Defense Evasion: Rootkit

This document describes a threat finding type in Security Command Center. Threat findings are generated by threat detectors when they detect a potential threat in your cloud resources. For a full list of available threat findings, see Threat findings index.

Finding description

VM Threat Detection detected a combination of signals that match a known kernel-mode rootkit in a Compute Engine VM instance.

The Defense Evasion: Rootkit finding category is a superset of the following finding categories. Therefore, this section applies to these finding categories as well.

  • Defense Evasion: Unexpected ftrace handler
  • Defense Evasion: Unexpected interrupt handler
  • Defense Evasion: Unexpected kernel modules
  • Defense Evasion: Unexpected kernel read-only data modification
  • Defense Evasion: Unexpected kprobe handler
  • Defense Evasion: Unexpected processes in runqueue
  • Defense Evasion: Unexpected system call handler

To respond to these findings, do the following.

Step 1: Review finding details

  1. Open finding, as directed in Review findings. The details panel for the finding opens to the Summary tab.

  2. On the Summary tab, review the information in the following sections:

    • What was detected, especially the following fields:

      • Kernel rootkit name: the family name of the rootkit that was detected—for example, Diamorphine.
      • Unexpected kernel code pages: whether kernel code pages are present in kernel or module code regions where they aren't expected.
      • Unexpected system call handler: whether system call handlers are present in kernel or module code regions where they aren't expected.

    • Affected resource, especially the following field:

      • Resource full name: the full resource name of the affected VM instance, including the ID of the project that contains it.

  3. To see the complete JSON for this finding, in the detail view of the finding, click the JSON tab.

Step 2: Check logs

  1. In the Google Cloud console, go to Logs Explorer.

    Go to Logs Explorer

  2. On the Google Cloud console toolbar, select the project that contains the VM instance, as specified on the Resource full name row in the Summary tab of the finding details.

  3. Check the logs for signs of intrusion on the affected VM instance. For example, check for suspicious or unknown activities and signs of compromised credentials.

Step 3: Review permissions and settings

  1. On the Summary tab of the finding details, in the Resource full name field, click the link.
  2. Review the details of the VM instance, including the network and access settings.

Step 4: Inspect the affected VM

Follow the instructions in Inspect a VM for signs of kernel memory tampering.

Step 5: Research attack and response methods

  1. Review MITRE ATT&CK framework entries for Defense Evasion.
  2. To develop a response plan, combine your investigation results with MITRE research.

Step 6: Implement your response

The following response plan might be appropriate for this finding, but might also impact operations. Carefully evaluate the information you gather in your investigation to determine the best way to resolve findings.

  1. Contact the owner of the VM.

  2. If necessary, stop the compromised instance and replace it with a new instance.

  3. For forensic analysis, consider backing up the virtual machines and persistent disks. For more information, see Data protection options in the Compute Engine documentation.

  4. Delete the VM instance.

  5. For further investigation, consider using incident response services like Mandiant.

What's next