Zararli dasturlar va ularga qarshi kurash

# Shubhali jarayonlar
ps aux --sort=-%cpu | head -20

# Nomsiz yoki g'alati joydan ishlayotgan jarayonlar
ls -la /proc/*/exe 2>/dev/null | grep -E '(deleted|/tmp/|/dev/shm/)'

# Tarmoq ulanishlari
sudo ss -tunp state established

# Kutilmagan tinglash portlari
sudo ss -tulpn | grep -v -E ':(22|80|443|3306|6379) '

# Chiquvchi ulanishlar - buyruq serveriga
sudo ss -tunp | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head

# Doimiylik mexanizmlarini tekshirish
crontab -l
sudo crontab -l
ls -la /etc/cron.*/
cat /etc/crontab

systemctl list-units --type=service --state=running
ls -la /etc/systemd/system/

# Avtoyuklash
ls -la ~/.config/autostart/
cat ~/.bashrc ~/.profile | grep -E '(curl|wget|nc|bash -i)'

# SSH kalitlarini tekshirish
for uy in /home/* /root; do
    if [ -f "$uy/.ssh/authorized_keys" ]; then
        echo "=== $uy ==="
        cat "$uy/.ssh/authorized_keys"
    fi
done

// Odatiy veb qobiq belgilari - bunday kodni qidiring
<?php system($_GET['cmd']); ?>
<?php eval(base64_decode($_POST['x'])); ?>
<?php @assert($_REQUEST['a']); ?>
<?php $f='sys'.'tem'; $f($_GET['c']); ?>

# Veb-ildizda shubhali PHP fayllarni qidirish
grep -rn --include="*.php" -E \
    "(eval|assert|base64_decode|shell_exec|system|passthru|popen|proc_open)\s*\(" \
    /var/www/dokon/public/

# Yaqinda o'zgargan fayllar
find /var/www/dokon -name "*.php" -mtime -7 -ls

# Yuklamalar papkasidagi PHP fayllar - juda shubhali
find /var/www/dokon/public/yuklamalar -name "*.php*"

# Fayl yaxlitligini solishtirish
cd /var/www/dokon
git status --porcelain
git diff --stat

# Yuklamalar papkasida PHP bajarilishini taqiqlash
location ^~ /yuklamalar/ {
    location ~ \.php$ {
        deny all;
        return 403;
    }
}

# Fayl o'zgarishlarini kuzatish
sudo apt install inotify-tools

inotifywait -m -r /var/www/dokon --format '%T %w%f %e' \
    --timefmt '%F %T' -e modify,create,delete

// Ko'p fayl bir vaqtda o'zgarishini aniqlash
final class ShifrlashDetektori
{
    private const CHEGARA = 100;      // 1 daqiqada
    private const OYNA = 60;

    public function faylOzgardi(string $yol): void
    {
        $soni = $this->kesh->oshiring('fayl_ozgarish', self::OYNA);

        if ($soni > self::CHEGARA) {
            $this->ogohlantiruvchi->kritik('shifrlash_shubhasi', [
                'ozgargan_fayllar' => $soni,
                'oxirgi_fayl'      => $yol,
            ]);

            // Xizmatni to'xtatish - zararni cheklash
            $this->tizim->yozishniTaqiqlang();
        }
    }
}

# Zaxira nusxa - 3-2-1 qoidasi
# 3 nusxa, 2 xil qurilma, 1 tasi tashqarida va oflayn

# Zaxira serveri ilova serveridan kirishga ruxsat bermasin
# Aksincha: zaxira serveri o'zi ma'lumotni tortib olsin

#!/bin/bash
# Zaxira serverida ishga tushadi (tortib olish modeli)
set -euo pipefail

