權限提升：預設 Compute Engine 服務帳戶 SetIAMPolicy

本文說明 Security Command Center 中的威脅發現項目類型。威脅偵測工具在雲端資源中偵測到潛在威脅時，就會產生威脅發現項目。如需可用威脅發現項目的完整清單，請參閱「威脅發現項目索引」。

總覽

預設的 Compute Engine 服務帳戶用於設定 Cloud Run 服務的 IAM 政策。如果無伺服器服務的 Compute Engine 權杖遭到入侵，這項限制可能會在入侵後發揮作用。

Event Threat Detection 是這項發現項目的來源。

回應方式

如要回應這項發現項目，請按照下列步驟操作：

  1. 查看 Cloud Logging 中的稽核記錄，判斷主體是否預期會執行這項活動。
  2. 判斷記錄中是否有其他跡象，表明主體進行了惡意活動。

發現項目 JSON 範例

以下是發現項目 JSON 的範例。

{
      "finding": {
        "access": {
          "principalEmail": "PROJECT_NUMBER-compute@developer.gserviceaccount.com",
          "callerIp": "IP_ADDRESS",
          "callerIpGeo": {
            "regionCode": "REGION_CODE"
          },
          "userAgent": "USER_AGENT",
          "serviceName": "run.googleapis.com",
          "methodName": "google.cloud.run.v1.Services.SetIamPolicy",
          "principalSubject": "serviceAccount:PROJECT_NUMBER-compute@developer.gserviceaccount.com",
          "serviceAccountDelegationInfo": [
            {
              "principalEmail": "service-PROJECT_NUMBER@serverless-robot-prod.iam.gserviceaccount.com"
            }
          ]
        },
        "application": {},
        "attackExposure": {},
        "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/locations/global/findings/FINDING_ID",
        "category": "Privilege Escalation: Default Compute Engine Service Account SetIAMPolicy",
        "chokepoint": {},
        "cloudDlpDataProfile": {},
        "cloudDlpInspection": {},
        "createTime": "2025-05-27T20:36:26.627Z",
        "database": {},
        "dataProtectionKeyGovernance": {},
        "eventTime": "2025-05-27T20:36:26.527Z",
        "exfiltration": {},
        "findingClass": "THREAT",
        "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/etd",
        "indicator": {},
        "kernelRootkit": {},
        "kubernetes": {},
        "logEntries": [
          {
            "cloudLoggingEntry": {
              "insertId": "INSERT_ID",
              "logId": "cloudaudit.googleapis.com/activity",
              "resourceContainer": "projects/PROJECT_ID",
              "timestamp": "2025-05-27T20:35:26.897015Z"
            }
          }
        ],
        "mitreAttack": {
          "primaryTactic": "PRIVILEGE_ESCALATION",
          "primaryTechniques": [
            "ADDITIONAL_CLOUD_ROLES"
          ]
        },
        "mute": "UNDEFINED",
        "muteInfo": {
          "staticMute": {
            "state": "UNDEFINED",
            "applyTime": "1970-01-01T00:00:00Z"
          }
        },
        "muteUpdateTime": "1970-01-01T00:00:00Z",
        "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global/findings/FINDING_ID",
        "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",
        "parentDisplayName": "Event Threat Detection",
        "resourceName": "//run.googleapis.com/projects/PROJECT_ID/locations/REGION/services/SERVICE_NAME",
        "securityPosture": {},
        "severity": "LOW",
        "state": "ACTIVE",
        "vulnerability": {},
        "externalSystems": {}
      },
      "resource": {
        "name": "//run.googleapis.com/projects/PROJECT_ID/locations/REGION/services/SERVICE_NAME",
        "displayName": "SERVICE_NAME",
        "type": "google.run.Service",
        "cloudProvider": "GOOGLE_CLOUD_PLATFORM",
        "service": "run.googleapis.com",
        "location": "REGION",
        "gcpMetadata": {
          "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
          "projectDisplayName": "PROJECT_ID",
          "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
          "parentDisplayName": "PROJECT_ID",
          "organization": "organizations/ORGANIZATION_ID"
        },
        "resourcePath": {
          "nodes": [
            {
              "nodeType": "GCP_PROJECT",
              "id": "projects/PROJECT_NUMBER",
              "displayName": "PROJECT_ID"
            },
            {
              "nodeType": "GCP_ORGANIZATION",
              "id": "organizations/ORGANIZATION_ID"
            }
          ]
        },
        "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_NUMBER"
      },
      "sourceProperties": {
        "sourceId": {
          "projectNumber": "PROJECT_NUMBER",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "detectionCategory": {
          "ruleName": "cloud_run_services_set_iam_policy"
        },
        "detectionPriority": "LOW",
        "affectedResources": [
          {
            "gcpResourceName": "//run.googleapis.com/projects/PROJECT_ID/locations/REGION/services/SERVICE_NAME"
          },
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
          }
        ],
        "evidence": [
          {
            "sourceLogId": {
              "projectId": "PROJECT_ID",
              "resourceContainer": "projects/PROJECT_ID",
              "timestamp": {
                "seconds": "1748378126",
                "nanos": 897015000
              },
              "insertId": "INSERT_ID",
              "logId": "cloudaudit.googleapis.com/activity"
            }
          }
        ],
        "properties": {},
        "findingId": "FINDING_ID",
        "contextUris": {
          "mitreUri": {
            "displayName": "MITRE Link",
            "url": "https://attack.mitre.org/techniques/T1098/003/"
          },
          "cloudLoggingQueryUri": [
            {
              "displayName": "Cloud Logging Query Link",
              "url": "LINK_TO_LOG_QUERY"
            }
          ],
          "relatedFindingUri": {}
        }
      }
    }

後續步驟