[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nCloud Run Threat Detection observed a malicious URL in the argument list of an\nexecutable process. Attackers can load malware or malicious libraries\nthrough malicious URLs.\n\nDetection service\n\n[Cloud Run Threat Detection](/security-command-center/docs/cloud-run-threat-detection-overview)\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nReview finding details\n\n1. Open the `Malicious URL Observed` finding as directed in [Reviewing\n findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings).\n Review the details on the **Summary** and **JSON** tabs.\n\n2. On the **Summary** tab, review the information in the following sections:\n\n - **What was detected** , especially the following fields:\n - **URI**: the malicious URI observed\n - **Added binary**: the full path of the process binary that received the arguments that contain the malicious URL\n - **Arguments**: the arguments provided when invoking the process binary\n - **Environment variables**: the environment variables that were in effect when the process binary was invoked\n - **Containers**: the name of the container\n - **Affected resource** , especially the following fields:\n - **Resource display name**: the name of the affected resource\n - **Resource full name** : the [full resource name](/apis/design/resource_names) of the affected Cloud Run resource\n - **Related links** , especially the following field:\n - **VirusTotal indicator**: link to the VirusTotal analysis page\n3. Look for related findings that occurred at a similar time for the affected\n container. Such findings might indicate that this activity was malicious,\n instead of a failure to follow best practices.\n\n4. Review the settings of the affected container.\n\n5. Check the logs for the affected container.\n\nResearch attack and response methods\n\n1. Check [Safe Browsing site status](https://transparencyreport.google.com/safe-browsing/search) to get details on why the URL is classified as malicious.\n2. Review the MITRE ATT\\&CK framework entry for this finding type: [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/).\n3. Check the SHA-256 hash value for the binary flagged as malicious on [VirusTotal](https://www.virustotal.com) by clicking the link in **VirusTotal indicator**. VirusTotal is an Alphabet-owned service that provides context on potentially malicious files, URLs, domains, and IP addresses.\n4. To develop a response plan, combine your investigation results with the MITRE research and VirusTotal analysis.\n\nImplement your response\n\nFor response recommendations, see [Respond to Cloud Run threat\nfindings](/security-command-center/docs/respond-cloud-run-threats).\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
