilmesi gerekenler:<\/p>\n<h3><strong>6.1. Network Artefaktlar\u0131<\/strong><\/h3>\n<ul>\n<li>\n<p>Powershell upload komutlar\u0131<\/p>\n<\/li>\n<li>\n<p>Cloud API &ccedil;a\u011fr\u0131lar\u0131<\/p>\n<\/li>\n<li>\n<p>TLS &uuml;zerinden b&uuml;y&uuml;k outbound trafik<\/p>\n<\/li>\n<li>\n<p>C2 ileti\u015fimi (HTTP POST \/ chunked transfer)<\/p>\n<\/li>\n<\/ul>\n<h3><strong>6.2. Ar\u015fivleme G&ouml;stergeleri<\/strong><\/h3>\n<p>Dosya eri\u015fim analizi ile birle\u015fti\u011finde tespit edilir:<\/p>\n<ul>\n<li>\n<p><code>winrar.exe<\/code> &ccedil;al\u0131\u015ft\u0131rma<\/p>\n<\/li>\n<li>\n<p><code>7z.exe a archive.7z<\/code><\/p>\n<\/li>\n<li>\n<p>&Ccedil;ok b&uuml;y&uuml;k boyutlu ge&ccedil;ici dosya olu\u015fumu (&ldquo;collection artifact&rdquo;)<\/p>\n<\/li>\n<\/ul>\n<h3><strong>6.3. SMB Transferleri<\/strong><\/h3>\n<p>Event ID 5145 &uuml;zerinden:<\/p>\n<ul>\n<li>\n<p>Ba\u015fka bir makineye b&uuml;y&uuml;k dosya kopyalama<\/p>\n<\/li>\n<li>\n<p>Y&uuml;ksek hacimli &ldquo;Read&rdquo; operasyonlar\u0131<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1><strong>7. Ara&ccedil;lar ve Otomasyon<\/strong><\/h1>\n<h2><strong>7.1. Eric Zimmerman Tools<\/strong><\/h2>\n<ul>\n<li>\n<p><strong>MFTECmd.exe<\/strong> &rarr; MFT analizi<\/p>\n<\/li>\n<li>\n<p><strong>UsnJrnl2Csv.exe<\/strong> &rarr; USN analizi<\/p>\n<\/li>\n<li>\n<p><strong>SrumECmd.exe<\/strong> &rarr; I\/O activity<\/p>\n<\/li>\n<li>\n<p><strong>EvtxECmd.exe<\/strong> &rarr; Event log parsing<\/p>\n<\/li>\n<\/ul>\n<h2><strong>7.2. Velociraptor<\/strong><\/h2>\n<ul>\n<li>\n<p>Ransomware IOC pack<\/p>\n<\/li>\n<li>\n<p>Live forensic acquisition<\/p>\n<\/li>\n<li>\n<p>USN\/MFT real-time timeline &ccedil;\u0131karma<\/p>\n<\/li>\n<\/ul>\n<h2><strong>7.3. KAPE (Triage Arac\u0131)<\/strong><\/h2>\n<ul>\n<li>\n<p>Minimal zamanda gerekli t&uuml;m artefaktlar\u0131 toplar<\/p>\n<\/li>\n<\/ul>\n<h2><strong>7.4. Sysinternals Tools<\/strong><\/h2>\n<ul>\n<li>\n<p>Procmon &rarr; Ger&ccedil;ek zamanl\u0131 I\/O<\/p>\n<\/li>\n<li>\n<p>Handle.exe &rarr; Dosya kilidi tespiti<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h1><strong>8. Bulgular\u0131n Raporlanmas\u0131<\/strong><\/h1>\n<p>Whitepaper i&ccedil;eri\u011fi kurum i&ccedil;i forensik ve hukuk ekipleri taraf\u0131ndan kullan\u0131labilir hale getirilmelidir.<\/p>\n<p>Rapor \u015fu b&ouml;l&uuml;mleri i&ccedil;ermelidir:<\/p>\n<ol>\n<li>\n<p><strong>&Ouml;zet<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Sald\u0131r\u0131 Zaman &Ccedil;izelgesi<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Bula\u015fma Y&ouml;ntemi<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Etkilenen Dosya Say\u0131s\u0131<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Etkilenen Kullan\u0131c\u0131lar<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Veri S\u0131z\u0131nt\u0131s\u0131 Bulgular\u0131<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>\u0130yile\u015ftirme &Ouml;nerileri<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Gelecek Sald\u0131r\u0131lara Kar\u015f\u0131 &Ouml;nlem Seti<\/strong><\/p>\n<\/li>\n<\/ol>\n<hr>\n<h1><strong>9. &Ouml;rnek Ransomware \u015eifreleme Ak\u0131\u015f Diyagram\u0131<\/strong><\/h1>\n<pre><code>[Initial Access]\n      &darr;\n[Payload Execution]\n      &darr;\n[Privilege Escalation]\n      &darr;\n[Shadow Copy Deletion]\n      &darr;\n[Mass File Enumeration]\n      &darr;\n[File Read &rarr; Encrypt &rarr; Write]\n      &darr;\n[File Rename (extension append)]\n      &darr;\n[Ransom Note Deployment]\n      &darr;\n[Optional: Data Exfiltration]\n<\/code><\/pre>\n<hr>\n<p>Bu whitepaper, ransomware sald\u0131r\u0131lar\u0131nda&nbsp;<strong>dosya eri\u015fim analizi<\/strong> i&ccedil;in profesyonel seviyede bir metodoloji sunmaktad\u0131r. MFT, USN Journal, Sysmon, SRUM ve EDR telemetry gibi birden fazla artefakt\u0131n korelasyonu sald\u0131r\u0131n\u0131n:<\/p>\n<ul>\n<li>\n<p>Etki alan\u0131n\u0131n,<\/p>\n<\/li>\n<li>\n<p>Zincirinin,<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131lan ara&ccedil;lar\u0131n,<\/p>\n<\/li>\n<li>\n<p>Sald\u0131rgan davran\u0131\u015f paterni,<\/p>\n<\/li>\n<li>\n<p>Veri kayb\u0131 seviyesinin<\/p>\n<\/li>\n<\/ul>\n<p>tam olarak anla\u015f\u0131lmas\u0131n\u0131 sa\u011flar.<\/p>\n<p>Bu analiz, olaya m&uuml;dahale ekiplerinin hem teknik hem de reg&uuml;lasyon uyumlu bir m&uuml;dahale yapabilmesi i&ccedil;in kritik &ouml;nemdedir.<\/p>\n<hr>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>","excerpt":"Ransomware sald\u0131r\u0131lar\u0131 g\u00fcn\u00fcm\u00fczde kurumlar\u0131n kar\u015f\u0131la\u015ft\u0131\u011f\u0131 en kritik tehditlerin ba\u015f\u0131nda geliyor. Modern fidye yaz\u0131l\u0131mlar\u0131 yaln\u0131zca verileri \u015fifrelemekle kalm\u0131yor; ayn\u0131 zamanda dosya sisteminde ola\u011fan d\u0131\u015f\u0131 bir aktivite b\u0131rakarak izlerini de saklamaya \u00e7al\u0131\u015f\u0131yor.","created_at":"2025-12-03 18:32:07","updated_at":"2026-09-23 16:37:03","category_id":7,"view_count":604,"reading_time":12,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-12-03 15:32:00","featured_image":"db630c443d86206b0661160a894eb1d5.png","slug":"ransomware-incelemelerinde-dosya-erisim-analizi-nasil-yapilir","category_name":"Cyber Security","category_slug":"cyber-security","category_color":"#10b981"},{"id":170,"title":"Windows Server'da Dosya \u0130\u015flemlerini \u0130zleme ve Denetleme","content":"<h1>Windows Server'da Dosya \u0130\u015flemlerini \u0130zleme ve G&uuml;venlik Rehberi<\/h1>\r\n<p>Windows Server ortam\u0131nda dosya i\u015flemlerinin (silme, de\u011fi\u015ftirme, eri\u015fim vb.) izlenmesi, sistem g&uuml;venli\u011fi ve denetim s&uuml;re&ccedil;leri a&ccedil;\u0131s\u0131ndan kritik &ouml;neme sahiptir. Bu rehberde, sistem y&ouml;neticilerinin dosya i\u015flemlerini nas\u0131l etkin \u015fekilde izleyebilece\u011fini, hangi ara&ccedil;lar\u0131 kullanabilece\u011fini ve log analizlerini nas\u0131l ger&ccedil;ekle\u015ftirebilece\u011fini ad\u0131m ad\u0131m ele al\u0131yoruz.<\/p>\r\n<h2>1. Event Viewer Yap\u0131land\u0131rmas\u0131<\/h2>\r\n<h3>Event Viewer'\u0131 Etkin Kullanma<\/h3>\r\n<p>Event Viewer, Windows Server'da dosya eri\u015fim ve de\u011fi\u015fikliklerini izlemek i&ccedil;in kullan\u0131lan en temel ara&ccedil;lardan biridir. &Ouml;zellikle a\u015fa\u011f\u0131daki <strong>Event ID<\/strong> de\u011ferleri, dosya aktivitelerini yak\u0131ndan takip etmek i&ccedil;in kritik &ouml;neme sahiptir:<\/p>\r\n<ul>\r\n<li><strong>4663:<\/strong> Nesneye eri\u015fim denemeleri<\/li>\r\n<li><strong>4660:<\/strong> Nesne silme i\u015flemleri<\/li>\r\n<li><strong>4656:<\/strong> Nesneye eri\u015fim talepleri<\/li>\r\n<li><strong>4658:<\/strong> Nesneye eri\u015fim kapatma i\u015flemleri<\/li>\r\n<li><strong>4664:<\/strong> Nesne ba\u011flant\u0131lar\u0131 olu\u015fturma<\/li>\r\n<\/ul>\r\n<h3>Event Viewer'da Log Arama<\/h3>\r\n<ol>\r\n<li><code>Server Manager &gt; Tools &gt; Event Viewer<\/code> yolunu izleyin.