Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Dokumen ini menjelaskan jenis temuan ancaman di Security Command Center. Temuan ancaman dibuat oleh
pendeteksi ancaman saat mendeteksi
potensi ancaman di resource cloud Anda. Untuk daftar lengkap temuan ancaman yang tersedia, lihat Indeks temuan ancaman.
Ringkasan
Program dijalankan yang mengakses /etc/shadow atau SSH authorized_keys. Penyerang dapat mengakses file otorisasi untuk menyalin hash sandi. Detektor ini adalah detektor pemantauan file dan memiliki persyaratan versi GKE tertentu. Detektor ini dinonaktifkan secara default. Untuk mengetahui petunjuk tentang cara mengaktifkannya, lihat Menguji Container Threat Detection.
Buka temuan Credential Access: Access Sensitive Files On Nodes seperti yang diarahkan dalam
Meninjau temuan.
Tinjau detail di tab Ringkasan dan JSON.
Identifikasi temuan lain yang terjadi pada waktu yang serupa untuk resource ini.
Temuan terkait mungkin menunjukkan bahwa aktivitas ini berbahaya, bukan karena kegagalan mengikuti praktik terbaik.
Tinjau setelan resource yang terpengaruh.
Periksa log untuk resource yang terpengaruh.
Meneliti metode serangan dan respons
Tinjau entri framework MITRE ATT&CK untuk jenis temuan ini:
Credential Access.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-10 UTC."],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nA program was executed that accessed `/etc/shadow` or SSH `authorized_keys`. Attackers may access authorization files to copy password hashes. This is a file monitoring detector and has [specific GKE version requirements](/security-command-center/docs/how-to-use-container-threat-detection#gke-version). This detector is disabled by default. For instructions on how to enable it, see [Testing Container Threat Detection](/security-command-center/docs/how-to-test-container-threat-detection).\n\nDetection service\n\n[Container Threat Detection](/security-command-center/docs/concepts-container-threat-detection-overview)\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nReview finding details\n\n1. Open the `Credential Access: Access Sensitive Files On Nodes` finding as directed in\n [Reviewing findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings).\n Review the details in the **Summary** and **JSON** tabs.\n\n2. Identify other findings that occurred at a similar time for this resource.\n Related findings might indicate that this activity was malicious, instead of\n a failure to follow best practices.\n\n3. Review the settings of the affected resource.\n\n4. Check the logs for the affected resource.\n\nResearch attack and response methods\n\nReview the MITRE ATT\\&CK framework entry for this finding type:\n[Credential Access](https://attack.mitre.org/tactics/TA0006/).\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
