影響：加密貨幣挖礦指令

本文說明 Security Command Center 中的威脅發現項目類型。威脅偵測工具偵測到雲端資源中可能存在威脅時，就會產生威脅發現項目。如需可用威脅發現項目的完整清單，請參閱威脅發現項目索引。

總覽

已知的加密貨幣挖礦指令會傳遞至 Cloud Run 工作，做為工作執行時執行的進入點。

Event Threat Detection 是這項發現項目的來源。

回應方式

下列應變計畫可能適用於這項發現，但也可能影響作業。 請仔細評估調查期間收集到的資訊，找出解決問題的最佳方式。

如要回應這項發現項目，請按照下列步驟操作：

  1. 檢查工作、指令和容器，判斷這是否為預期行為。
  2. 刪除遭入侵的工作和容器。

發現項目 JSON 範例

以下是發現項目 JSON 的範例。

{
  "finding": {
    "access": {
      "callerIpGeo": {},
      "serviceName": "run.googleapis.com",
      "methodName": "/Jobs.CreateJob"
    },
    "application": {},
    "attackExposure": {},
    "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/locations/global/findings/FINDING_ID",
    "category": "Impact: Cryptomining Commands",
    "chokepoint": {},
    "cloudDlpDataProfile": {},
    "cloudDlpInspection": {},
    "containers": [
      {
        "imageId": "CONTAINER_IMAGE_ID",
        "labels": [
          {
            "name": "command",
            "value": "getblockchaininfo"
          }
        ],
        "createTime": "1970-01-01T00:00:00Z"
      }
    ],
    "createTime": "2025-05-06T01:19:09.854Z",
    "database": {},
    "dataProtectionKeyGovernance": {},
    "eventTime": "2025-05-06T01:19:08.853Z",
    "exfiltration": {},
    "findingClass": "THREAT",
    "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/etd",
    "indicator": {},
    "kernelRootkit": {},
    "kubernetes": {},
    "logEntries": [
      {
        "cloudLoggingEntry": {
          "insertId": "INSERT_ID",
          "logId": "cloudaudit.googleapis.com/system_event",
          "resourceContainer": "projects/PROJECT_ID",
          "timestamp": "2025-05-06T01:18:02.533391Z"
        }
      }
    ],
    "mitreAttack": {
      "primaryTactic": "IMPACT",
      "primaryTechniques": [
        "RESOURCE_HIJACKING"
      ]
    },
    "mute": "UNDEFINED",
    "muteInfo": {
      "staticMute": {
        "state": "UNDEFINED",
        "applyTime": "1970-01-01T00:00:00Z"
      }
    },
    "muteUpdateTime": "1970-01-01T00:00:00Z",
    "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global/findings/FINDING_ID",
    "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",
    "parentDisplayName": "Event Threat Detection",
    "resourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "securityPosture": {},
    "severity": "HIGH",
    "state": "ACTIVE",
    "vulnerability": {},
    "externalSystems": {}
  },
  "resource": {
    "name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "displayName": "PROJECT_ID",
    "type": "google.cloud.resourcemanager.Project",
    "cloudProvider": "GOOGLE_CLOUD_PLATFORM",
    "service": "cloudresourcemanager.googleapis.com",
    "gcpMetadata": {
      "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
      "projectDisplayName": "PROJECT_ID",
      "parent": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",
      "parentDisplayName": "FOLDER_NAME",
      "folders": [
        {
          "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",
          "resourceFolderDisplayName": "FOLDER_NAME"
        }
      ],
      "organization": "organizations/ORGANIZATION_ID"
    },
    "resourcePath": {
      "nodes": [
        {
          "nodeType": "GCP_PROJECT",
          "id": "projects/PROJECT_NUMBER",
          "displayName": "PROJECT_ID"
        },
        {
          "nodeType": "GCP_FOLDER",
          "id": "folders/FOLDER_NUMBER",
          "displayName": "FOLDER_NAME"
        },
        {
          "nodeType": "GCP_ORGANIZATION",
          "id": "organizations/ORGANIZATION_ID"
        }
      ]
    },
    "resourcePathString": "organizations/ORGANIZATION_ID/folders/FOLDER_NUMBER/projects/PROJECT_NUMBER"
  },
  "sourceProperties": {
    "sourceId": {
      "projectNumber": "PROJECT_NUMBER",
      "customerOrganizationNumber": "ORGANIZATION_ID"
    },
    "detectionCategory": {
      "ruleName": "cloud_run_jobs_cryptomining_commands"
    },
    "detectionPriority": "HIGH",
    "affectedResources": [
      {
        "gcpResourceName": "//run.googleapis.com/namespaces/PROJECT_ID/jobs/JOB_NAME"
      },
      {
        "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
      }
    ],
    "evidence": [
      {
        "sourceLogId": {
          "projectId": "PROJECT_ID",
          "resourceContainer": "projects/PROJECT_ID",
          "timestamp": {
            "seconds": "1746494282",
            "nanos": 533391000
          },
          "insertId": "INSERT_ID",
          "logId": "cloudaudit.googleapis.com/system_event"
        }
      }
    ],
    "properties": {},
    "findingId": "FINDING_ID",
    "contextUris": {
      "mitreUri": {
        "displayName": "MITRE Link",
        "url": "https://attack.mitre.org/techniques/T1496/"
      },
      "cloudLoggingQueryUri": [
        {
          "displayName": "Cloud Logging Query Link",
          "url": "LINK_TO_LOG_QUERY"
        }
      ],
      "relatedFindingUri": {}
    }
  }
}

後續步驟