<\/li>\r\n<li><code>Windows Logs &gt; Security<\/code> sekmesine gidin.<\/li>\r\n<li>Sa\u011f panelden <strong>Filter Current Log<\/strong> se&ccedil;ene\u011fini t\u0131klay\u0131n.<\/li>\r\n<li>Yukar\u0131daki Event ID&rsquo;leri girerek loglar\u0131 filtreleyin.<\/li>\r\n<\/ol>\r\n<h2>2. Audit Policy Yap\u0131land\u0131rmas\u0131<\/h2>\r\n<h3>Group Policy &Uuml;zerinden Audit Ayarlar\u0131<\/h3>\r\n<ol>\r\n<li>Group Policy Management Console&rsquo;u a&ccedil;\u0131n.<\/li>\r\n<li><code>Default Domain Policy<\/code> &uuml;zerine sa\u011f t\u0131klay\u0131n ve d&uuml;zenleyin.<\/li>\r\n<li><code>Computer Configuration &gt; Policies &gt; Windows Settings &gt; Security Settings &gt; Advanced Audit Policy Configuration<\/code> yolunu izleyin.<\/li>\r\n<li>A\u015fa\u011f\u0131daki politikalar\u0131 etkinle\u015ftirin:<\/li>\r\n<\/ol>\r\n<ul>\r\n<li>Object Access &gt; Audit File System<\/li>\r\n<li>Object Access &gt; Audit File Share<\/li>\r\n<li>Object Access &gt; Audit Handle Manipulation<\/li>\r\n<\/ul>\r\n<h3>PowerShell ile Audit Policy Yap\u0131land\u0131rma<\/h3>\r\n<pre><code class=\"language-powershell\">\r\n# T&uuml;m dosya sistemi eri\u015fimlerini izleme\r\nauditpol \/set \/category:\"Object Access\" \/success:enable \/failure:enable\r\n\r\n# Belirli bir kategoriyi sorgulama\r\nauditpol \/get \/category:\"Object Access\"\r\n<\/code><\/pre>\r\n<h2>3. File Server Resource Manager (FSRM) Kullan\u0131m\u0131<\/h2>\r\n<h3>FSRM Kurulumu<\/h3>\r\n<pre><code class=\"language-powershell\">\r\nInstall-WindowsFeature FS-Resource-Manager -IncludeManagementTools\r\n<\/code><\/pre>\r\n<h3>File Screening ve Storage Reports<\/h3>\r\n<ul>\r\n<li><strong>File Screening Management:<\/strong> Belirli dosya t&uuml;rlerini engelleyebilir ve bu eylemleri loglayabilirsiniz.<\/li>\r\n<li><strong>Storage Reports Management:<\/strong> Disk kullan\u0131m analizi, b&uuml;y&uuml;k dosya raporlar\u0131 ve kopya dosya tespiti yap\u0131labilir.<\/li>\r\n<\/ul>\r\n<h2>4. PowerShell ile Log Analizi<\/h2>\r\n<p>Dosya aktivitelerini analiz etmek i&ccedil;in PowerShell komutlar\u0131 olduk&ccedil;a etkilidir. &Ouml;rne\u011fin, son 24 saatte ger&ccedil;ekle\u015fen silme i\u015flemlerini listelemek veya belirli bir kullan\u0131c\u0131ya ait aktiviteleri g&ouml;rmek m&uuml;mk&uuml;nd&uuml;r:<\/p>\r\n<pre><code class=\"language-powershell\">\r\n# Son 24 saatteki silme i\u015flemlerini getir\r\nGet-WinEvent -FilterHashtable @{ LogName='Security'; ID=4663; StartTime=(Get-Date).AddDays(-1) } |\r\nWhere-Object {$_.Message -like \"*Delete*\"} |\r\nFormat-Table TimeCreated,ID,Message -Wrap\r\n\r\n# Belirli bir kullan\u0131c\u0131n\u0131n i\u015flemlerini izleme\r\nGet-WinEvent -FilterHashtable @{ LogName='Security'; ID=4663,4660 } |\r\nWhere-Object {$_.Message -like \"*UserName*\"} |\r\nSelect-Object TimeCreated,ID,Message\r\n<\/code><\/pre>\r\n<h2>5. Shadow