이 문서에서는 Security Command Center의 위협 발견 항목 유형에 대해 설명합니다. 위협 발견 항목은 위협 감지기가 클라우드 리소스에서 잠재적인 위협을 감지할 때 생성됩니다. 사용 가능한 위협 발견 항목의 전체 목록은 위협 발견 항목 색인을 참고하세요.
개요
컨테이너 내에서 로컬 정찰 도구가 실행되었습니다. 이는 잠재적 공격자가 네트워크 구성, 실행 중인 프로세스, 마운트된 파일 시스템 등 컨테이너 환경에 대한 정보를 수집하고 있다는 신호일 수 있습니다. 공격자는 일반적으로 공격 초기 단계에서 이러한 유형의 도구를 사용하여 잠재적인 공격 대상과 취약점을 파악합니다. 이 발견 항목은 공격자가 추가적인 악용 기회를 모색하며 컨테이너를 탐색하고 있음을 나타내므로, 중간 심각도로 분류됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nA local reconnaissance tool was executed within the container. This suggests\nthat a potential attacker is gathering information about the container\nenvironment, such as network configurations, active processes, or mounted file\nsystems. Attackers often use this type of tool in the early stages of an attack\nto map out potential targets and identify weaknesses. This is a medium-severity\nfinding, because it indicates that the attacker is actively probing the\ncontainer for further exploitation opportunities.\n\nDetection service\n\n[Cloud Run Threat Detection](/security-command-center/docs/cloud-run-threat-detection-overview)\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nReview finding details\n\n1. Open the `Execution: Local Reconnaissance Tool Execution` finding as directed\n in [Reviewing\n findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings).\n Review the details on the **Summary** and **JSON** tabs.\n\n2. On the **Summary** tab, review the information in the following sections.\n\n - **What was detected** , especially the following fields:\n - **Program binary**: the absolute path of the executed binary\n - **Arguments**: the arguments passed during binary execution\n - **Affected resource** , especially the following fields:\n - **Resource full name** : the [full resource\n name](/apis/design/resource_names) of the affected Cloud Run resource\n3. On the **JSON** tab, note the following fields.\n\n - `resource`:\n - `project_display_name`: the name of the project that contains affected Cloud Run resource\n - `finding`:\n - `processes`:\n - `binary`:\n - `path`: the full path of the executed binary\n - `args`: the arguments that were provided when the binary was executed\n4. Identify other findings that occurred at a similar time for the affected\n container. Related findings might indicate that this activity was malicious,\n instead of a failure to follow best practices.\n\n5. Review the settings of the affected container.\n\n6. Check the logs for the affected container.\n\nResearch attack and response methods\n\n1. Review the MITRE ATT\\&CK framework entry for this finding type: [Active Scanning](https://attack.mitre.org/techniques/T1595/).\n2. To develop a response plan, combine your investigation results with MITRE research.\n\nImplement your response\n\nFor response recommendations, see [Respond to Cloud Run threat\nfindings](/security-command-center/docs/respond-cloud-run-threats).\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
