このドキュメントでは、Security Command Center の脅威の検出結果のタイプについて説明します。脅威の検出結果は、クラウド リソースで潜在的な脅威が検出されたときに、脅威検出機能によって生成されます。利用可能な脅威の検出結果の一覧については、脅威の検出結果のインデックスをご覧ください。
概要
プロジェクト レベルで有効にしている場合、この検出結果は利用できません。
異常なユーザー エージェントによって示されるように、IAM サービス アカウントは不審なソフトウェアを使用して Google Cloud にアクセスしています。
顧客への対処方法
この検出結果に対応する手順は次のとおりです。
ステップ 1: 検出結果の詳細を確認する
このページの検出結果の詳細を確認するの説明に従って Persistence: New User Agent の検出結果を開きます。検出結果の詳細パネルが開き、[概要] タブが表示されます。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-11 UTC。"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nThis finding isn't available for project-level activations.\n\nAn IAM service account is accessing Google Cloud using\nsuspicious software, as indicated by an anomalous user agent.\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nStep 1: Review finding details\n\n1. Open a `Persistence: New User Agent` finding, as directed\n in [Reviewing finding details](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) earlier on this\n page. The details panel for the finding opens to the **Summary** tab.\n\n2. On the **Summary** tab, review the information in the following sections:\n\n - **What was detected** , especially the following fields:\n - **Principal email**: the potentially compromised service account.\n - **Affected resource** , especially the following fields:\n - **Project full name**: the project that contains the potentially compromised service account.\n - **Related links** , especially the following fields:\n - **Cloud Logging URI**: link to Logging entries.\n - **MITRE ATT\\&CK method**: link to the MITRE ATT\\&CK documentation.\n - **Related findings**: links to any related findings.\n\n 1. In the detail view of the finding, click the **JSON** tab.\n 2. In the JSON, note the following fields.\n\n - `projectId`: the project that contains the potentially compromised service account.\n - `callerUserAgent`: the anomalous user agent.\n - `anomalousSoftwareClassification`: the type of software.\n - `notSeenInLast`: the time period used to establish a baseline for normal behavior.\n\nStep 2: Review project and account permissions\n\n1. In the Google Cloud console, go to the **IAM** page.\n\n \u003cbr /\u003e\n\n [Go to IAM](https://console.cloud.google.com/iam-admin/iam)\n\n \u003cbr /\u003e\n\n2. If necessary, select the project listed in `projectId`.\n\n3. On the page that appears, in the **Filter** box, enter the account name\n that is listed on the **Principal email** row in the **Summary** tab\n of the finding details and check granted roles.\n\n4. In the Google Cloud console, go to the **Service Accounts** page.\n\n \u003cbr /\u003e\n\n [Go to Service Accounts](https://console.cloud.google.com/iam-admin/serviceaccounts)\n\n \u003cbr /\u003e\n\n5. On the page that appears, in the **Filter** box, enter the account name\n that is listed on the **Principal email** row in the **Summary** tab\n of the finding details.\n\n6. Check the service account's keys and key creation dates.\n\nStep 3: Check logs\n\n1. On the **Summary tab** of the finding details panel, click the **Cloud Logging URI** link to open the **Logs Explorer**.\n2. If necessary, select your project.\n3. On the page that loads, check logs for activity from new or updated IAM resources using the following filters:\n - `proto_payload.method_name=\"google.iam.admin.v1.CreateServiceAccount\"`\n - `protoPayload.methodName=\"SetIamPolicy\"`\n - `protoPayload.methodName=\"google.iam.admin.v1.UpdateRole\"`\n - `protoPayload.methodName=\"google.iam.admin.v1.CreateRole\"`\n - `protoPayload.authenticationInfo.principalEmail=\"`\u003cvar class=\"edit\" translate=\"no\"\u003eprincipalEmail\u003c/var\u003e`\"`\n\nStep 4: Research attack and response methods\n\n1. Review the MITRE ATT\\&CK framework entry for this finding type: [Valid Accounts: Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/).\n2. To develop a response plan, combine your investigation results with MITRE research.\n\nStep 5: Implement your response\n\n\nThe following response plan might be appropriate for this finding, but might also impact operations.\nCarefully evaluate the information you gather in your investigation to determine the best way to\nresolve findings.\n\n- Contact the owner of the project with the compromised account.\n- Review the `anomalousSoftwareClassification`, `callerUserAgent`, and `behaviorPeriod` fields to verify whether the access is abnormal and if the account has been compromised.\n- Delete project resources created by unauthorized accounts, like unfamiliar Compute Engine instances, snapshots, service accounts, and IAM users.\n- To restrict the creation of new resources to specific regions, see [Restricting resource locations](/resource-manager/docs/organization-policy/defining-locations).\n- To identify and fix overly permissive roles, use [IAM\n Recommender](/iam/docs/recommender-overview).\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
