Cloud Run 威脅發現項目

Security Command Center 會對 Cloud Run 資源執行執行階段和控制平面監控。如需這些威脅的建議回應方式，請參閱「回應 Cloud Run 威脅發現」。

執行階段發現項目類型

Cloud Run Threat Detection 提供下列執行階段偵測功能：

• Command and Control: Find Google Cloud Credentials
• Command and Control: Steganography Tool Detected
• Credential Access: GPG Key Reconnaissance
• Credential Access: Search Private Keys or Passwords
• Defense Evasion: Base64 ELF File Command Line
• Defense Evasion: Base64 Encoded Python Script Executed
• Defense Evasion: Base64 Encoded Shell Script Executed
• Defense Evasion: Launch Code Compiler Tool In Container
• Execution: Added Malicious Binary Executed
• Execution: Added Malicious Library Loaded
• Execution: Built in Malicious Binary Executed
• Execution: Container Escape
• Execution: Fileless Execution in /memfd:
• Execution: Kubernetes Attack Tool Execution
• Execution: Local Reconnaissance Tool Execution
• Execution: Malicious Python executed
• Execution: Modified Malicious Binary Executed
• Execution: Modified Malicious Library Loaded
• Execution: Netcat Remote Code Execution in Container
• Execution: Possible Arbitrary Command Execution through CUPS (CVE-2024-47177)
• Execution: Possible Remote Command Execution Detected
• Execution: Program Run with Disallowed HTTP Proxy Env
• Execution: Socat Reverse Shell Detected
• Execution: Suspicious OpenSSL Shared Object Loaded
• Exfiltration: Launch Remote File Copy Tools in Container
• Impact: Detect Malicious Cmdlines
• Impact: Remove Bulk Data From Disk
• Impact: Suspicious crypto mining activity using the Stratum Protocol
• Malicious Script Executed
• Malicious URL Observed
• Privilege Escalation: Abuse of Sudo For Privilege Escalation (CVE-2019-14287)
• Privilege Escalation: Fileless Execution in /dev/shm
• Privilege Escalation: Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034)
• Privilege Escalation: Sudo Potential Privilege Escalation (CVE-2021-3156)
• Reverse Shell
• Unexpected Child Shell

控制層發現項目類型

Event Threat Detection 可偵測下列控制層：

• Execution: Cryptomining Docker Image
• Impact: Cryptomining Commands
• Privilege Escalation: Default Compute Engine Service Account SetIAMPolicy

後續步驟

• 瞭解 Cloud Run Threat Detection。
• 瞭解 Event Threat Detection。
• 瞭解如何回應 Cloud Run 威脅發現。
• 請參閱威脅發現項目索引。