Índice de hallazgos de amenazas

Este documento te ayuda a encontrar los hallazgos de amenazas disponibles en Security Command Center. Usa el filtro para buscar categorías de hallazgos de amenazas, recursos de la nube supervisados o servicios de detección para obtener más detalles.

Nombre Categoría del recurso Servicio de detección
Active Scan: Log4j Vulnerable to RCE Red Event Threat Detection
Added Binary Executed Google Kubernetes Engine Detección de amenazas a contenedores
Added Library Loaded Google Kubernetes Engine Detección de amenazas a contenedores
Brute force SSH Compute Engine Event Threat Detection
Cloud IDS: THREAT_IDENTIFIER Red Event Threat Detection
Collection: Pam.d Modification Google Kubernetes Engine Detección de amenazas a contenedores
Command and Control: DNS Tunneling Red Event Threat Detection
Command and Control: Steganography Tool Detected Google Kubernetes Engine Detección de amenazas a contenedores
Credential Access: Access Sensitive Files On Nodes Google Kubernetes Engine Detección de amenazas a contenedores
Credential Access: CloudDB Failed login from Anonymizing Proxy IP Base de datos Event Threat Detection
Credential Access: Failed Attempt to Approve Kubernetes Certificate Signing Request (CSR) Google Kubernetes Engine Event Threat Detection
Credential Access: Find Google Cloud Credentials Google Kubernetes Engine Detección de amenazas a contenedores
Credential Access: GPG Key Reconnaissance Google Kubernetes Engine Detección de amenazas a contenedores
Credential Access: Manually Approved Kubernetes Certificate Signing Request (CSR) Google Kubernetes Engine Event Threat Detection
Credential Access: Search Private Keys or Passwords Google Kubernetes Engine Detección de amenazas a contenedores
Credential Access: Secrets Accessed In Kubernetes Namespace Google Kubernetes Engine Event Threat Detection
Defense Evasion: Anonymous Sessions Granted Cluster Admin Access Google Kubernetes Engine Event Threat Detection
Defense Evasion: Base64 ELF File Command Line Google Kubernetes Engine Detección de amenazas a contenedores
Defense Evasion: Base64 Encoded Python Script Executed Google Kubernetes Engine Detección de amenazas a contenedores
Defense Evasion: Base64 Encoded Shell Script Executed Google Kubernetes Engine Detección de amenazas a contenedores
Defense Evasion: Breakglass Workload Deployment Created Google Kubernetes Engine Event Threat Detection
Defense Evasion: Breakglass Workload Deployment Updated Google Kubernetes Engine Event Threat Detection
Defense Evasion: Disable or Modify Linux Audit System Google Kubernetes Engine Detección de amenazas a contenedores
Defense Evasion: GCS Bucket IP Filtering Modified Cloud Storage Event Threat Detection
Defense Evasion: Launch Code Compiler Tool In Container Google Kubernetes Engine Detección de amenazas a contenedores
Defense Evasion: Manually Deleted Certificate Signing Request (CSR) Google Kubernetes Engine Event Threat Detection
Defense Evasion: Modify VPC Service Control IAM Event Threat Detection
Defense Evasion: Organization-Level Service Account Token Creator Role Added IAM Event Threat Detection
Defense Evasion: Potential Kubernetes Pod Masquerading Google Kubernetes Engine Event Threat Detection
Defense Evasion: Project HTTP Policy Block Disabled Cloud Storage Event Threat Detection
Defense Evasion: Project-Level Service Account Token Creator Role Added IAM Event Threat Detection
Defense Evasion: Root Certificate Installed Google Kubernetes Engine Detección de amenazas a contenedores
Defense Evasion: Rootkit Compute Engine Virtual Machine Threat Detection
Defense Evasion: Static Pod Created Google Kubernetes Engine Event Threat Detection
Defense Evasion: Unexpected ftrace handler Compute Engine Virtual Machine Threat Detection
Defense Evasion: Unexpected interrupt handler Compute Engine Virtual Machine Threat Detection
Defense Evasion: Unexpected kernel modules Compute Engine Virtual Machine Threat Detection
Defense Evasion: Unexpected kernel read-only data modification Compute Engine Virtual Machine Threat Detection
