Organiza tus páginas con colecciones
Guarda y categoriza el contenido según tus preferencias.
En este documento, se describe un tipo de resultado de amenazas en Security Command Center. Los detectores de amenazas generan resultados de amenazas cuando detectan una amenaza potencial en tus recursos de Cloud. Para obtener una lista completa de los resultados de amenazas disponibles, consulta el Índice de resultados de amenazas.
Descripción general
Es un proceso iniciado con redireccionamiento de transmisión a un socket remoto conectado. La generación de un shell conectado a la red puede permitir que un atacante realice acciones arbitrarias después de un compromiso inicial limitado.
Nombre completo del proyecto: El proyecto Google Cloud afectado
Vínculos relacionados, en especial los siguientes campos:
Indicador de VirusTotal: Vínculo a la página de análisis de VirusTotal
En la pestaña JSON, observa los siguientes campos:
resource:
project_display_name: Es el nombre del proyecto que contiene el recurso.
sourceProperties:
Reverse_Shell_Stdin_Redirection_Dst_Ip: la dirección IP remota de la conexión
Reverse_Shell_Stdin_Redirection_Dst_Port: el puerto remoto
Reverse_Shell_Stdin_Redirection_Src_Ip: la dirección IP local de la conexión
Reverse_Shell_Stdin_Redirection_Src_Port: el puerto local
Container_Image_Uri: Es el nombre de la imagen de contenedor que se ejecuta.
Busca resultados relacionados que se hayan producido en un momento similar para el contenedor afectado. Estos hallazgos pueden indicar que la actividad fue maliciosa, en lugar de un incumplimiento de las prácticas recomendadas.
Para verificar el valor de hash SHA-256 del archivo binario marcado como malicioso en VirusTotal, haz clic en el vínculo del indicador de VirusTotal. VirusTotal es un servicio que es propiedad de Alphabet y proporciona contexto sobre archivos, URLs, dominios y direcciones IP potencialmente maliciosos.
Para desarrollar un plan de respuesta, combina los resultados de la investigación con la investigación del MITRE y el análisis de VirusTotal.
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-05 (UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nA process started with stream redirection to a remote connected socket. Spawning\na network-connected shell can allow an attacker to perform arbitrary actions\nafter a limited initial compromise.\n\n[Cloud Run Threat Detection](/security-command-center/docs/cloud-run-threat-detection-overview) is the source\nof this finding.\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nReview finding details\n\n1. Open the `Reverse Shell` finding as directed in [Reviewing\n findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings).\n Review the details on the **Summary** and **JSON** tabs.\n\n2. On the **Summary** tab, review the information in the following sections:\n\n - **What was detected** , especially the following fields:\n - **Program binary**: the absolute path of the process started with stream redirection to a remote socket\n - **Arguments**: the arguments provided when the process binary was invoked\n - **Affected resource** , especially the following fields:\n - **Resource full name** : the [full resource name](/apis/design/resource_names) of the affected Cloud Run resource\n - **Project full name**: the affected Google Cloud project\n - **Related links** , especially the following fields:\n - **VirusTotal indicator**: link to the VirusTotal analysis page\n3. On the **JSON** tab, note the following fields:\n\n - `resource`:\n - `project_display_name`: the name of the project that contains the asset.\n - `sourceProperties`:\n - `Reverse_Shell_Stdin_Redirection_Dst_Ip`: the remote IP address of the connection\n - `Reverse_Shell_Stdin_Redirection_Dst_Port`: the remote port\n - `Reverse_Shell_Stdin_Redirection_Src_Ip`: the local IP address of the connection\n - `Reverse_Shell_Stdin_Redirection_Src_Port`: the local port\n - `Container_Image_Uri`: the name of the container image being executed.\n4. Look for related findings that occurred at a similar time for the affected\n container. Such findings might indicate that this activity was malicious,\n instead of a failure to follow best practices.\n\n5. Review the settings of the affected container.\n\n6. Check the logs for the affected container.\n\nResearch attack and response methods\n\n1. Review the MITRE ATT\\&CK framework entries for this finding type: [Command and\n Scripting Interpreter](https://attack.mitre.org/techniques/T1059/) and [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/).\n2. Check the SHA-256 hash value for the binary flagged as malicious on [VirusTotal](https://www.virustotal.com) by clicking the link in **VirusTotal indicator**. VirusTotal is an Alphabet-owned service that provides context on potentially malicious files, URLs, domains, and IP addresses.\n3. To develop a response plan, combine your investigation results with the MITRE research and VirusTotal analysis.\n\nImplement your response\n\nFor response recommendations, see [Respond to Cloud Run threat\nfindings](/security-command-center/docs/respond-cloud-run-threats).\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
