規避防禦機制：建立急用權限工作負載部署作業

本文說明 Security Command Center 中的威脅發現項目類型。威脅偵測工具在雲端資源中偵測到潛在威脅時，就會產生威脅發現項目。如需可用威脅發現項目的完整清單，請參閱威脅發現項目索引。

總覽

Breakglass Workload Deployment Created 會檢查 Cloud 稽核記錄，確認是否有工作負載部署作業使用急用權限旗標覆寫二進位授權控管機制。

Event Threat Detection 是這項發現項目的來源。

回應方式

如要回應這項發現項目，請按照下列步驟操作：

步驟 1：查看調查結果詳細資料

  1. 按照「查看發現項目」一文的說明，開啟Defense Evasion: Breakglass Workload Deployment Created發現項目。系統會開啟發現項目詳細資料面板，並顯示「摘要」分頁。

  2. 在「摘要」分頁中，查看下列各節的資訊：

    • 偵測到的內容，尤其是下列欄位：
      • 主體電子郵件地址：執行修改作業的帳戶。
      • 方法名稱：呼叫的方法。
      • Kubernetes Pod：Pod 名稱和命名空間。
    • 受影響的資源，尤其是下列欄位：
      • 資源顯示名稱：部署作業所在的 GKE 命名空間。
    • 相關連結：
      • Cloud Logging URI：記錄項目連結。
      • MITRE ATT&CK 方法：連結至 MITRE ATT&CK 文件。
      • 相關發現項目：任何相關發現項目的連結。

步驟 2：檢查記錄

  1. 在 Google Cloud 控制台的「發現項目詳細資料」分頁中，按一下「Cloud Logging URI」欄位中的連結，前往「Logs Explorer」。
  2. 檢查 protoPayload.resourceName 欄位中的值，找出特定憑證簽署要求。

  3. 使用下列篩選器，檢查主體執行的其他動作：

    • resource.labels.cluster_name="CLUSTER_NAME"

    • protoPayload.authenticationInfo.principalEmail="PRINCIPAL_EMAIL"

      更改下列內容：

    • CLUSTER_NAME：您在調查結果詳細資料的「資源顯示名稱」欄位中記下的值。

    • PRINCIPAL_EMAIL：您在調查結果詳細資料的「主體電子郵件」欄位中記下的值。

步驟 3：研究攻擊和應變方法

  1. 查看這類發現項目的 MITRE ATT&CK 框架項目： 規避防禦措施：急用權限工作負載部署。
  2. 如要查看相關發現項目，請在發現項目詳細資料的「摘要」分頁中，點選「相關發現項目」列的「相關發現項目」連結。
  3. 如要制定回應計畫，請將調查結果與 MITRE 研究結合。

發現項目 JSON 範例

以下是發現項目 JSON 的範例。

{
  "findings": {
    "access": {
      "principalEmail": "PRINCIPAL_EMAIL",
      "callerIp": "IP_ADDRESS",
      "callerIpGeo": {},
      "serviceName": "k8s.io",
      "methodName": "io.k8s.core.v1.pods.create"
    },
    "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",
    "category": "Defense Evasion: Breakglass Workload Deployment Created",
    "cloudDlpInspection": {},
    "containers": [
      {
        "name": "test-container",
        "uri": "test-image"
      }
    ],
    "createTime": "2023-03-24T17:38:45.756Z",
    "database": {},
    "eventTime": "2023-03-24T17:38:45.709Z",
    "exfiltration": {},
    "findingClass": "THREAT",
    "findingProviderId": "organizations/ORGANIZATION_NUMBER/firstPartyFindingProviders/etd,
    "indicator": {},
    "kernelRootkit": {},
    "kubernetes": {
      "pods": [
        {
          "ns": "NAMESPACE",
          "name": "POD_NAME",
          "labels": [
            {
              "name": "image-policy.k8s.io/break-glass",
              "value": "true"
            }
          ],
          "containers": [
            {
              "name": "CONTAINER_NAME",
              "uri": "CONTAINER_URI"
            }
          ]
        }
      ]
    },
    "mitreAttack": {
      "primaryTactic": "DEFENSE_EVASION",
      "primaryTechniques": [
        "ABUSE_ELEVATION_CONTROL_MECHANISM"
      ]
    },
    "mute": "UNDEFINED",
    "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",
    "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",
    "parentDisplayName": "Event Threat Detection",
    "resourceName": "//container.googleapis.com/projects/PROJECT_NUMBER/locations/us-west1-a/clusters/CLUSTER_NAME/k8s/namespaces/NAMESPACE",
    "severity": "LOW",
    "state": "ACTIVE",
    "vulnerability": {},
    "workflowState": "NEW"
  },
  "resource": {
    "name": "//container.googleapis.com/projects/PROJECT_ID/locations/us-west1-a/clusters/CLUSTER_NAME/k8s/namespaces/NAMESPACE",
    "display_name": "default",
    "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "project_display_name": "PROJECT_ID",
    "parent_name": "//container.googleapis.com/projects/PROJECT_ID/locations/us-west1-a/clusters/CLUSTER_NAME",
    "parent_display_name": "CLUSTER_NAME",
    "type": "k8s.io.Namespace",
    "folders": [
      {
        "resourceFolderDisplayName": "FOLDER_NAME",
        "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER"
      }
    ]
  },
  "sourceProperties": {
    "properties": {},
    "findingId": "FINDING_ID",
    "contextUris": {
      "mitreUri": {
        "displayName": "MITRE Link",
        "url": "https://attack.mitre.org/techniques/T1548/"
      },
      "cloudLoggingQueryUri": [
        {
          "displayName": "Cloud Logging Query Link",
          "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222022-10-07T07:42:06.044146Z%22%0AinsertId%3D%225d80de5c-84b8-4f42-84c7-6b597162e00a%22%0Aresource.labels.project_id%3D%22PROJECT_ID%22?project=PROJECT_ID"
        }
      ],
      "relatedFindingUri": {}
    },
    "sourceId": {
      "projectNumber": "PROJECT_NUMBER",
      "customerOrganizationNumber": "ORGANIZATION_NUMBER"
    },
    "detectionCategory": {
      "ruleName": "binary_authorization_breakglass_workload",
      "subRuleName": "create"
    },
    "detectionPriority": "LOW",
    "affectedResources": [
      {
        "gcpResourceName": "//container.googleapis.com/projects/PROJECT_ID/locations/us-west1-a/clusters/CLUSTER_NAME/k8s/namespaces/NAMESPACE"
      },
      {
        "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
      }
    ],
    "evidence": [
      {
        "sourceLogId": {
          "projectId": "PROJECT_ID",
          "resourceContainer": "projects/PROJECT_ID",
          "timestamp": {
            "seconds": "1679679521",
            "nanos": 141571000
          },
          "insertId": "INSERT_ID"
        }
      }
    ]
  }
}

後續步驟