Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Dokumen ini menjelaskan jenis temuan ancaman di Security Command Center. Temuan ancaman dibuat oleh
pendeteksi ancaman saat mendeteksi
potensi ancaman di resource cloud Anda. Untuk daftar lengkap temuan ancaman yang tersedia, lihat Indeks temuan ancaman.
Ringkasan
Aktivitas admin yang tidak biasa oleh aktor yang berpotensi berbahaya terdeteksi di organisasi, folder, atau project. Aktivitas tidak normal dapat berupa salah satu dari hal berikut:
Aktivitas baru oleh akun utama di organisasi, folder, atau project
Aktivitas yang belum dilihat dalam waktu lama oleh prinsipal di organisasi, folder, atau project
Cara merespons
Untuk menanggapi temuan ini, lakukan hal berikut:
Langkah 1: Tinjau detail temuan
Buka temuan Persistence: New API Method seperti yang diarahkan dalam Meninjau temuan.
Di detail temuan, pada tab Ringkasan, catat nilai kolom berikut:
Di bagian Yang terdeteksi:
Email utama: akun yang melakukan panggilan
Nama layanan: nama API layanan Google Cloud yang digunakan dalam tindakan
Nama metode: metode yang dipanggil
Di bagian Resource yang terpengaruh:
Nama tampilan resource: nama resource yang terpengaruh, yang bisa sama dengan nama organisasi, folder, atau project
Jalur resource: lokasi dalam hierarki resource tempat aktivitas terjadi
Langkah 2: Meneliti metode serangan dan respons
Tinjau entri framework MITRE ATT&CK untuk jenis temuan ini: Persistensi.
Selidiki apakah tindakan tersebut diperlukan di organisasi, folder, atau project dan apakah tindakan tersebut dilakukan oleh pemilik akun yang sah. Organisasi, folder, atau project ditampilkan di baris Jalur resource dan akun ditampilkan di baris Email utama.
Untuk mengembangkan rencana respons, gabungkan hasil penyelidikan Anda dengan riset MITRE.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-05 UTC."],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nAnomalous admin activity by a potentially malicious actor was detected in an\norganization, folder, or project. Anomalous activity can be either of the following:\n\n- New activity by a principal in an organization, folder, or project\n- Activity that has not been seen in a while by a principal in an organization, folder, or project\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nStep 1: Review finding details\n\n1. Open the `Persistence: New API Method` finding as directed in [Reviewing findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings).\n2. In the finding details, on the **Summary** tab, note the values of the following fields:\n\n - Under **What was detected** :\n - **Principal email**: the account that made the call\n - **Service name**: the API name of the Google Cloud service used in the action\n - **Method name**: the method that was called\n - Under **Affected resource** :\n - **Resource display name**: the name of the affected resource, which could be the same as the name of the organization, folder, or project\n - **Resource path**: the location in the resource hierarchy where the activity took place\n\nStep 2: Research attack and response methods\n\n1. Review MITRE ATT\\&CK framework entries for this finding type: **Persistence**.\n2. Investigate whether the action was warranted in the organization, folder, or project and whether the action was taken by the legitimate owner of the account. The organization, folder, or project is displayed on the **Resource path** row and the account is displayed on the **Principal email** row.\n3. To develop a response plan, combine your investigation results with MITRE research.\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