SANA=$(date +%F)
MANBA=dokon@10.0.1.15
ZAXIRA=/zaxira/dokon

# Faqat o'qish huquqi bilan ulanadi
rsync -az --delete \
    -e "ssh -i /root/.ssh/zaxira_kaliti" \
    "$MANBA:/var/www/dokon/storage/" \
    "$ZAXIRA/fayllar_$SANA/"

ssh -i /root/.ssh/zaxira_kaliti "$MANBA" \
    "mysqldump --single-transaction dokon | gzip" \
    > "$ZAXIRA/db_$SANA.sql.gz"

# O'zgartirilmaydigan saqlashga yuborish
aws s3 cp "$ZAXIRA/db_$SANA.sql.gz" \
    s3://dokon-zaxira/ \
    --storage-class GLACIER \
    --object-lock-mode COMPLIANCE \
    --object-lock-retain-until-date "$(date -d '+90 days' -Iseconds)"

# O'zgartirilmaydigan saqlash (S3 Object Lock)
aws s3api put-object-lock-configuration \
    --bucket dokon-zaxira \
    --object-lock-configuration '{
        "ObjectLockEnabled": "Enabled",
        "Rule": {
            "DefaultRetention": {
                "Mode": "COMPLIANCE",
                "Days": 90
            }
        }
    }'

# Linux uchun ClamAV
sudo apt install clamav clamav-daemon
sudo freshclam
sudo clamscan -r /var/www --infected --log=/var/log/clamav/skan.log

# Muntazam skanerlash
echo "0 2 * * * root clamscan -r /var/www --infected --log=/var/log/clamav/kunlik.log" \
    | sudo tee /etc/cron.d/clamav-skan

// Yuklangan fayllarni tekshirish
final class FaylSkanerlovchi
{
    public function xavfsizmi(string $yol): bool
    {
        $jarayon = new Process(['clamdscan', '--no-summary', '--fdpass', $yol]);
        $jarayon->run();

        if ($jarayon->getExitCode() === 0) {
            return true;
        }

        $this->jurnal->warning('Zararli fayl aniqlandi', [
            'yol'    => $yol,
            'natija' => $jarayon->getOutput(),
        ]);

        return false;
    }
}

# Xotiradan ishlayotgan shubhali jarayonlar
sudo ls -la /proc/*/exe 2>/dev/null | grep memfd

# Bajariladigan xotira sohalari
sudo grep -l 'rwx' /proc/*/maps 2>/dev/null | head

# PowerShell jurnalini yoqish (Windows)
# Script Block Logging - obfuskatsiya qilingan kodni ham yozadi

$yol = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
New-Item -Path $yol -Force
Set-ItemProperty -Path $yol -Name "EnableScriptBlockLogging" -Value 1

# Ortiqcha vositalarni olib tashlash
sudo apt purge gcc make perl python3-pip
sudo apt autoremove

# Yoki cheklash
sudo chmod 750 /usr/bin/curl /usr/bin/wget
sudo chown root:sudo /usr/bin/curl /usr/bin/wget

; PHP da xavfli funksiyalarni o'chirish
disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_multi_exec,parse_ini_file,show_source

; Fayl tizimiga kirishni cheklash
open_basedir = /var/www/dokon:/tmp

; Masofaviy fayllarni o'chirish
allow_url_fopen = Off
allow_url_include = Off

# Konteynerda minimal muhit
FROM php:8.3-fpm-alpine

# Shell yo'q obraz (distroless) - eng xavfsiz
# Yoki kerakli minimum
RUN apk add --no-cache libzip \
    && docker-php-ext-install pdo_mysql opcache \
    && rm -rf /var/cache/apk/*

# Bajariladigan fayllarni olib tashlash
RUN rm -f /bin/sh /bin/busybox 2>/dev/null || true

# Zararli dastur aniqlanganda

## 1. Izolyatsiya (darhol)
- [ ] Tizimni tarmoqdan uzing (o'chirmang!)
- [ ] Boshqa tizimlarni tekshiring
- [ ] Buzilgan hisoblarni bloklang

## 2. Dalillarni saqlash
- [ ] Xotira nusxasini oling
- [ ] Disk tasvirini oling
- [ ] Jurnallarni nusxalang
- [ ] Tarmoq trafigini saqlang

## 3. Tahlil
- [ ] Qanday kirdi?
- [ ] Qachon?
- [ ] Nima qildi?
- [ ] Qayerga tarqaldi?
- [ ] Qanday ma'lumot o'g'irlandi?

