이 문서에서는 Security Command Center의 위협 발견 항목 유형에 대해 설명합니다. 위협 발견 항목은 위협 감지기가 클라우드 리소스에서 잠재적인 위협을 감지할 때 생성됩니다. 사용 가능한 위협 발견 항목의 전체 목록은 위협 발견 항목 색인을 참고하세요.
개요
컨테이너 이스케이프 활동과 관련된 것으로 알려진 의심스러운 바이너리 도구가 실행되었습니다.
이는 컨테이너 내부의 프로세스가 격리 환경을 벗어나 호스트 시스템이나 다른 컨테이너와 상호작용하려는 컨테이너 이스케이프 시도를 의미할 수 있습니다. 이 발견 항목은 공격자가 컨테이너의 경계를 넘어 액세스하려는 시도일 가능성을 시사하므로, 심각도가 높은 보안 위험으로 간주됩니다. 컨테이너 이스케이프는 컨테이너 런타임의 취약점, 잘못된 구성, 또는 권한이 과도하게 부여된 컨테이너의 악용으로 인해 발생할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nA known suspicious tool binary for container escape activities was executed.\nThis indicates a possible container escape attempt, where a process inside the\ncontainer tries to break out of its isolation and interact with the host system\nor other containers. This is a high-severity finding, because it suggests that\nan attacker might be attempting to gain access beyond the container's\nboundaries, potentially compromising the host or other infrastructure. Container\nescapes can result from misconfigurations, vulnerabilities in container\nruntimes, or exploitation of privileged containers.\n\nDetection service\n\n[Cloud Run Threat Detection](/security-command-center/docs/cloud-run-threat-detection-overview)\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nReview finding details\n\n1. Open the `Execution: Container Escape` finding as directed in [Reviewing\n findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings).\n Review the details on the **Summary** and **JSON** tabs.\n\n2. On the **Summary** tab, review the information in the following sections:\n\n - **What was detected** , especially the following fields:\n - **Program binary**: the absolute path of the executed binary\n - **Arguments**: the arguments passed during binary execution\n - **Affected resource** , especially the following fields:\n - **Resource full name** : the [full resource name](/apis/design/resource_names) of the affected Cloud Run resource\n3. On the **JSON** tab, note the following fields:\n\n - `resource`:\n - `project_display_name`: the name of the project that contains the cluster.\n - `finding`:\n - `processes`:\n - `binary`:\n - `path`: the full path of the executed binary.\n - `args`: the arguments that were provided while executing the binary.\n4. Identify other findings that occurred at a similar time for the affected\n container. Related findings might indicate that this activity was malicious,\n instead of a failure to follow best practices.\n\n5. Review the settings of the affected container.\n\n6. Check the logs for the affected container.\n\nResearch attack and response methods\n\n1. Review MITRE ATT\\&CK framework entry for this finding type: [Escape to Host](https://attack.mitre.org/techniques/T1611/).\n2. To develop a response plan, combine your investigation results with MITRE research.\n\nImplement your response\n\nFor response recommendations, see [Respond to Cloud Run threat\nfindings](/security-command-center/docs/respond-cloud-run-threats).\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
