[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nThis finding isn't available for project-level activations.\n\nAn IAM service account is accessing Google Cloud using\nsuspicious software, as indicated by an anomalous user agent.\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nStep 1: Review finding details\n\n1. Open a `Persistence: New User Agent` finding, as directed\n in [Reviewing finding details](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) earlier on this\n page. The details panel for the finding opens to the **Summary** tab.\n\n2. On the **Summary** tab, review the information in the following sections:\n\n - **What was detected** , especially the following fields:\n - **Principal email**: the potentially compromised service account.\n - **Affected resource** , especially the following fields:\n - **Project full name**: the project that contains the potentially compromised service account.\n - **Related links** , especially the following fields:\n - **Cloud Logging URI**: link to Logging entries.\n - **MITRE ATT\\&CK method**: link to the MITRE ATT\\&CK documentation.\n - **Related findings**: links to any related findings.\n\n 1. In the detail view of the finding, click the **JSON** tab.\n 2. In the JSON, note the following fields.\n\n - `projectId`: the project that contains the potentially compromised service account.\n - `callerUserAgent`: the anomalous user agent.\n - `anomalousSoftwareClassification`: the type of software.\n - `notSeenInLast`: the time period used to establish a baseline for normal behavior.\n\nStep 2: Review project and account permissions\n\n1. In the Google Cloud console, go to the **IAM** page.\n\n \u003cbr /\u003e\n\n [Go to IAM](https://console.cloud.google.com/iam-admin/iam)\n\n \u003cbr /\u003e\n\n2. If necessary, select the project listed in `projectId`.\n\n3. On the page that appears, in the **Filter** box, enter the account name\n that is listed on the **Principal email** row in the **Summary** tab\n of the finding details and check granted roles.\n\n4. In the Google Cloud console, go to the **Service Accounts** page.\n\n \u003cbr /\u003e\n\n [Go to Service Accounts](https://console.cloud.google.com/iam-admin/serviceaccounts)\n\n \u003cbr /\u003e\n\n5. On the page that appears, in the **Filter** box, enter the account name\n that is listed on the **Principal email** row in the **Summary** tab\n of the finding details.\n\n6. Check the service account's keys and key creation dates.\n\nStep 3: Check logs\n\n1. On the **Summary tab** of the finding details panel, click the **Cloud Logging URI** link to open the **Logs Explorer**.\n2. If necessary, select your project.\n3. On the page that loads, check logs for activity from new or updated IAM resources using the following filters:\n - `proto_payload.method_name=\"google.iam.admin.v1.CreateServiceAccount\"`\n - `protoPayload.methodName=\"SetIamPolicy\"`\n - `protoPayload.methodName=\"google.iam.admin.v1.UpdateRole\"`\n - `protoPayload.methodName=\"google.iam.admin.v1.CreateRole\"`\n - `protoPayload.authenticationInfo.principalEmail=\"`\u003cvar class=\"edit\" translate=\"no\"\u003eprincipalEmail\u003c/var\u003e`\"`\n\nStep 4: Research attack and response methods\n\n1. Review the MITRE ATT\\&CK framework entry for this finding type: [Valid Accounts: Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/).\n2. To develop a response plan, combine your investigation results with MITRE research.\n\nStep 5: Implement your response\n\n\nThe following response plan might be appropriate for this finding, but might also impact operations.\nCarefully evaluate the information you gather in your investigation to determine the best way to\nresolve findings.\n\n- Contact the owner of the project with the compromised account.\n- Review the `anomalousSoftwareClassification`, `callerUserAgent`, and `behaviorPeriod` fields to verify whether the access is abnormal and if the account has been compromised.\n- Delete project resources created by unauthorized accounts, like unfamiliar Compute Engine instances, snapshots, service accounts, and IAM users.\n- To restrict the creation of new resources to specific regions, see [Restricting resource locations](/resource-manager/docs/organization-policy/defining-locations).\n- To identify and fix overly permissive roles, use [IAM\n Recommender](/iam/docs/recommender-overview).\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