## 4. Tozalash
- [ ] Zaiflikni yoping
- [ ] Barcha parollarni almashtiring
- [ ] Tizimni **qayta o'rnating** (tozalash emas)
- [ ] Zaxiradan tiklang

## 5. Tiklash
- [ ] Monitoringni kuchaytiring
- [ ] Bosqichma-bosqich ishga tushiring
- [ ] Qaytish belgilarini kuzating

# Xotira nusxasini olish (Linux)
sudo apt install lime-forensics-dkms
sudo insmod /lib/modules/$(uname -r)/updates/dkms/lime.ko \
    "path=/mnt/tashqi/xotira.lime format=lime"

# Disk tasviri
sudo dd if=/dev/sda of=/mnt/tashqi/disk.img bs=4M status=progress
sha256sum /mnt/tashqi/disk.img > /mnt/tashqi/disk.img.sha256

# Kompromis indikatorlari (IoC)

## Fayl darajasida
- Kutilmagan fayllar (ayniqsa `/tmp`, yuklamalar papkasida)
- O'zgargan tizim fayllari
- Yashirin fayllar (`.` bilan boshlanadi)
- G'alati kengaytmalar (`.php.jpg`)

## Jarayon darajasida
- Yuqori CPU (cryptominer)
- `(deleted)` belgili jarayonlar
- Kutilmagan ota-bola munosabati (`nginx` → `bash`)
- Nomsiz yoki tizim jarayoniga o'xshash nomlar

## Tarmoq darajasida
- Noma'lum IP ga ulanish
- G'alati portlar
- DNS so'rovlarining ko'payishi
- Katta chiquvchi trafik

## Hisob darajasida
- Yangi foydalanuvchilar
- Kutilmagan `sudo` amallari
- G'ayritabiiy vaqtdagi kirishlar
- Yangi SSH kalitlar

#!/bin/bash
# tez-tekshiruv.sh - buzilish belgilarini qidirish

echo "=== O'chirilgan fayldan ishlayotgan jarayonlar ==="
sudo ls -la /proc/*/exe 2>/dev/null | grep deleted || echo "yo'q"

echo -e "\n=== /tmp va /dev/shm dan ishlayotganlar ==="
sudo ls -la /proc/*/exe 2>/dev/null | grep -E '/(tmp|dev/shm)/' || echo "yo'q"

echo -e "\n=== Yuqori CPU ishlatayotgan jarayonlar ==="
ps aux --sort=-%cpu | head -5

echo -e "\n=== Kutilmagan tinglash portlari ==="
sudo ss -tulpn | grep LISTEN | grep -v -E ':(22|80|443|3306|6379|9000) '

echo -e "\n=== So'nggi 7 kunda o'zgargan PHP fayllar ==="
find /var/www -name "*.php" -mtime -7 2>/dev/null | head -10

echo -e "\n=== Yuklamalar papkasidagi bajariladigan fayllar ==="
find /var/www/*/public/yuklamalar -type f \( -name "*.php" -o -name "*.sh" \) 2>/dev/null || echo "yo'q"

echo -e "\n=== Yangi SSH kalitlar ==="
find /home /root -name authorized_keys -mtime -30 -ls 2>/dev/null || echo "yo'q"

echo -e "\n=== Cron vazifalari ==="
for u in $(cut -f1 -d: /etc/passwd); do
    crontab -u "$u" -l 2>/dev/null | grep -v '^#' | sed "s/^/$u: /"
done

echo -e "\n=== UID 0 hisoblar ==="
awk -F: '($3 == 0) {print $1}' /etc/passwd