Evasion: Access from Anonymizing Proxy

This document describes a threat finding type in Security Command Center. Threat findings are generated by threat detectors when they detect a potential threat in your cloud resources. For a full list of available threat findings, see Threat findings index.

Finding description

Anomalous access from an anonymous proxy is detected by examining Cloud Audit Logs for Google Cloud service modifications that originated from an IP address associated with the Tor network.

To respond to these findings, do the following:

Step 1: Review finding details

  1. Open an Evasion: Access from Anonymizing Proxy finding, as directed in Reviewing findings. The panel for the finding details opens, displaying the Summary tab.

  2. On the Summary tab of the finding details panel, review the listed values in the following sections:

    • What was detected, especially the following fields:
      • Principal email: the account that made the changes (a potentially compromised account).
      • IP: The proxy IP address where the changes are conducted from.
    • Affected resource
    • Related links, especially the following fields:
      • Cloud Logging URI: link to Logging entries.
      • MITRE ATT&CK method: link to the MITRE ATT&CK documentation.
      • Related findings: links to any related findings.

  3. Optionally, click the JSON tab to view additional finding fields.

Step 2: Research attack and response methods

  1. Review the MITRE ATT&CK framework entry for this finding type: Proxy: Multi-hop Proxy.
  2. Contact the owner of the account in the principalEmail field. Confirm whether the action was conducted by the legitimate owner.
  3. To develop a response plan, combine your investigation results with MITRE research.

What's next