Defense Evasion: Unexpected kprobe handler Compute Engine Virtual Machine Threat Detection
Defense Evasion: Unexpected processes in runqueue Compute Engine Virtual Machine Threat Detection
Defense Evasion: Unexpected system call handler Compute Engine Virtual Machine Threat Detection
Defense Evasion: VPC Route Masquerade Attempt Red Event Threat Detection
Discovery: Can get sensitive Kubernetes object check Google Kubernetes Engine Event Threat Detection
Discovery: Information Gathering Tool Used IAM Event Threat Detection
Discovery: Service Account Self-Investigation IAM Event Threat Detection
Discovery: Unauthorized Service Account API Call IAM Event Threat Detection
Evasion: Access from Anonymizing Proxy IAM Event Threat Detection
Execution: Added Malicious Binary Executed Google Kubernetes Engine Detección de amenazas a contenedores
Execution: Added Malicious Library Loaded Google Kubernetes Engine Detección de amenazas a contenedores
Execution: Built in Malicious Binary Executed Google Kubernetes Engine Detección de amenazas a contenedores
Execution: Container Escape Google Kubernetes Engine Detección de amenazas a contenedores
Execution: cryptocurrency mining combined detection Compute Engine Virtual Machine Threat Detection
Execution: Cryptocurrency Mining Hash Match Compute Engine Virtual Machine Threat Detection
Execution: Cryptocurrency Mining YARA Rule Compute Engine Virtual Machine Threat Detection
Execution: Cryptomining Docker Image Cloud Run Event Threat Detection
Execution: Fileless Execution in /memfd: Google Kubernetes Engine Detección de amenazas a contenedores
Execution: GKE launch excessively capable container Google Kubernetes Engine Event Threat Detection
Execution: Ingress Nightmare Vulnerability Exploitation Google Kubernetes Engine Detección de amenazas a contenedores
Execution: Kubernetes Attack Tool Execution Google Kubernetes Engine Detección de amenazas a contenedores
Execution: Kubernetes Pod Created with Potential Reverse Shell Arguments Google Kubernetes Engine Event Threat Detection
Execution: Local Reconnaissance Tool Execution Google Kubernetes Engine Detección de amenazas a contenedores
Execution: Malicious Python executed Google Kubernetes Engine Detección de amenazas a contenedores
Execution: Modified Malicious Binary Executed Google Kubernetes Engine Detección de amenazas a contenedores
Execution: Modified Malicious Library Loaded Google Kubernetes Engine Detección de amenazas a contenedores
Execution: Netcat Remote Code Execution in Container Google Kubernetes Engine Detección de amenazas a contenedores
Execution: Possible Remote Command Execution Detected Google Kubernetes Engine Detección de amenazas a contenedores
Execution: Program Run with Disallowed HTTP Proxy Env Google Kubernetes Engine Detección de amenazas a contenedores
Execution: Suspicious Cron Modification Google Kubernetes Engine Detección de amenazas a contenedores
Execution: Suspicious Exec or Attach to a System Pod Google Kubernetes Engine Event Threat Detection
Execution: Suspicious OpenSSL Shared Object Loaded Google Kubernetes Engine Detección de amenazas a contenedores
Execution: Workload triggered in sensitive namespace Google Kubernetes Engine Event Threat Detection
Exfiltration: Cloud SQL Data Exfiltration Base de datos Event Threat Detection
Exfiltration: Cloud SQL Over-Privileged Grant Base de datos Event Threat Detection
Exfiltration: Cloud SQL Restore Backup to External Organization Base de datos Event Threat Detection
Exfiltration: BigQuery Data Exfiltration BigQuery Event Threat Detection
Exfiltration: BigQuery Data Extraction BigQuery Event Threat Detection
Exfiltration: BigQuery Data to Google Drive BigQuery Event Threat Detection
Exfiltration: Launch Remote File Copy Tools in Container Google Kubernetes Engine Detección de amenazas a contenedores
Exfiltration: Move to Public BigQuery resource BigQuery Event Threat Detection
Impact: Billing Disabled IAM Event Threat Detection
Impact: Billing Disabled IAM Event Threat Detection
