이 문서에서는 Security Command Center의 위협 발견 항목 유형에 대해 설명합니다. 위협 발견 항목은 위협 감지기가 클라우드 리소스에서 잠재적인 위협을 감지할 때 생성됩니다. 사용 가능한 위협 발견 항목의 전체 목록은 위협 발견 항목 색인을 참고하세요.
개요
지원되는 Log4j 취약점 스캐너는 HTTP 매개변수, URL, 텍스트 필드에 스캐너로 제어되는 도메인에 대한 콜백과 함께 난독화된 JNDI 조회를 삽입합니다. 이 발견 항목은 난독화되지 않은 도메인에 대한 DNS 쿼리를 발견하는 경우에 생성됩니다. 이러한 쿼리는 JNDI 조회가 성공한 경우에만 발생하며, 이는 활성 Log4j 취약점을 나타냅니다.
대응 방법
이 발견 항목에 대응하려면 다음을 수행하세요.
1단계: 발견 항목 세부정보 검토하기
발견 항목 세부정보 검토의 지시에 따라 Active Scan: Log4j Vulnerable to RCE 발견 항목을 엽니다. 발견 항목의 세부정보 패널의 요약 탭이 열립니다.
요약 탭에서 다음 섹션의 정보를 검토합니다.
감지된 항목
특히 다음 필드를 포함하는 영향을 받는 리소스:
리소스 전체 이름: Log4j RCE에 취약한 Compute Engine 인스턴스의 전체 리소스 이름
특히 다음 필드를 포함하는 관련 링크:
Cloud Logging URI: Logging 항목의 링크
MITRE ATT&CK 메서드: MITRE ATT&CK 문서의 링크
관련 발견 항목: 모든 관련 발견 항목의 링크
발견 항목의 세부정보 보기에서 JSON 탭을 클릭합니다.
JSON에서 다음 필드를 확인합니다.
properties
scannerDomain: 스캐너가 JNDI 조회의 일부로 사용한 도메인. 이를 통해 취약점을 발견한 스캐너를 식별할 수 있습니다.
sourceIp: DNS 쿼리를 수행하는 데 사용한 IP 주소
vpcName: DNS 쿼리가 수행된 인스턴스의 네트워크 이름
2단계: 로그 확인하기
Google Cloud 콘솔에서 1단계의 Cloud Logging URI 필드에 있는 링크를 클릭하여 로그 탐색기로 이동합니다.
로드되는 페이지에서 httpRequest 필드를 확인하여 악용 시도를 나타내는 것일 수 있는 ${jndi:ldap://와 같은 문자열 토큰을 찾습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nSupported Log4j vulnerability scanners inject obfuscated JNDI lookups in HTTP\nparameters, URLs, and text fields with callbacks to domains controlled by the\nscanners. This finding is generated when DNS queries for the unobfuscated domains\nare found. Such queries only occur if a JNDI lookup was successful, indicating\nan active Log4j vulnerability.\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nStep 1: Review finding details\n\n1. Open an `Active Scan: Log4j Vulnerable to RCE` finding, as directed in\n [Reviewing finding details](/security-command-center/docs/how-to-investigate-threats#reviewing_findings). The details\n panel for the finding opens to the **Summary** tab.\n\n2. On the **Summary** tab, review the information in the following sections:\n\n - **What was detected**\n - **Affected resource** , especially the following field:\n - **Resource full name** : the [full resource name](/apis/design/resource_names) of the Compute Engine instance that is vulnerable to the Log4j RCE.\n - **Related links** , especially the following fields:\n - **Cloud Logging URI**: link to Logging entries.\n - **MITRE ATT\\&CK method**: link to the MITRE ATT\\&CK documentation.\n - **Related findings**: links to any related findings.\n3. In the detail view of the finding, click the **JSON** tab.\n\n4. In the JSON, note the following fields.\n\n - `properties`\n - `scannerDomain`: the domain used by the scanner as part of the JNDI lookup. This tells you which scanner identified the vulnerability.\n - `sourceIp`: the IP address used to make the DNS query\n - `vpcName`: the name of the network on the instance where the DNS query was made.\n\nStep 2: Check logs\n\n1. In the Google Cloud console, go to **Logs Explorer** by clicking the link in the **Cloud Logging URI** field from [step 1](#log4j_active_findings).\n2. On the page that loads, check the `httpRequest` fields for string tokens\n like `${jndi:ldap://` that may indicate possible exploitation attempts.\n\n See [CVE-2021-44228: Detecting Log4Shell exploit](/logging/docs/log4j2-vulnerability)\n in the Logging documentation for example strings to search\n for and for an example query.\n\nStep 3: Research attack and response methods\n\n1. Review the MITRE ATT\\&CK framework entry for this finding type: [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210/).\n2. Review related findings by clicking the link on the **Related findings** on the **Related findings** row in the **Summary** tab of the finding details. Related findings are the same finding type and the same instance and network.\n3. To develop a response plan, combine your investigation results with MITRE research.\n\nStep 4: Implement your response\n\n\nThe following response plan might be appropriate for this finding, but might also impact operations.\nCarefully evaluate the information you gather in your investigation to determine the best way to\nresolve findings.\n\n- Upgrade to the [latest version of Log4j](https://logging.apache.org/log4j/2.x/download.html).\n- Follow [Google Cloud's recommendations for investigating and responding\n to the \"Apache Log4j\" vulnerability](https://cloud.google.com/blog/products/identity-security/recommendations-for-apache-log4j2-vulnerability).\n- Implement the recommended mitigation techniques in [Apache Log4j Security Vulnerabilities](https://logging.apache.org/log4j/2.x/security.html).\n- If you use [Google Cloud Armor](/armor/docs), deploy the `cve-canary rule` into a new or existing Cloud Armor security policy. For more information, see [Google Cloud Armor WAF rule to help mitigate Apache Log4j vulnerability](https://cloud.google.com/blog/products/identity-security/cloud-armor-waf-rule-to-help-address-apache-log4j-vulnerability).\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
