Impact : commandes de minage de cryptomonnaie

Ce document décrit un type de résultat de détection de menace dans Security Command Center. Ces résultats sont générés par les détecteurs de menaces lorsqu'ils détectent une menace potentielle dans vos ressources cloud. Pour obtenir la liste complète des résultats de détection de menace disponibles, consultez cet index.

Présentation

Des commandes de minage de cryptomonnaie connues ont été transmises aux jobs Cloud Run en tant que points d'entrée exécutés lors de l'exécution du job.

Event Threat Detection est la source de ce résultat.

Actions à mettre en place

Le plan de réponse suivant peut être adapté à ce résultat, mais il peut également avoir un impact sur vos opérations. Veillez à bien évaluer les informations que vous collectez dans votre enquête pour déterminer quelle est la meilleure réponse à apporter aux problèmes soulevés par les résultats.

Pour traiter ce résultat, procédez comme suit :

  1. Vérifiez le job, la commande et le conteneur pour déterminer si cela était prévu.
  2. Supprimez le job et le conteneur compromis.

Exemple de résultat au format JSON

Voici un exemple de résultat au format JSON.

{
  "finding": {
    "access": {
      "callerIpGeo": {},
      "serviceName": "run.googleapis.com",
      "methodName": "/Jobs.CreateJob"
    },
    "application": {},
    "attackExposure": {},
    "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/locations/global/findings/FINDING_ID",
    "category": "Impact: Cryptomining Commands",
    "chokepoint": {},
    "cloudDlpDataProfile": {},
    "cloudDlpInspection": {},
    "containers": [
      {
        "imageId": "CONTAINER_IMAGE_ID",
        "labels": [
          {
            "name": "command",
            "value": "getblockchaininfo"
          }
        ],
        "createTime": "1970-01-01T00:00:00Z"
      }
    ],
    "createTime": "2025-05-06T01:19:09.854Z",
    "database": {},
    "dataProtectionKeyGovernance": {},
    "eventTime": "2025-05-06T01:19:08.853Z",
    "exfiltration": {},
    "findingClass": "THREAT",
    "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/etd",
    "indicator": {},
    "kernelRootkit": {},
    "kubernetes": {},
    "logEntries": [
      {
        "cloudLoggingEntry": {
          "insertId": "INSERT_ID",
          "logId": "cloudaudit.googleapis.com/system_event",
          "resourceContainer": "projects/PROJECT_ID",
          "timestamp": "2025-05-06T01:18:02.533391Z"
        }
      }
    ],
    "mitreAttack": {
      "primaryTactic": "IMPACT",
      "primaryTechniques": [
        "RESOURCE_HIJACKING"
      ]
    },
    "mute": "UNDEFINED",
    "muteInfo": {
      "staticMute": {
        "state": "UNDEFINED",
        "applyTime": "1970-01-01T00:00:00Z"
      }
    },
    "muteUpdateTime": "1970-01-01T00:00:00Z",
    "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global/findings/FINDING_ID",
    "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",
    "parentDisplayName": "Event Threat Detection",
    "resourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "securityPosture": {},
    "severity": "HIGH",
    "state": "ACTIVE",
    "vulnerability": {},
    "externalSystems": {}
  },
  "resource": {
    "name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "displayName": "PROJECT_ID",
    "type": "google.cloud.resourcemanager.Project",
    "cloudProvider": "GOOGLE_CLOUD_PLATFORM",
    "service": "cloudresourcemanager.googleapis.com",
    "gcpMetadata": {
      "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
      "projectDisplayName": "PROJECT_ID",
      "parent": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",
      "parentDisplayName": "FOLDER_NAME",
      "folders": [
        {
          "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",
          "resourceFolderDisplayName": "FOLDER_NAME"
        }
      ],
      "organization": "organizations/ORGANIZATION_ID"
    },
    "resourcePath": {
      "nodes": [
        {
          "nodeType": "GCP_PROJECT",
          "id": "projects/PROJECT_NUMBER",
          "displayName": "PROJECT_ID"
        },
        {
          "nodeType": "GCP_FOLDER",
          "id": "folders/FOLDER_NUMBER",
          "displayName": "FOLDER_NAME"
        },
        {
          "nodeType": "GCP_ORGANIZATION",
          "id": "organizations/ORGANIZATION_ID"
        }
      ]
    },
    "resourcePathString": "organizations/ORGANIZATION_ID/folders/FOLDER_NUMBER/projects/PROJECT_NUMBER"
  },
  "sourceProperties": {
    "sourceId": {
      "projectNumber": "PROJECT_NUMBER",
      "customerOrganizationNumber": "ORGANIZATION_ID"
    },
    "detectionCategory": {
      "ruleName": "cloud_run_jobs_cryptomining_commands"
    },
    "detectionPriority": "HIGH",
    "affectedResources": [
      {
        "gcpResourceName": "//run.googleapis.com/namespaces/PROJECT_ID/jobs/JOB_NAME"
      },
      {
        "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
      }
    ],
    "evidence": [
      {
        "sourceLogId": {
          "projectId": "PROJECT_ID",
          "resourceContainer": "projects/PROJECT_ID",
          "timestamp": {
            "seconds": "1746494282",
            "nanos": 533391000
          },
          "insertId": "INSERT_ID",
          "logId": "cloudaudit.googleapis.com/system_event"
        }
      }
    ],
    "properties": {},
    "findingId": "FINDING_ID",
    "contextUris": {
      "mitreUri": {
        "displayName": "MITRE Link",
        "url": "https://attack.mitre.org/techniques/T1496/"
      },
      "cloudLoggingQueryUri": [
        {
          "displayName": "Cloud Logging Query Link",
          "url": "LINK_TO_LOG_QUERY"
        }
      ],
      "relatedFindingUri": {}
    }
  }
}

Étape suivante