Impact: Cryptomining Commands Cloud Run Event Threat Detection
Impact: Deleted Google Cloud Backup and DR Backup Backup and DR Event Threat Detection
Impact: Deleted Google Cloud Backup and DR host Backup and DR Event Threat Detection
Impact: Deleted Google Cloud Backup and DR plan association Backup and DR Event Threat Detection
Impact: Deleted Google Cloud Backup and DR Vault Backup and DR Event Threat Detection
Impact: Detect Malicious Cmdlines Google Kubernetes Engine Detección de amenazas a contenedores
Impact: GKE kube-dns modification detected Google Kubernetes Engine Event Threat Detection
Impact: Google Cloud Backup and DR delete policy Backup and DR Event Threat Detection
Impact: Google Cloud Backup and DR delete profile Backup and DR Event Threat Detection
Impact: Google Cloud Backup and DR delete storage pool Backup and DR Event Threat Detection
Impact: Google Cloud Backup and DR delete template Backup and DR Event Threat Detection
Impact: Google Cloud Backup and DR expire all images Backup and DR Event Threat Detection
Impact: Google Cloud Backup and DR expire image Backup and DR Event Threat Detection
Impact: Google Cloud Backup and DR reduced backup expiration Backup and DR Event Threat Detection
Impact: Google Cloud Backup and DR reduced backup frequency Backup and DR Event Threat Detection
Impact: Google Cloud Backup and DR remove appliance Backup and DR Event Threat Detection
Impact: Google Cloud Backup and DR remove plan Backup and DR Event Threat Detection
Impact: Managed Instance Group Autoscaling Set To Maximum Compute Engine Event Threat Detection
Impact: Remove Bulk Data From Disk Google Kubernetes Engine Detección de amenazas a contenedores
Impact: Service API Disabled IAM Event Threat Detection
Impact: Suspicious crypto mining activity using the Stratum Protocol Google Kubernetes Engine Detección de amenazas a contenedores
Impact: Suspicious Kubernetes Container Names - Cryptocurrency Mining Google Kubernetes Engine Event Threat Detection
Impact: VPC Firewall High Priority Block Red Event Threat Detection
Impact: VPC Firewall Mass Rule Deletion Red Event Threat Detection
Persistence: Strong Authentication Disabled Google Workspace Event Threat Detection
Initial Access: Account Disabled Hijacked Google Workspace Event Threat Detection
Initial Access: Anonymous GKE Resource Created from the Internet Google Kubernetes Engine Event Threat Detection
Initial Access: CloudDB Successful login from Anonymizing Proxy IP Base de datos Event Threat Detection
Initial Access: Database Superuser Writes to User Tables Base de datos Event Threat Detection
Initial Access: Disabled Password Leak Google Workspace Event Threat Detection
Initial Access: Dormant Service Account Action IAM Event Threat Detection
Initial Access: Dormant Service Account Activity in AI Service AI Event Threat Detection
Initial Access: Dormant Service Account Key Created IAM Event Threat Detection
Initial Access: Excessive Permission Denied Actions IAM Event Threat Detection
Initial Access: GKE NodePort service created Google Kubernetes Engine Event Threat Detection
Initial Access: GKE Resource Modified Anonymously from the Internet Google Kubernetes Engine Event Threat Detection
Initial Access: Government Based Attack Google Workspace Event Threat Detection
Initial Access: Log4j Compromise Attempt Red Event Threat Detection
Initial Access: Successful API call made from a TOR proxy IP Google Kubernetes Engine Event Threat Detection
Initial Access: Suspicious Login Blocked Google Workspace Event Threat Detection
Lateral Movement: Modified Boot Disk Attached to Instance Compute Engine Event Threat Detection
Lateral Movement: OS Patch Execution From Service Account Compute Engine Event Threat Detection
Log4j Malware: Bad Domain Red Event Threat Detection
Log4j Malware: Bad IP Red Event Threat Detection
Malicious Script Executed Google Kubernetes Engine Detección de amenazas a contenedores
Malicious URL Observed Google Kubernetes Engine Detección de amenazas a contenedores
