Akses Awal: Pengguna Super Database Menulis ke Tabel Pengguna
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Dokumen ini menjelaskan jenis temuan ancaman di Security Command Center. Temuan ancaman dibuat oleh
pendeteksi ancaman saat mendeteksi
potensi ancaman di resource cloud Anda. Untuk daftar lengkap temuan ancaman yang tersedia, lihat Indeks temuan ancaman.
Ringkasan
Akun superuser database Cloud SQL (postgres
untuk PostgreSQL dan root untuk MySQL) menulis ke tabel pengguna. Pengguna super (peran dengan akses yang sangat luas) umumnya tidak boleh
digunakan untuk menulis ke tabel pengguna. Akun pengguna dengan akses yang lebih terbatas harus digunakan
untuk aktivitas harian normal. Saat superuser menulis ke tabel pengguna, hal itu dapat
menunjukkan bahwa penyerang telah meningkatkan hak istimewa atau telah membahayakan
pengguna database default dan sedang mengubah data. Hal ini juga dapat menunjukkan praktik yang normal tetapi tidak aman.
Cara merespons
Untuk menanggapi temuan ini, lakukan hal berikut:
Langkah 1: Tinjau detail temuan
Buka temuan Initial Access: Database Superuser Writes to User Tables, seperti yang diarahkan dalam Meninjau temuan.
Di tab Ringkasan pada panel detail temuan, tinjau informasi di bagian berikut:
Apa yang terdeteksi, terutama kolom berikut:
Nama tampilan database: nama database di instance Cloud SQL PostgreSQL atau MySQL yang terpengaruh.
Nama pengguna database: superuser.
Kueri database: kueri SQL yang dijalankan saat menulis ke tabel pengguna.
Resource yang terpengaruh, terutama kolom berikut:
Nama lengkap resource: nama resource instance Cloud SQL yang terpengaruh.
Nama lengkap induk: nama resource instance Cloud SQL.
Nama lengkap project: project Google Cloud yang berisi
instance Cloud SQL.
Link terkait, terutama kolom berikut:
Cloud Logging URI: link ke entri Logging.
Metode MITRE ATT&CK: link ke dokumentasi MITRE ATT&CK.
Temuan terkait: link ke temuan terkait.
Untuk melihat JSON lengkap temuan, klik tab JSON.
Langkah 2: Periksa log
Di konsol Google Cloud , buka Logs Explorer dengan mengklik
link di cloudLoggingQueryURI (dari Langkah 1).
Halaman Logs Explorer mencakup semua log yang terkait dengan instance Cloud SQL yang relevan.
Periksa log untuk log pgaudit PostgreSQL atau log audit Cloud SQL untuk MySQL, yang berisi kueri yang dijalankan oleh pengguna super, dengan menggunakan filter berikut:
Untuk menentukan apakah langkah-langkah perbaikan tambahan diperlukan, gabungkan hasil penyelidikan Anda dengan penelitian MITRE.
Langkah 4: Terapkan respons Anda
Rencana respons berikut mungkin sesuai untuk temuan ini, tetapi juga dapat memengaruhi operasi.
Evaluasi dengan cermat informasi yang Anda kumpulkan dalam penyelidikan untuk menentukan cara terbaik dalam menyelesaikan temuan.
Tinjau pengguna yang diizinkan untuk terhubung ke database.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-05 UTC."],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nThe Cloud SQL database superuser account (`postgres`\nfor PostgreSQL and `root` for MySQL) wrote to user\ntables. The superuser (a role with very broad access) generally shouldn't be\nused to write to user tables. A user account with more limited access should be used\nfor normal daily activity. When a superuser writes to a user table, that could\nindicate that an attacker has escalated privileges or has compromised the\ndefault database user and is modifying data. It could also indicate normal but\nunsafe practices.\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nStep 1: Review finding details\n\n1. Open an `Initial Access: Database Superuser Writes to User Tables` finding, as directed in [Reviewing findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings).\n2. On the **Summary** tab of the finding details panel, review the\n information in the following sections:\n\n - **What was detected** , especially the following fields:\n - **Database display name**: the name of the database in the Cloud SQL PostgreSQL or MySQL instance that was affected.\n - **Database user name**: the superuser.\n - **Database query**: the SQL query executed while writing to user tables.\n - **Affected resource** , especially the following fields:\n - **Resource full name**: the resource name of the Cloud SQL instance that was affected.\n - **Parent full name**: the resource name of the Cloud SQL instance.\n - **Project full name**: the Google Cloud project that contains the Cloud SQL instance.\n - **Related links** , especially the following fields:\n - **Cloud Logging URI**: link to Logging entries.\n - **MITRE ATT\\&CK method**: link to the MITRE ATT\\&CK documentation.\n - **Related findings**: links to any related findings.\n3. To see the complete JSON for the finding, click the **JSON** tab.\n\nStep 2: Check logs\n\n1. In the Google Cloud console, go to **Logs Explorer** by clicking the link in `cloudLoggingQueryURI` (from [Step 1](#initial_access_database_superuser_writes_to_user_tables_findings)). The **Logs Explorer** page includes all logs related to the relevant Cloud SQL instance.\n2. Check the logs for PostgreSQL pgaudit logs or Cloud SQL for MySQL audit logs, which contain the queries executed by the superuser, by using the following filters:\n - `protoPayload.request.user=\"`\u003cvar class=\"edit\" translate=\"no\"\u003eSUPERUSER\u003c/var\u003e`\"`\n\nStep 3: Research attack and response methods\n\n1. Review the MITRE ATT\\&CK framework entry for this finding type: [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1078/001/).\n2. To determine if additional remediation steps are necessary, combine your investigation results with MITRE research.\n\nStep 4: Implement your response\n\n\nThe following response plan might be appropriate for this finding, but might also impact operations.\nCarefully evaluate the information you gather in your investigation to determine the best way to\nresolve findings.\n\n- Review the users allowed to connect to the database.\n\n - For PostgreSQL, see [Create and manage users](/sql/docs/postgres/create-manage-users)\n - For MySQL, see [Manage users with built-in authentication](/sql/docs/mysql/create-manage-users)\n- Consider changing the password for the superuser.\n\n - For PostgreSQL, see [Set the password for the default user](/sql/docs/postgres/create-manage-users#user-root)\n - For MySQL, see [Set the password for the default user](/sql/docs/mysql/create-manage-users#user-root)\n- Consider creating a new, limited access user for the different types of queries used on the instance.\n\n - Grant the new user only the necessary permissions needed to execute their queries.\n\n - For PostgreSQL, see [Grant (command)](https://www.postgresql.org/docs/14/sql-grant.html)\n - For MySQL, see [Access Control and Account Management](https://dev.mysql.com/doc/refman/8.0/en/access-control.html)\n - Update the credentials for the clients that connect to the Cloud SQL instance\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
