이 문서에서는 Security Command Center의 위협 발견 항목 유형에 대해 설명합니다. 위협 발견 항목은 위협 감지기가 클라우드 리소스에서 잠재적인 위협을 감지할 때 생성됩니다. 사용 가능한 위협 발견 항목의 전체 목록은 위협 발견 항목 색인을 참고하세요.
개요
ld.so.preload 파일을 수정하려고 시도했습니다. ld.so.preload 변경사항은 공격자가 시스템의 라이브러리 세트에 악성 공유 라이브러리를 미리 로드하는 데 사용할 수 있습니다. 공격자는 이를 사용하여 프로그램 실행 중에 자체 라이브러리를 로드하여 실행 흐름을 하이재킹할 수 있으며, 이는 권한 에스컬레이션이나 방어 메커니즘 회피로 이어질 수 있습니다. 파일 모니터링 감지기이며 특정 GKE 버전 요구사항이 있습니다. 이 감지기는 기본적으로 사용 중지되어 있습니다. 사용 설정 방법에 대한 안내는 Container Threat Detection 테스트를 참고하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-10(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nAn attempt was made to modify the `ld.so.preload` file. Changes to `ld.so.preload` can be used by attackers to preload malicious shared libraries into a system's library set. An attacker could use this to hijack the execution flow by loading their own libraries during program execution, potentially leading to privilege escalation or evasion of defense mechanisms. This is a file monitoring detector and has [specific GKE version requirements](/security-command-center/docs/how-to-use-container-threat-detection#gke-version). This detector is disabled by default. For instructions on how to enable it, see [Testing Container Threat Detection](/security-command-center/docs/how-to-test-container-threat-detection).\n\nDetection service\n\n[Container Threat Detection](/security-command-center/docs/concepts-container-threat-detection-overview)\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nReview finding details\n\n1. Open the `Persistence: Modify ld.so.preload` finding as directed in\n [Reviewing findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings).\n Review the details in the **Summary** and **JSON** tabs.\n\n2. Identify other findings that occurred at a similar time for this resource.\n Related findings might indicate that this activity was malicious, instead of\n a failure to follow best practices.\n\n3. Review the settings of the affected resource.\n\n4. Check the logs for the affected resource.\n\nResearch attack and response methods\n\nReview the MITRE ATT\\&CK framework entry for this finding type:\n[Persistence](https://attack.mitre.org/tactics/TA0003/).\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