Malware: bad domain Red Event Threat Detection
Malware: bad IP Red Event Threat Detection
Malware: Cryptomining Bad Domain Red Event Threat Detection
Malware: Cryptomining Bad IP Red Event Threat Detection
Malware: Malicious file on disk Amazon EC2 Virtual Machine Threat Detection
Malware: Malicious file on disk (YARA) Compute Engine Virtual Machine Threat Detection
Persistence: IAM Anomalous Grant IAM Event Threat Detection
Persistence: GCE Admin Added SSH Key Compute Engine Event Threat Detection
Persistence: GCE Admin Added Startup Script Compute Engine Event Threat Detection
Persistence: GKE Webhook Configuration Detected Google Kubernetes Engine Event Threat Detection
Persistence: Global Startup Script Added Compute Engine Event Threat Detection
Persistence: Modify ld.so.preload Google Kubernetes Engine Detección de amenazas a contenedores
Persistence: New AI API Method AI Event Threat Detection
Persistence: New API Method IAM Event Threat Detection
Persistence: New Geography IAM Event Threat Detection
Persistence: New Geography for AI Service AI Event Threat Detection
Persistence: New User Agent IAM Event Threat Detection
Persistence: Service Account Created in sensitive namespace Google Kubernetes Engine Event Threat Detection
Persistence: Service Account Key Created IAM Event Threat Detection
Persistence: SSO Enablement Toggle Google Workspace Event Threat Detection
Persistence: SSO Settings Changed Google Workspace Event Threat Detection
Persistence: Two Step Verification Disabled Google Workspace Event Threat Detection
Persistence: Unmanaged Account Granted Sensitive Role IAM Event Threat Detection
Privilege Escalation: AlloyDB Database Superuser Writes to User Tables Base de datos Event Threat Detection
Privilege Escalation: AlloyDB Over-Privileged Grant Base de datos Event Threat Detection
Privilege Escalation: Anomalous Impersonation of Service Account for Admin Activity IAM Event Threat Detection
Privilege Escalation: Anomalous Impersonation of Service Account for AI Admin Activity AI Event Threat Detection
Privilege Escalation: Anomalous Multistep Service Account Delegation for Admin Activity IAM Event Threat Detection
Privilege Escalation: Anomalous Multistep Service Account Delegation for AI Admin Activity AI Event Threat Detection
Privilege Escalation: Anomalous Multistep Service Account Delegation for AI Data Access AI Event Threat Detection
Privilege Escalation: Anomalous Multistep Service Account Delegation for Data Access IAM Event Threat Detection
Privilege Escalation: Anomalous Service Account Impersonator for Admin Activity IAM Event Threat Detection
Privilege Escalation: Anomalous Service Account Impersonator for AI Admin Activity AI Event Threat Detection
Privilege Escalation: Anomalous Service Account Impersonator for AI Data Access AI Event Threat Detection
Privilege Escalation: Anomalous Service Account Impersonator for Data Access IAM Event Threat Detection
Privilege Escalation: Changes to sensitive Kubernetes RBAC objects Google Kubernetes Engine Event Threat Detection
Privilege Escalation: ClusterRole with Privileged Verbs Google Kubernetes Engine Event Threat Detection
Privilege Escalation: ClusterRoleBinding to Privileged Role Google Kubernetes Engine Event Threat Detection
Privilege Escalation: Create Kubernetes CSR for master cert Google Kubernetes Engine Event Threat Detection
Privilege Escalation: Creation of sensitive Kubernetes bindings Google Kubernetes Engine Event Threat Detection
Privilege Escalation: Default Compute Engine Service Account SetIAMPolicy Cloud Run Event Threat Detection
Privilege Escalation: Dormant Service Account Granted Sensitive Role IAM Event Threat Detection
Privilege Escalation: Effectively Anonymous Users Granted GKE Cluster Access Google Kubernetes Engine Event Threat Detection
Privilege Escalation: External Member Added To Privileged Group IAM Event Threat Detection
Privilege Escalation: Fileless Execution in /dev/shm Google Kubernetes Engine Detección de amenazas a contenedores
