리소스 전체 이름에서 이름 및 영역이 일치하는 VM 인스턴스를 클릭합니다.
네트워크 및 액세스 설정을 포함한 인스턴스 세부정보를 검토합니다.
탐색 창에서 VPC 네트워크를 클릭한 다음 방화벽을 클릭합니다.
과도한 권한이 부여된 방화벽 규칙을 삭제하거나 사용 중지합니다.
3단계: 로그 확인하기
발견 항목 세부정보 패널의 요약 탭에서 Cloud Logging URI 링크를 클릭하여 로그 탐색기를 엽니다.
로드되는 페이지에서 다음 필터를 사용하여 소스 IP의 IP 주소와 관련된 VPC 흐름 로그를 찾습니다.
logName="projects/projectId/logs/compute.googleapis.com%2Fvpc_flows" AND
(jsonPayload.connection.src_ip="SOURCE_IP" OR jsonPayload.connection.dest_ip="destIP")
다음을 바꿉니다.
PROJECT_ID를 projectId에 나열된 프로젝트로 바꿉니다.
SOURCE_IP를 발견 항목 세부정보의 요약 탭에 있는 소스 IP 행에 나열된 IP 주소로 바꿉니다.
4단계: Flow Analyzer 확인
다음 프로세스를 수행하려면 VPC 흐름 로그를 사용 설정해야 합니다.
로그 애널리틱스를 사용하도록 로그 버킷을 업그레이드했는지 확인합니다.
자세한 내용은 로그 애널리틱스를 사용하도록 버킷을 업그레이드를 참조하세요. 업그레이드는 추가 비용이 없습니다.
발견 항목 세부정보 창의 요약 탭에 있는 관련 링크 섹션에서 Flow Analyzer URL 링크를 통해 Flow Analyzer에 액세스할 수도 있습니다.
Event Threat Detection 발견 항목과 관련된 정보를 자세히 조사하려면 작업 표시줄의 시간 범위 선택 도구를 사용하여 기간을 변경합니다. 이 기간은 발견 항목이 처음 보고된 시점을 반영합니다.
예를 들어 발견 항목이 지난 2시간 이내에 보고된 경우 기간을 지난 6시간으로 설정할 수 있습니다. 이렇게 하면 Flow Analyzer의 기간에 발견 항목이 보고된 시간이 포함됩니다.
Flow Analyzer를 필터링하여 악의적인 IP 발견 항목과 연관된 IP 주소에 대해 적절한 결과를 표시합니다.
쿼리 섹션의 소스 행에 있는 필터 메뉴에서 IP를 선택합니다.
값 필드에 발견 항목과 연결된 IP 주소를 입력하고 새 쿼리 실행을 클릭합니다.
Flow Analyzer에 IP 주소에 대한 결과가 표시되지 않으면 소스 행에서 필터를 지우고 대상 행에 동일한 필터를 사용하여 쿼리를 다시 실행합니다.
결과를 분석합니다. 특정 흐름에 대한 자세한 내용을 보려면 모든 데이터 흐름 테이블에서 세부정보를 클릭하여 흐름 세부정보 창을 엽니다.
방화벽 규칙을 업데이트하거나 Cloud Armor를 사용하여 악성 IP 주소를 차단합니다. Security Command Center 통합 서비스 페이지에서 Cloud Armor를 사용 설정할 수 있습니다. 데이터 볼륨에 따라 Cloud Armor 비용이 크게 증가할 수 있습니다. 자세한 내용은 Cloud Armor 가격 책정 가이드를 참고하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nMalware is detected by examining VPC Flow Logs and\nCloud DNS logs for connections to known command and control domains and\nIP addresses.\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nStep 1: Review finding details\n\n1. Open the `Log4j Malware: Bad Domain` finding, as directed in [Reviewing\n findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings).\n The details panel for the\n finding opens to the **Summary** tab.\n\n2. On the **Summary** tab, review the information in the following sections:\n\n - **What was detected** , especially the following fields:\n - **Indicator domain**: the domain that triggered the finding.\n - **Affected resource** , especially the following fields:\n - **Resource full name**: the full resource name of the affected Compute Engine instance.\n - **Project full name**: the full resource name of the project that contains the finding.\n - **Related links** , especially the following fields:\n - **Cloud Logging URI**: link to Logging entries.\n - **MITRE ATT\\&CK method**: link to the MITRE ATT\\&CK documentation.\n - **Related findings**: links to any related findings.\n - **VirusTotal indicator**: link to the VirusTotal analysis page.\n - **Flow Analyzer**: link to the Flow Analyzer feature of Network Intelligence Center. This field displays only when VPC Flow Logs is enabled.\n\n 1. Click the **JSON** tab and note the following field:\n\n - `evidence`:\n - `sourceLogId`:\n - `projectID`: the ID of the project in which the issue was detected.\n - `properties`:\n - `InstanceDetails`: the resource address for the Compute Engine instance.\n\nStep 2: Review permissions and settings\n\n1. In the Google Cloud console, go to the **Dashboard** page.\n\n \u003cbr /\u003e\n\n [Go to the Dashboard](https://console.cloud.google.com/home)\n\n \u003cbr /\u003e\n\n2. Select the project that is specified in the **Project full name** row\n on the **Summary** tab.\n\n3. Navigate to the **Resources** card and click **Compute Engine**.\n\n4. Click the VM instance that matches the name and zone in\n **Resource full name**.\n Review instance details, including network and access settings.\n\n5. In the navigation pane, click **VPC Network** , then click **Firewall**.\n Remove or disable overly permissive firewall rules.\n\nStep 3: Check logs\n\n1. On the **Summary tab** of the finding details panel, click the **Cloud Logging URI** link to open the **Logs Explorer**.\n2. On the page that loads, find VPC Flow Logs related to the IP\n address in **Source IP** by using the following filter:\n\n - `logName=\"projects/`\u003cvar class=\"edit\" translate=\"no\"\u003eprojectId\u003c/var\u003e`/logs/compute.googleapis.com%2Fvpc_flows\" AND\n (jsonPayload.connection.src_ip=\"`\u003cvar class=\"edit\" translate=\"no\"\u003eSOURCE_IP\u003c/var\u003e`\" OR jsonPayload.connection.dest_ip=\"`\u003cvar class=\"edit\" translate=\"no\"\u003edestIP\u003c/var\u003e`\")`\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with select the project listed in `projectId`.