이 문서에서는 Security Command Center의 위협 발견 항목 유형에 대해 설명합니다. 위협 발견 항목은 위협 감지기가 클라우드 리소스에서 잠재적인 위협을 감지할 때 생성됩니다. 사용 가능한 위협 발견 항목의 전체 목록은 위협 발견 항목 색인을 참고하세요.
개요
노드에 루트 인증서가 설치되었습니다. 공격자는 악성 웹 서버에 연결할 때 보안 알림을 피하기 위해 루트 인증서를 설치할 수 있습니다. 공격자는 경고를 트리거하지 않고 피해자와 공격자의 서버 간에 교환되는 민감한 정보를 가로채는 중간자 공격을 실행할 수 있습니다. 파일 모니터링 감지기이며 특정 GKE 버전 요구사항이 있습니다. 이 감지기는 기본적으로 사용 중지되어 있습니다. 사용 설정 방법에 대한 안내는 Container Threat Detection 테스트를 참고하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-10(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nA root certificate was installed on the node. Adversaries may install a root certificate to avoid security alerts when establishing connections to their malicious web servers. Attackers could carry out man-in-the-middle attacks, intercepting sensitive data exchanged between the victim and the adversary's servers, without triggering any warnings. This is a file monitoring detector and has [specific GKE version requirements](/security-command-center/docs/how-to-use-container-threat-detection#gke-version). This detector is disabled by default. For instructions on how to enable it, see [Testing Container Threat Detection](/security-command-center/docs/how-to-test-container-threat-detection).\n\n[Container Threat Detection](/security-command-center/docs/concepts-container-threat-detection-overview) is the source\nof this finding.\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nReview finding details\n\n1. Open the `Defense Evasion: Root Certificate Installed` finding as directed in\n [Reviewing findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings).\n Review the details in the **Summary** and **JSON** tabs.\n\n2. Identify other findings that occurred at a similar time for this resource.\n Related findings might indicate that this activity was malicious, instead of\n a failure to follow best practices.\n\n3. Review the settings of the affected resource.\n\n4. Check the logs for the affected resource.\n\nResearch attack and response methods\n\nReview the MITRE ATT\\&CK framework entry for this finding type:\n[Defense Evasion](https://attack.mitre.org/tactics/TA0005/).\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
