[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["| Enterprise [service tier](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nVM Threat Detection detected a potentially malicious file by scanning an Amazon\nElastic Compute Cloud (EC2) VM's persistent disks for known malware signatures.\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nStep 1: Review finding details\n\n1. Open the `Malware: Malicious file on disk` finding, as directed in\n [Review\n findings](/security-command-center/docs/how-to-use-vm-threat-detection#findings-vmtd).\n The details panel for the finding opens to the **Summary** tab.\n\n2. On the **Summary** tab, review the information in the following sections:\n\n - **What was detected** , especially the following fields:\n - **YARA rule name**: the YARA rule that was matched.\n - **Files**: the partition UUID and the relative path of the potentially malicious file that was detected.\n - **Affected resource** , especially the following fields:\n - **Resource full name**: the full resource name of the affected VM instance, including the ID of the project that contains it.\n3. To see the complete JSON for this finding, in the detail view of\n the finding, click the **JSON** tab.\n\n4. In the JSON, note the following fields:\n\n - `indicator`\n - `signatures`:\n - `yaraRuleSignature`: a signature corresponding to the YARA rule that was matched.\n\nStep 2: Check logs\n\nTo check your logs for a Compute Engine VM instance, follow these steps:\n\n1. In the Google Cloud console, go to **Logs Explorer**.\n\n \u003cbr /\u003e\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n\n \u003cbr /\u003e\n\n2. On the Google Cloud console toolbar, select the project that contains\n the VM instance, as specified on the **Resource full name** row in\n the **Summary** tab of the finding details.\n\n3. Check the logs for signs of intrusion on the affected VM instance. For\n example, check for suspicious or unknown activities and signs of\n [compromised credentials](/security/compromised-credentials).\n\nFor information about how to check logs for an Amazon EC2 VM instance, see the\n[Amazon CloudWatch\nLogs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html)\ndocumentation.\n\nStep 3: Review permissions and settings\n\n1. On the **Summary** tab of the finding details, in the **Resource full\n name** field, click the link.\n2. Review the details of the VM instance, including the network and access settings.\n\nStep 4: Research attack and response methods\n\nCheck the SHA-256 hash value for the binary flagged as malicious on\n[VirusTotal](https://www.virustotal.com) by clicking the link in\n**VirusTotal indicator**. VirusTotal is an Alphabet-owned service that\nprovides context on potentially malicious files, URLs, domains, and IP\naddresses.\n\nStep 5: Implement your response\n\n\nThe following response plan might be appropriate for this finding, but might also impact operations.\nCarefully evaluate the information you gather in your investigation to determine the best way to\nresolve findings.\n\n1. Contact the owner of the VM.\n\n2. If necessary, locate and delete the potentially malicious file. To get the\n partition UUID and relative path of the file, refer to the **Files** field on\n the **Summary tab** of the finding details. To assist with detection and\n removal, use an endpoint detection and response solution.\n\n3. If necessary, stop the compromised instance and replace it with a new\n instance.\n\n - Compute Engine VM: See [Stop or restart a Compute Engine\n instance](/compute/docs/instances/stop-start-instance) in the\n Compute Engine documentation.\n\n | **Note:** With the Security Command Center Enterprise tier, you can also perform this action through a [threat response\n | playbook](/security-command-center/docs/playbooks-overview#threat_response_playbooks).\n - Amazon EC2 VM: See [Stop and start Amazon EC2\n instances](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop_Start.html)\n in the AWS documentation.\n\n4. For forensic analysis, consider backing up the virtual machines and\n persistent disks.\n\n - Compute Engine VM: See [Data protection\n options](/compute/docs/disks/data-protection) in the Compute Engine documentation.\n - Amazon EC2 VM: See [Amazon EC2 backup and recovery with snapshots and\n AMIs](https://docs.aws.amazon.com/prescriptive-guidance/latest/backup-recovery/ec2-backup.html) in the AWS documentation.\n5. For further investigation, consider using incident response services like\n [Mandiant](/security/consulting/mandiant-incident-response-services).\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
