Security Command Center führt das Laufzeit- und Steuerungsebenen Monitoring von Cloud Run-Ressourcen durch. Empfohlene Reaktionen auf diese Bedrohungen finden Sie unter Auf Cloud Run Bedrohungsbefunde reagieren.
Ergebnistypen für die Laufzeit
Die folgenden Laufzeiterkennungen sind mit Cloud Run Threat Detection verfügbar:
-
Command and Control: Find Google Cloud Credentials -
Command and Control: Steganography Tool Detected -
Credential Access: GPG Key Reconnaissance -
Credential Access: Search Private Keys or Passwords -
Defense Evasion: Base64 ELF File Command Line -
Defense Evasion: Base64 Encoded Python Script Executed -
Defense Evasion: Base64 Encoded Shell Script Executed -
Defense Evasion: Launch Code Compiler Tool In Container -
Execution: Added Malicious Binary Executed -
Execution: Added Malicious Library Loaded -
Execution: Added Malicious Skill Executed -
Execution: Added Malicious Skill Loaded -
Execution: Built in Malicious Binary Executed -
Execution: Built in Malicious Skill Executed -
Execution: Container Escape -
Execution: Fileless Execution in /memfd: -
Execution: Kubernetes Attack Tool Execution -
Execution: Local Reconnaissance Tool Execution -
Execution: Malicious Python executed -
Execution: Modified Malicious Binary Executed -
Execution: Modified Malicious Library Loaded -
Execution: Modified Malicious Skill Executed -
Execution: Modified Malicious Skill Loaded -
Execution: Netcat Remote Code Execution in Container -
Execution: Possible Arbitrary Command Execution through CUPS (CVE-2024-47076) -
Execution: Possible Remote Command Execution Detected -
Execution: Program Run with Disallowed HTTP Proxy Env -
Execution: Socat Reverse Shell Detected -
Execution: Suspicious OpenSSL Shared Object Loaded -
Exfiltration: Launch Remote File Copy Tools in Container -
Impact: Detect Malicious Cmdlines -
Impact: Remove Bulk Data From Disk -
Impact: Suspicious crypto mining activity using the Stratum Protocol -
Malicious Script Executed -
Malicious URL Observed -
Privilege Escalation: Abuse of Sudo For Privilege Escalation (CVE-2019-14287) -
Privilege Escalation: Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034) -
Privilege Escalation: Sudo Potential Privilege Escalation (CVE-2021-3156) -
Reverse Shell -
Unexpected Child Shell
Ergebnistypen für die Steuerungsebene
Die folgenden Erkennungen der Steuerungsebene sind mit Event Threat Detection verfügbar:
-
Execution: Cryptomining Docker Image -
Impact: Cryptomining Commands -
Privilege Escalation: Default Compute Engine Service Account SetIAMPolicy
Nächste Schritte
- Weitere Informationen zu Cloud Run Threat Detection.
- Weitere Informationen zu Event Threat Detection.
- Informationen zum Reagieren auf Cloud Run-Bedrohungs befunde.
- Weitere Informationen finden Sie im Index der Bedrohungsergebnisse.