Cloud Run Threat Detection is a built-in service of Security Command Center that continuously monitors the state of supported Cloud Run resources to detect the most common runtime attacks. If Cloud Run Threat Detection detects an attack, it generates a finding in Security Command Center in near real-time.
Cloud Run Threat Detection runtime detectors monitor Cloud Run resources for suspicious binaries and libraries and use natural language processing (NLP) to detect malicious Bash and Python code.
In addition, control plane detectors are available through Event Threat Detection. These detectors monitor the Cloud Logging stream of your organization or projects to detect potential attacks to the control plane of your Cloud Run resources.
Supported resources
Cloud Run Threat Detection monitors the following resources:
Supported execution environments
The supported execution environments differ for runtime detectors and control plane detectors.
Supported execution environments for runtime detectors
Cloud Run Threat Detection runtime detectors support only Cloud Run resources that run on the second generation execution environment. Consider the following before enabling Cloud Run Threat Detection:
When you enable Cloud Run Threat Detection, you can't create a Cloud Run service or service revision that runs on the first generation execution environment. The Cloud Run service must use the second generation execution environment. We recommend that you test your workloads on the second generation execution environment before enabling Cloud Run Threat Detection.
To enable runtime threat detection for a service, deploy a revision that sets the execution environment of the service to either the second generation or the default execution environment.
Supported execution environments for control plane detectors
The control plane detectors support both first and second generation execution environments.
How Cloud Run Threat Detection runtime threat detection works
When you enable Cloud Run Threat Detection, it collects telemetry from the supported Cloud Run resources to analyze processes, scripts, and libraries that might indicate a runtime attack. The following is the execution path when events are detected:
- Cloud Run Threat Detection uses a watcher process to collect container and event information for the complete duration of a Cloud Run workload.
Cloud Run Threat Detection analyzes the collected event information to determine whether an event is indicative of an incident. It uses NLP to analyze Bash and Python scripts for malicious code.
If Cloud Run Threat Detection identifies an incident, it reports the incident as a finding in Security Command Center.
If Cloud Run Threat Detection doesn't identify an incident, no information is stored.
All data collected is ephemeral and isn't persistently stored.
For information about how to review Cloud Run Threat Detection findings in the Google Cloud console, see Review findings.
Known issues
- If the watcher process prematurely stops in a running instance of your Cloud Run service or job, the watcher process doesn't restart. The instance stops sending telemetry information to Cloud Run Threat Detection. Cloud Run Threat Detection logs are absent from the instance logs. There's no indicator that a watcher process has stopped.
Detectors
This section lists the runtime and control plane detectors that are available. We regularly add new detectors as new cloud threats emerge.
Runtime detectors
Cloud Run Threat Detection includes the following runtime detectors:
| Display name | API name | Description |
|---|---|---|
| Command and Control: Steganography Tool Detected | CLOUD_RUN_STEGANOGRAPHY_TOOL_DETECTED |
A program was executed that is identified as a steganography tool commonly found in Unix-like environments, indicating a potential attempt to conceal communication or data transfer. Attackers might utilize steganographic techniques to embed malicious command and control (C2) instructions or exfiltrated data within seemingly benign digital files, aiming to evade standard security monitoring and detection. Identifying the use of such tools is crucial for uncovering hidden malicious activity. |
| Credential Access: Find Google Cloud Credentials | CLOUD_RUN_FIND_GCP_CREDENTIALS |
A command was executed to search for Google Cloud private keys, passwords, or other sensitive credentials within the container environment. An attacker could use stolen Google Cloud credentials to gain illegitimate access to sensitive data or resources within the targeted Google Cloud environment. |
| Credential Access: GPG Key Reconnaissance | CLOUD_RUN_GPG_KEY_RECONNAISSANCE |
A command was executed to search for GPG security keys. An attacker could use stolen GPG security keys to gain unauthorized access to encrypted communications or files. |
| Credential Access: Search Private Keys or Passwords | CLOUD_RUN_SEARCH_PRIVATE_KEYS_OR_PASSWORDS |