\n - \u003cvar translate=\"no\"\u003eSOURCE_IP\u003c/var\u003e with the IP address listed on the **Source IP** row in the **Summary** tab of the finding details.\n\nStep 4: Check Flow Analyzer\n\nYou must enable VPC Flow Logs to perform the following process.\n\n1. Ensure that you have upgraded your log bucket to use Log Analytics. For instructions, see [Upgrade a bucket to use Log\n Analytics](/logging/docs/buckets#upgrade-bucket). There is no additional cost to upgrade.\n2. In the Google Cloud console, go to the **Flow Analyzer**\n page:\n\n [Go to Flow Analyzer](https://console.cloud.google.com/net-intelligence/flow-analyzer)\n\n You can also access Flow Analyzer through the\n **Flow Analyzer URL** link in the **Related Links section** on\n the **Summary** tab of the **Finding details** pane.\n3. To further investigate information pertaining to the Event Threat Detection\n finding, use the time range picker in the action bar to change the time\n period. The time period should reflect when the finding was first reported.\n For example, if the finding was reported within the last 2 hours, you might\n set the time period to **Last 6 hours**. This ensures the time period in\n Flow Analyzer includes the time when the finding was\n reported.\n\n4. Filter Flow Analyzer to display the\n appropriate results for the IP address associated with the malicious IP\n finding:\n\n 1. From the **Filter** menu in the **Source** row of the **Query** section, select **IP**.\n 2. In the **Value** field, enter the IP address associated with the finding\n and click **Run New Query**.\n\n If Flow Analyzer doesn't display any results for the IP\n address, clear the filter from the **Source** row, and run the query again\n with the same filter in the **Destination** row.\n5. Analyze the results. For additional information about a specific flow, click\n **Details** in the **All data flows** table to open the **Flow details**\n pane.\n\nStep 5: Research attack and response methods\n\n1. Review MITRE ATT\\&CK framework entries for this finding type: [Dynamic\n Resolution](https://attack.mitre.org/techniques/T1568/) and [Command and Control](https://attack.mitre.org/tactics/TA0011/).\n2. Review related findings by clicking the link on the **Related findings** on the **Related findings** row in the **Summary** tab of the finding details. Related findings are the same finding type and the same instance and network.\n3. Check flagged URLs and domains on [VirusTotal](https://www.virustotal.com) by clicking the link in **VirusTotal indicator**. VirusTotal is an Alphabet-owned service that provides context on potentially malicious files, URLs, domains, and IP addresses.\n4. To develop a response plan, combine your investigation results with MITRE research.\n\nStep 6: Implement your response\n\n\nThe following response plan might be appropriate for this finding, but might also impact operations.\nCarefully evaluate the information you gather in your investigation to determine the best way to\nresolve findings.\n\n- Contact the owner of the project containing malware.\n- Investigate the potentially compromised instance and remove any discovered malware. To assist with detection and removal, use an endpoint detection and response solution.\n- To track activity and vulnerabilities that allowed the insertion of malware, check audit logs and syslogs associated with the compromised instance.\n- If necessary, [stop the compromised\n instance](/compute/docs/instances/stop-start-instance) and replace it with a new instance.\n- Block the malicious IP addresses by [updating firewall\n rules](/vpc/docs/using-firewalls) or by using Cloud Armor. You can enable Cloud Armor on the Security Command Center [Integrated\n Services](https://console.cloud.google.com/security/command-center/config/integrated-services) page. Depending on data volume, Cloud Armor costs can be significant. See the [Cloud Armor pricing guide](/armor/pricing) for more information.\n- To control access and use of VM images, use [Shielded VM](/security/shielded-cloud/shielded-vm) and [Trusted\n Images](/compute/docs/images/restricting-image-access) IAM policy.\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