Privilege Escalation: Get Kubernetes CSR with compromised bootstrap credentials Google Kubernetes Engine Event Threat Detection
Privilege Escalation: Global Shutdown Script Added Compute Engine Event Threat Detection
Privilege Escalation: Impersonation Role Granted For Dormant Service Account IAM Event Threat Detection
Privilege Escalation: Launch of privileged Kubernetes container Google Kubernetes Engine Event Threat Detection
Privilege Escalation: New Service Account is Owner or Editor IAM Event Threat Detection
Privilege Escalation: Privileged Group Opened To Public IAM Event Threat Detection
Privilege Escalation: Sensitive Role Granted To Hybrid Group IAM Event Threat Detection
Privilege Escalation: Suspicious Cross-Project Permission Use IAM Event Threat Detection
Privilege Escalation: Suspicious Kubernetes Container Names - Exploitation and Escape Google Kubernetes Engine Event Threat Detection
Privilege Escalation: Suspicious Token Generation IAM Event Threat Detection
Privilege Escalation: Suspicious Token Generation IAM Event Threat Detection
Privilege Escalation: Suspicious Token Generation IAM Event Threat Detection
Privilege Escalation: Suspicious Token Generation IAM Event Threat Detection
Privilege Escalation: Workload Created with a Sensitive Host Path Mount Google Kubernetes Engine Event Threat Detection
Privilege Escalation: Workload with shareProcessNamespace enabled Google Kubernetes Engine Event Threat Detection
Resource Development: Offensive Security Distro Activity IAM Event Threat Detection
Reverse Shell Google Kubernetes Engine Detección de amenazas a contenedores
Unexpected Child Shell Google Kubernetes Engine Detección de amenazas a contenedores
Initial Access: Leaked Service Account Key Used IAM Event Threat Detection
Account has leaked credentials IAM Detección de anomalías
Defense Evasion: Organization Policy Changed IAM Servicio de acciones sensibles
Defense Evasion: Remove Billing Admin IAM Servicio de acciones sensibles
Impact: GPU Instance Created Compute Engine Servicio de acciones sensibles
Impact: Many Instances Created Compute Engine Servicio de acciones sensibles
Impact: Many Instances Deleted Compute Engine Servicio de acciones sensibles
Persistence: Add Sensitive Role IAM Servicio de acciones sensibles
Persistence: Project SSH Key Added IAM Servicio de acciones sensibles
Execution: Added Malicious Binary Executed Cloud Run Detección de amenazas de Cloud Run
Execution: Added Malicious Library Loaded Cloud Run Detección de amenazas de Cloud Run
Execution: Built in Malicious Binary Executed Cloud Run Detección de amenazas de Cloud Run
Execution: Container Escape Cloud Run Detección de amenazas de Cloud Run
Execution: Kubernetes Attack Tool Execution Cloud Run Detección de amenazas de Cloud Run
Execution: Local Reconnaissance Tool Execution Cloud Run Detección de amenazas de Cloud Run
Execution: Malicious Python executed Cloud Run Detección de amenazas de Cloud Run
Execution: Modified Malicious Binary Executed Cloud Run Detección de amenazas de Cloud Run
Execution: Modified Malicious Library Loaded Cloud Run Detección de amenazas de Cloud Run
Malicious Script Executed Cloud Run Detección de amenazas de Cloud Run
Malicious URL Observed Cloud Run Detección de amenazas de Cloud Run
Reverse Shell Cloud Run Detección de amenazas de Cloud Run
Unexpected Child Shell Cloud Run Detección de amenazas de Cloud Run
Execution: Possible Arbitrary Command Execution through CUPS (CVE-2024-47177) Google Kubernetes Engine Detección de amenazas a contenedores
Execution: Socat Reverse Shell Detected Google Kubernetes Engine Detección de amenazas a contenedores
Privilege Escalation: Abuse of Sudo For Privilege Escalation (CVE-2019-14287) Google Kubernetes Engine Detección de amenazas a contenedores
Privilege Escalation: Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034) Google Kubernetes Engine Detección de amenazas a contenedores
Privilege Escalation: Sudo Potential Privilege Escalation (CVE-2021-3156) Google Kubernetes Engine Detección de amenazas a contenedores