A command was executed to search for private keys, passwords, or other sensitive credentials within the container environment, indicating a potential attempt to harvest authentication data. Attackers often search for credential files to gain unauthorized access to systems, escalate privileges, or move laterally within the environment. Detecting such activity is critical to preventing security breaches. |
| Defense Evasion: Base64 ELF File Command Line | CLOUD_RUN_BASE64_ELF_FILE_CMDLINE |
A process was executed that contains an argument that is an ELF (Executable and Linkable Format) file. If an encoded ELF file execution is detected, it's a signal that an attacker is trying to encode binary data for transfer to ASCII-only command lines. Attackers can use this technique to evade detection and run malicious code embedded in an ELF file. |
| Defense Evasion: Base64 Encoded Python Script Executed | CLOUD_RUN_BASE64_ENCODED_PYTHON_SCRIPT_EXECUTED |
A process was executed that contains an argument that is a base64- encoded python script. If an encoded python script execution is detected, it's a signal that an attacker is trying to encode binary data for transfer to ASCII-only command lines. Attackers can use this technique to evade detection and run malicious code embedded in a python script. |
| Defense Evasion: Base64 Encoded Shell Script Executed | CLOUD_RUN_BASE64_ENCODED_SHELL_SCRIPT_EXECUTED |
A process was executed that contains an argument that is a base64- encoded shell script. If an encoded shell script execution is detected, it's a signal that an attacker is trying to encode binary data for transfer to ASCII-only command lines. Attackers can use this technique to evade detection and run malicious code embedded in a shell script. |
| Defense Evasion: Launch Code Compiler Tool In Container | CLOUD_RUN_LAUNCH_CODE_COMPILER_TOOL_IN_CONTAINER |
A process was initiated to launch a code compiler tool within the container environment, indicating a potential attempt to build or modify executable code in an isolated context. Attackers might use code compilers within containers to develop malicious payloads, inject code into existing binaries, or create tools to bypass security controls, all while operating in a less scrutinized environment to evade detection on the host system. |
| Execution: Added Malicious Binary Executed | CLOUD_RUN_ADDED_MALICIOUS_BINARY_EXECUTED |
A binary that meets the following conditions was executed:
If an added malicious binary is executed, it's a strong sign that an attacker has control of the workload and they're executing malicious software. |
| Execution: Added Malicious Library Loaded | CLOUD_RUN_ADDED_MALICIOUS_LIBRARY_LOADED |
A library that meets the following conditions was loaded:
If an added malicious library is loaded, it's a strong sign that an attacker has control of the workload and they're executing malicious software. |
| Execution: Built in Malicious Binary Executed | CLOUD_RUN_BUILT_IN_MALICIOUS_BINARY_EXECUTED |
A binary that meets the following conditions was executed:
If a built-in malicious binary is executed, it's a sign that the attacker is deploying malicious containers. They may have gained control of a legitimate image repository or container build pipeline and injected a malicious binary into the container image. |
| Execution: Container Escape | CLOUD_RUN_CONTAINER_ESCAPE |
A process was executed within the container that attempted to break out of the container's isolation, using known escape techniques or binaries. This type of attack can give the attacker access to the host system. These processes are identified as potential threats based on intelligence data. If a container escape attempt is detected, it might indicate that an attacker is exploiting vulnerabilities to break out of the container. As a result, the attacker might gain unauthorized access to the host system or broader infrastructure, compromising the entire environment. |
| Execution: Fileless Execution in /memfd: | CLOUD_RUN_FILELESS_EXECUTION_DETECTION_MEMFD |
A process was executed using an in-memory file descriptor. If a process is launched from an in-memory file, it might indicate that an attacker is trying to bypass other methods of detection in order to execute malicious code. |
| Execution: Kubernetes Attack Tool Execution | CLOUD_RUN_KUBERNETES_ATTACK_TOOL_EXECUTION |
A Kubernetes-specific attack tool was executed within the environment, which can indicate that an attacker is targeting Kubernetes cluster components. These attack tools are identified as potential threats based on intelligence data. If an attack tool is executed within the Kubernetes environment, it can suggest that an attacker has gained access to the cluster and is using the tool to exploit Kubernetes-specific vulnerabilities or configurations. |
| Execution: Local Reconnaissance Tool Execution | CLOUD_RUN_LOCAL_RECONNAISSANCE_TOOL_EXECUTION |
A local reconnaissance tool not typically associated with the container or environment was executed, suggesting an attempt to gather internal system information. These reconnaissance tools are identified as potential threats based on intelligence data. If a reconnaissance tool is executed, it suggests that the attacker may be trying to map out the infrastructure, identify vulnerabilities, or collect data on system configurations to plan their next steps. |
