이 문서에서는 Security Command Center의 위협 발견 항목 유형에 대해 설명합니다. 위협 발견 항목은 위협 감지기가 클라우드 리소스에서 잠재적인 위협을 감지할 때 생성됩니다. 사용 가능한 위협 발견 항목의 전체 목록은 위협 발견 항목 색인을 참고하세요.
개요
컨테이너 내에서 Kubernetes 공격 도구가 실행되었습니다. 이는 Kubernetes 환경의 취약점을 악용하려는 시도가 있었음을 나타냅니다.
공격자는 이러한 도구를 사용하여 권한을 에스컬레이션하거나, 클러스터 내에서 수평 이동을 수행하거나, 다른 리소스를 손상시키는 경우가 많습니다.
이 발견 항목의 심각도는 Critical입니다. 이러한 도구의 실행은 API 서버, 노드, 워크로드 등 Kubernetes 구성요소에 대한 통제를 확보하려는 의도적인 시도일 수 있습니다. 공격자는 이러한 도구를 사용하여 보안 통제를 우회하고, 구성을 조작하거나, 민감한 정보를 유출할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nA Kubernetes attack tool was executed within the container. This indicates a\npotential attempt to exploit vulnerabilities in the Kubernetes environment.\nAttackers often use these tools to escalate privileges, perform lateral\nmovement, or compromise other resources within the cluster.\n\nThe severity of this finding is `Critical`. The execution of such tools suggests\na deliberate attempt to gain control over Kubernetes components, such as the API\nserver, nodes, or workloads. Attackers might use these tools to bypass security\ncontrols, manipulate configurations, or exfiltrate sensitive data.\n\nDetection service\n\n[Cloud Run Threat Detection](/security-command-center/docs/cloud-run-threat-detection-overview)\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nReview finding details\n\n1. Open the `Execution: Kubernetes Attack Tool Execution` finding as directed in\n [Reviewing\n findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings).\n Review the details on the **Summary** and **JSON** tabs.\n\n2. On the **Summary** tab, review the information in the following sections:\n\n - **What was detected** , especially the following fields:\n - **Program binary**: the absolute path of the executed binary\n - **Arguments**: the arguments passed during binary execution\n - **Affected resource** , especially the following fields:\n - **Resource full name** : the [full resource name](/apis/design/resource_names) of the affected Cloud Run resource\n3. On the **JSON** tab, note the following fields:\n\n - `resource`:\n - `project_display_name`: the name of the project that contains the affected Cloud Run resource\n - `finding`:\n - `processes`:\n - `binary`:\n - `path`: the full path of the executed binary\n - `args`: the arguments that were provided when the binary was executed\n4. Identify other findings that occurred at a similar time for the affected\n container. Related findings might indicate that this activity was malicious,\n instead of a failure to follow best practices.\n\n5. Review the settings of the affected container.\n\n6. Check the logs for the affected container.\n\nResearch attack and response methods\n\n1. Review MITRE ATT\\&CK framework entry for this finding type: [Obtain Capabilities: Tool](https://attack.mitre.org/techniques/T1588/002/).\n2. To develop a response plan, combine your investigation results with MITRE research.\n\nImplement your response\n\nFor response recommendations, see [Respond to Cloud Run threat\nfindings](/security-command-center/docs/respond-cloud-run-threats).\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
