Eskalasi Hak Istimewa: Default Compute Engine Service Account SetIAMPolicy

Dokumen ini menjelaskan jenis temuan ancaman di Security Command Center. Temuan ancaman dihasilkan oleh detektor ancaman saat mendeteksi potensi ancaman di resource cloud Anda. Untuk daftar lengkap temuan ancaman yang tersedia, lihat Indeks temuan ancaman.

Ringkasan

Akun layanan Compute Engine default digunakan untuk menetapkan kebijakan IAM untuk layanan Cloud Run. Ini adalah potensi tindakan pasca-eksploitasi saat token Compute Engine disusupi dari layanan tanpa server.

Event Threat Detection adalah sumber temuan ini.

Cara merespons

Untuk merespons temuan ini, lakukan hal berikut:

  1. Tinjau log audit di Cloud Logging untuk menentukan apakah ini adalah aktivitas yang diharapkan oleh principal.
  2. Tentukan apakah ada tanda aktivitas berbahaya lainnya oleh principal dalam log.

Contoh JSON temuan

Berikut adalah contoh JSON temuan.

{
      "finding": {
        "access": {
          "principalEmail": "PROJECT_NUMBER-compute@developer.gserviceaccount.com",
          "callerIp": "IP_ADDRESS",
          "callerIpGeo": {
            "regionCode": "REGION_CODE"
          },
          "userAgent": "USER_AGENT",
          "serviceName": "run.googleapis.com",
          "methodName": "google.cloud.run.v1.Services.SetIamPolicy",
          "principalSubject": "serviceAccount:PROJECT_NUMBER-compute@developer.gserviceaccount.com",
          "serviceAccountDelegationInfo": [
            {
              "principalEmail": "service-PROJECT_NUMBER@serverless-robot-prod.iam.gserviceaccount.com"
            }
          ]
        },
        "application": {},
        "attackExposure": {},
        "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/locations/global/findings/FINDING_ID",
        "category": "Privilege Escalation: Default Compute Engine Service Account SetIAMPolicy",
        "chokepoint": {},
        "cloudDlpDataProfile": {},
        "cloudDlpInspection": {},
        "createTime": "2025-05-27T20:36:26.627Z",
        "database": {},
        "dataProtectionKeyGovernance": {},
        "eventTime": "2025-05-27T20:36:26.527Z",
        "exfiltration": {},
        "findingClass": "THREAT",
        "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/etd",
        "indicator": {},
        "kernelRootkit": {},
        "kubernetes": {},
        "logEntries": [
          {
            "cloudLoggingEntry": {
              "insertId": "INSERT_ID",
              "logId": "cloudaudit.googleapis.com/activity",
              "resourceContainer": "projects/PROJECT_ID",
              "timestamp": "2025-05-27T20:35:26.897015Z"
            }
          }
        ],
        "mitreAttack": {
          "primaryTactic": "PRIVILEGE_ESCALATION",
          "primaryTechniques": [
            "ADDITIONAL_CLOUD_ROLES"
          ]
        },
        "mute": "UNDEFINED",
        "muteInfo": {
          "staticMute": {
            "state": "UNDEFINED",
            "applyTime": "1970-01-01T00:00:00Z"
          }
        },
        "muteUpdateTime": "1970-01-01T00:00:00Z",
        "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global/findings/FINDING_ID",
        "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",
        "parentDisplayName": "Event Threat Detection",
        "resourceName": "//run.googleapis.com/projects/PROJECT_ID/locations/REGION/services/SERVICE_NAME",
        "securityPosture": {},
        "severity": "LOW",
        "state": "ACTIVE",
        "vulnerability": {},
        "externalSystems": {}
      },
      "resource": {
        "name": "//run.googleapis.com/projects/PROJECT_ID/locations/REGION/services/SERVICE_NAME",
        "displayName": "SERVICE_NAME",
        "type": "google.run.Service",
        "cloudProvider": "GOOGLE_CLOUD_PLATFORM",
        "service": "run.googleapis.com",
        "location": "REGION",
        "gcpMetadata": {
          "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
          "projectDisplayName": "PROJECT_ID",
          "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
          "parentDisplayName": "PROJECT_ID",
          "organization": "organizations/ORGANIZATION_ID"
        },
        "resourcePath": {
          "nodes": [
            {
              "nodeType": "GCP_PROJECT",
              "id": "projects/PROJECT_NUMBER",
              "displayName": "PROJECT_ID"
            },
            {
              "nodeType": "GCP_ORGANIZATION",
              "id": "organizations/ORGANIZATION_ID"
            }
          ]
        },
        "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_NUMBER"
      },
      "sourceProperties": {
        "sourceId": {
          "projectNumber": "PROJECT_NUMBER",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "detectionCategory": {
          "ruleName": "cloud_run_services_set_iam_policy"
        },
        "detectionPriority": "LOW",
        "affectedResources": [
          {
            "gcpResourceName": "//run.googleapis.com/projects/PROJECT_ID/locations/REGION/services/SERVICE_NAME"
          },
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
          }
        ],
        "evidence": [
          {
            "sourceLogId": {
              "projectId": "PROJECT_ID",
              "resourceContainer": "projects/PROJECT_ID",
              "timestamp": {
                "seconds": "1748378126",
                "nanos": 897015000
              },
              "insertId": "INSERT_ID",
              "logId": "cloudaudit.googleapis.com/activity"
            }
          }
        ],
        "properties": {},
        "findingId": "FINDING_ID",
        "contextUris": {
          "mitreUri": {
            "displayName": "MITRE Link",
            "url": "https://attack.mitre.org/techniques/T1098/003/"
          },
          "cloudLoggingQueryUri": [
            {
              "displayName": "Cloud Logging Query Link",
              "url": "LINK_TO_LOG_QUERY"
            }
          ],
          "relatedFindingUri": {}
        }
      }
    }

Langkah berikutnya