| Execution: Malicious Python executed | CLOUD_RUN_MALICIOUS_PYTHON_EXECUTED |
A machine learning model identified the specified Python code as malicious. Attackers can use Python to transfer tools or other files from an external system into a compromised environment and execute commands without binaries. The detector uses NLP techniques to evaluate the content of executed Python code. Because this approach isn't based on signatures, detectors can identify known and novel Python code. |
| Execution: Modified Malicious Binary Executed | CLOUD_RUN_MODIFIED_MALICIOUS_BINARY_EXECUTED |
A binary that meets the following conditions was executed:
If a modified malicious binary is executed, it's a strong sign that an attacker has control of the workload and they're executing malicious software. |
| Execution: Modified Malicious Library Loaded | CLOUD_RUN_MODIFIED_MALICIOUS_LIBRARY_LOADED |
A library that meets the following conditions was loaded:
If a modified malicious library is loaded, it's a strong sign that an attacker has control of the workload and they're executing malicious software. |
| Execution: Netcat Remote Code Execution in Container | CLOUD_RUN_NETCAT_REMOTE_CODE_EXECUTION_IN_CONTAINER |
Netcat, a versatile networking utility, was executed within the container environment, potentially indicating an attempt to establish unauthorized remote access or exfiltrate data. The use of Netcat in a containerized environment may signal an attacker's effort to create a reverse shell, enable lateral movement, or execute arbitrary commands, which could compromise system integrity. |
| Execution: Possible Arbitrary Command Execution through CUPS (CVE-2024-47177) | CLOUD_RUN_POSSIBLE_ARBITRARY_COMMAND_EXECUTION_THROUGH_CUPS |
This rule detects the |
| Execution: Possible Remote Command Execution Detected | CLOUD_RUN_POSSIBLE_REMOTE_COMMAND_EXECUTION_DETECTED |
A process was detected spawning common UNIX commands through a network socket connection, indicating a potential attempt to establish unauthorized remote command execution capabilities. Attackers frequently utilize techniques that mimic reverse shells to gain interactive control over a compromised system, allowing them to execute arbitrary commands remotely and bypass standard network security measures like firewall restrictions. Detecting command execution over a socket is a strong indicator of malicious remote access. |
| Execution: Program Run with Disallowed HTTP Proxy Env | CLOUD_RUN_PROGRAM_RUN_WITH_DISALLOWED_HTTP_PROXY_ENV |
A program was executed with an HTTP proxy environment variable that is disallowed. This can indicate an attempt to bypass security controls, redirect traffic for malicious purposes, or exfiltrate data through unauthorized channels. Attackers may configure disallowed HTTP proxies to intercept sensitive information, route traffic through malicious servers, or establish covert communication channels. Detecting the execution of programs with these environment variables is crucial for maintaining network security and preventing data breaches. |
| Execution: Socat Reverse Shell Detected | CLOUD_RUN_SOCAT_REVERSE_SHELL_DETECTED |
The
This rule detects the execution |
| Execution: Suspicious OpenSSL Shared Object Loaded | CLOUD_RUN_SUSPICIOUS_OPENSSL_SHARED_OBJECT_LOADED |
OpenSSL has been executed to load a custom shared object. Attackers may load custom libraries and replace existing libraries used by OpenSSL in order to run malicious code. Its use in production is uncommon and should warrant an immediate investigation. |
| Exfiltration: Launch Remote File Copy Tools in Container | CLOUD_RUN_LAUNCH_REMOTE_FILE_COPY_TOOLS_IN_CONTAINER |
A remote file copy tool execution was detected within the container, indicating potential data exfiltration, lateral movement, or the deployment of malicious payloads. Attackers often use these tools to transfer sensitive data outside of the container, move laterally within the network to compromise other systems, or introduce malware for further malicious activities. Detecting the use of remote file copy tools is crucial for preventing data breaches, unauthorized access, and further compromise of the container and potentially the host system. |
| Impact: Detect Malicious Cmdlines | CLOUD_RUN_DETECT_MALICIOUS_CMDLINES |
A command was executed with arguments known to be potentially destructive, such as attempts to delete critical system files or modify password-related configurations. Attackers may issue malicious command lines to cause system instability, prevent recovery by deleting essential files, or gain unauthorized access by manipulating user credentials. Detecting these specific command patterns is critical to preventing significant system impact. |
| Impact: Remove Bulk Data From Disk | CLOUD_RUN_REMOVE_BULK_DATA_FROM_DISK |