Copy Yap\u0131land\u0131rmas\u0131<\/h2>\r\n<h3>Shadow Copy Etkinle\u015ftirme<\/h3>\r\n<pre><code class=\"language-powershell\">\r\n# Shadow Copy depolama alan\u0131 olu\u015fturma\r\nvssadmin add shadowstorage \/for=C: \/on=C: \/maxsize=10GB\r\n\r\n# G&uuml;nl&uuml;k Shadow Copy zamanlamas\u0131\r\nschtasks \/create \/tn \"Daily Shadow Copy\" \/tr \"wmic shadowcopy call create Volume='C:\\'\" \/sc daily \/st 00:00\r\n<\/code><\/pre>\r\n<h3>Shadow Copy Durumunu \u0130zleme<\/h3>\r\n<pre><code class=\"language-powershell\">\r\n# Mevcut Shadow Copy'leri listele\r\nvssadmin list shadows\r\n\r\n# Shadow Copy depolama alan\u0131 kullan\u0131m\u0131n\u0131 g&ouml;r&uuml;nt&uuml;le\r\nvssadmin list shadowstorage\r\n<\/code><\/pre>\r\n<p><strong>&Ouml;rnek &ccedil;\u0131kt\u0131:<\/strong><\/p>\r\n<pre>Used Shadow Copy Storage space: 0 bytes (0%)\r\nAllocated Shadow Copy Storage space: 0 bytes (0%)\r\nMaximum Shadow Copy Storage space: 19.9 GB (9%)\r\n<\/pre>\r\n<h2>6. \u0130yi Uygulama &Ouml;nerileri<\/h2>\r\n<ul>\r\n<li><strong>Log Rotasyonu:<\/strong> Loglar\u0131 d&uuml;zenli ar\u015fivleyin, s\u0131k\u0131\u015ft\u0131r\u0131n veya farkl\u0131 bir diske ta\u015f\u0131y\u0131n. Disk alan\u0131 y&ouml;netimini ihmal etmeyin.<\/li>\r\n<li><strong>Alarm Mekanizmas\u0131:<\/strong> Kritik dosya i\u015flemleri i&ccedil;in e-posta bildirimleri veya otomatik uyar\u0131 sistemleri olu\u015fturun.<\/li>\r\n<li><strong>Periyodik Raporlama:<\/strong> Haftal\u0131k veya ayl\u0131k dosya i\u015flem raporlar\u0131yla kullan\u0131c\u0131 aktivitelerini izleyin, anormal davran\u0131\u015flar\u0131 tespit edin.<\/li>\r\n<\/ul>\r\n<h2>Sonu&ccedil;<\/h2>\r\n<p>Windows Server'da dosya i\u015flemlerinin izlenmesi, g&uuml;venlik ve denetim politikalar\u0131n\u0131n merkezinde yer al\u0131r. Event Viewer, Audit Policy, FSRM ve PowerShell ara&ccedil;lar\u0131n\u0131 bir arada kullanarak sisteminizdeki dosya eri\u015fimlerini detayl\u0131 \u015fekilde takip edebilir, g&uuml;venlik ihlallerini erken a\u015famada tespit edebilirsiniz.<\/p>\r\n<p>D&uuml;zenli denetim, log analizi ve otomatik bildirim sistemleriyle kurumsal verilerinizi koruyabilir, yasal gereklilikleri eksiksiz yerine getirebilirsiniz.<\/p>","excerpt":"Windows Server'da dosya i\u015flemlerinin izlenmesi, sistem g\u00fcvenli\u011fi ve denetimi a\u00e7\u0131s\u0131ndan kritik \u00f6neme sahiptir. Bu yaz\u0131da bahsedilen y\u00f6ntemleri kullanarak, sisteminizde ger\u00e7ekle\u015fen t\u00fcm dosya i\u015flemlerini etkin bir \u015fekilde izleyebilir ve gerekti\u011finde m\u00fcdahale edebilirsiniz.\r\n\r\nD\u00fczenli kontroller ve raporlamalar yaparak, olas\u0131 g\u00fcvenlik ihlallerini erkenden tespit edebilir ve gerekli \u00f6nlemleri alabilirsiniz. Ayr\u0131ca, bu izleme mekanizmalar\u0131n\u0131 kurum politikalar\u0131n\u0131za ve yasal gerekliliklere uygun \u015fekilde yap\u0131land\u0131rman\u0131z \u00f6nemlidir.","created_at":"2025-02-06 17:11:34","updated_at":"2026-09-23 13:09:25","category_id":6,"view_count":773,"reading_time":3,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-02-06 17:11:34","featured_image":"resimyok.jpg","slug":"windows-server-da-dosya-islemlerini-izleme-ve-denetleme","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"}]