執行：加密貨幣挖礦 Docker 映像檔

本文說明 Security Command Center 中的威脅發現項目類型。威脅偵測工具偵測到雲端資源中可能存在威脅時，就會產生威脅發現項目。如需可用威脅發現項目的完整清單，請參閱威脅發現項目索引。

總覽

新增可進行加密貨幣挖礦的已知不良 Docker 映像檔，藉此建立或修訂 Cloud Run 服務或工作。

Event Threat Detection 是這項發現項目的來源。

回應方式

下列應變計畫可能適用於這項發現，但也可能影響作業。 請仔細評估調查期間收集到的資訊，找出解決問題的最佳方式。

如要回應這項發現項目，請按照下列步驟操作：

  1. 檢查容器映像檔，判斷這是否為預期行為。
  2. 刪除遭入侵的容器，並換成新容器。

發現項目 JSON 範例

以下是發現項目 JSON 的範例。

{
      "finding": {
        "access": {
          "callerIpGeo": {},
          "serviceName": "run.googleapis.com",
          "methodName": "/Services.DeleteService"
        },
        "application": {},
        "attackExposure": {},
        "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/locations/global/findings/FINDING_ID",
        "category": "Execution: Cryptomining Docker Image",
        "chokepoint": {},
        "cloudDlpDataProfile": {},
        "cloudDlpInspection": {},
        "contacts": {
          "security": {
            "contacts": [
              {
                "email": "EMAIL_ADDRESS"
              }
            ]
          }
        },
        "containers": [
          {
            "imageId": "CONTAINER_IMAGE_ID",
            "createTime": "1970-01-01T00:00:00Z"
          }
        ],
        "createTime": "2025-05-06T01:06:10.340Z",
        "database": {},
        "dataProtectionKeyGovernance": {},
        "eventTime": "2025-05-06T01:06:09.037Z",
        "exfiltration": {},
        "findingClass": "THREAT",
        "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/etd",
        "indicator": {},
        "kernelRootkit": {},
        "kubernetes": {},
        "logEntries": [
          {
            "cloudLoggingEntry": {
              "insertId": "INSERT_ID",
              "logId": "cloudaudit.googleapis.com/system_event",
              "resourceContainer": "projects/PROJECT_ID",
              "timestamp": "2025-05-06T01:05:31.417999Z"
            }
          }
        ],
        "mitreAttack": {
          "primaryTactic": "EXECUTION",
          "primaryTechniques": [
            "DEPLOY_CONTAINER"
          ]
        },
        "mute": "UNDEFINED",
        "muteInfo": {
          "staticMute": {
            "state": "UNDEFINED",
            "applyTime": "1970-01-01T00:00:00Z"
          }
        },
        "muteUpdateTime": "1970-01-01T00:00:00Z",
        "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global/findings/FINDING_ID",
        "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",
        "parentDisplayName": "Event Threat Detection",
        "resourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
        "securityPosture": {},
        "severity": "HIGH",
        "state": "ACTIVE",
        "vulnerability": {},
        "externalSystems": {}
      },
      "resource": {
        "name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
        "displayName": "PROJECT_ID",
        "type": "google.cloud.resourcemanager.Project",
        "cloudProvider": "GOOGLE_CLOUD_PLATFORM",
        "service": "cloudresourcemanager.googleapis.com",
        "gcpMetadata": {
          "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
          "projectDisplayName": "PROJECT_ID",
          "parent": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",
          "parentDisplayName": "FOLDER_NAME",
          "folders": [
            {
              "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",
              "resourceFolderDisplayName": "FOLDER_NAME"
            }
          ],
          "organization": "organizations/ORGANIZATION_ID"
        },
        "resourcePath": {
          "nodes": [
            {
              "nodeType": "GCP_PROJECT",
              "id": "projects/PROJECT_NUMBER",
              "displayName": "PROJECT_ID"
            },
            {
              "nodeType": "GCP_FOLDER",
              "id": "folders/FOLDER_NUMBER",
              "displayName": "FOLDER_NAME"
            },
            {
              "nodeType": "GCP_ORGANIZATION",
              "id": "organizations/ORGANIZATION_ID"
            }
          ]
        },
        "resourcePathString": "organizations/ORGANIZATION_ID/folders/FOLDER_NUMBER/projects/PROJECT_NUMBER"
      },
      "sourceProperties": {
        "sourceId": {
          "projectNumber": "PROJECT_NUMBER",
          "customerOrganizationNumber": "ORGANIZATION_ID"
        },
        "detectionCategory": {
          "ruleName": "cloud_run_cryptomining_docker_images"
        },
        "detectionPriority": "HIGH",
        "affectedResources": [
          {
            "gcpResourceName": "//run.googleapis.com/namespaces/PROJECT_ID/services/SERVICE_NAME"
          },
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
          }
        ],
        "evidence": [
          {
            "sourceLogId": {
              "projectId": "PROJECT_ID",
              "resourceContainer": "projects/PROJECT_ID",
              "timestamp": {
                "seconds": "1746493531",
                "nanos": 417999000
              },
              "insertId": "INSERT_ID",
              "logId": "cloudaudit.googleapis.com/system_event"
            }
          }
        ],
        "properties": {},
        "findingId": "FINDING_ID",
        "contextUris": {
          "mitreUri": {
            "displayName": "MITRE Link",
            "url": "https://attack.mitre.org/techniques/T1610/"
          },
          "cloudLoggingQueryUri": [
            {
              "displayName": "Cloud Logging Query Link",
              "url": "LINK_TO_LOG_QUERY"
            }
          ],
          "relatedFindingUri": {}
        }
      }
    }

後續步驟