A process was detected performing bulk data deletion operations, which might indicate an attempt to erase evidence, disrupt services, or execute a data-wiping attack within the container environment. Attackers may remove large volumes of data to cover their tracks, sabotage operations, or prepare for ransomware deployment. Detecting such activity helps in identifying potential threats before critical data loss occurs. |
| Impact: Suspicious cryptocurrency mining activity using the Stratum Protocol | CLOUD_RUN_SUSPICIOUS_CRYPTO_MINING_ACTIVITY_USING_STRATUM_PROTOCOL |
A process was detected communicating over the Stratum protocol, which is commonly used by cryptocurrency mining software. This activity suggests potential unauthorized mining operations within the container environment. Attackers often deploy cryptocurrency miners to exploit system resources for financial gain, leading to degraded performance, increased operational costs, and potential security risks. Detecting such activity helps mitigate resource abuse and unauthorized access. |
| Malicious Script Executed | CLOUD_RUN_MALICIOUS_SCRIPT_EXECUTED |
A machine learning model identified the specified Bash code as malicious. Attackers can use Bash to transfer tools or other files from an external system into a compromised environment and execute commands without binaries. The detector uses NLP techniques to evaluate the content of executed Bash code. Because this approach isn't based on signatures, detectors can identify known and novel malicious Bash code. |
| Malicious URL Observed | CLOUD_RUN_MALICIOUS_URL_OBSERVED |
Cloud Run Threat Detection observed a malicious URL in the argument list of a running process. The detector checks URLs that are observed in the argument list of running processes against the lists of unsafe web resources that are maintained by the Google Safe Browsing service. If a URL is incorrectly classified as a phishing site or malware, report it at Reporting Incorrect Data. |
| Privilege Escalation: Abuse of Sudo For Privilege Escalation (CVE-2019-14287) | CLOUD_RUN_ABUSE_SUDO_FOR_PRIVILEGE_ESCALATION |
This detection notifies an attempt of the exploitation of
CVE-2019-14287, which allows privilege escalation through abusing the
|
| Privilege Escalation: Fileless Execution in /dev/shm | CLOUD_RUN_FILELESS_EXECUTION_DETECTION_SHM |
A process has been executed from a path within
Executing a file from |
| Privilege Escalation: Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034) | CLOUD_RUN_POLKIT_LOCAL_PRIVILEGE_ESCALATION_VULNERABILITY |
A non-root user has executed
This rule detects an attempt to exploit a privilege escalation
vulnerability (CVE-2021-4034) in Polkit's |
| Privilege Escalation: Sudo Potential Privilege Escalation (CVE-2021-3156) | CLOUD_RUN_SUDO_POTENTIAL_PRIVILEGE_ESCALATION |
A non-root user has executed
Detects an attempt to exploit a vulnerability affecting
|
| Reverse Shell | CLOUD_RUN_REVERSE_SHELL |
A process started with stream redirection to a remote connected
socket. The detector looks for With a reverse shell, an attacker can communicate from a compromised workload to an attacker-controlled machine. The attacker can then command and control the workload—for example, as part of a botnet. |
| Unexpected Child Shell | CLOUD_RUN_UNEXPECTED_CHILD_SHELL |
A process that does not normally invoke shells spawned a shell process. The detector monitors all process executions. When a shell is invoked, the detector generates a finding if the parent process is known to not typically invoke shells. |
Control plane detectors
The following control plane detectors are available through Event Threat Detection. These detectors are enabled by default. You manage these detectors the same way you do other Event Threat Detection detectors. For more information, see Use Event Threat Detection.
| Display name | API name | Log source types | Description |
|---|---|---|---|
| Impact: Cryptomining Commands | CLOUD_RUN_JOBS_CRYPTOMINING_COMMANDS |
Cloud Audit Logs: IAM System Event audit logs |
Specific cryptomining commands were attached to a Cloud Run job during execution. Findings are classified as High severity by default. |
| Execution: Cryptomining Docker Image | CLOUD_RUN_CRYPTOMINING_DOCKER_IMAGES |
Cloud Audit Logs: IAM System Event audit logs |
Specific known bad docker images were attached to a new or existing Cloud Run service or job. Findings are classified as High severity by default. |
| Privilege Escalation: Default Compute Engine Service Account SetIAMPolicy | CLOUD_RUN_SERVICES_SET_IAM_POLICY |
Cloud Audit Logs: Admin Activity logs |
The default Compute Engine service account was used to set the IAM policy for a Cloud Run service. This is a potential post exploit action when a Compute Engine token is compromised from a serverless service. Findings are classified as Low severity by default. |
What's next
- Learn how to use Cloud Run Threat Detection.
- Learn how to use Event Threat Detection.
- Learn how to respond to Cloud Run threat findings.
- Refer to the Threat findings index.