방화벽 규칙을 업데이트하거나 Google Cloud Armor를 사용하여 악성 IP 주소를 차단합니다. Security Command Center 통합 서비스 페이지에서 Cloud Armor를 사용 설정할 수 있습니다. 정보 양에 따라 Cloud Armor 비용이 크게 증가할 수 있습니다. 자세한 내용은 Cloud Armor 가격 책정 가이드를 참고하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nDetection of successful brute force of SSH on a host.\n\n[Event Threat Detection](/security-command-center/docs/concepts-event-threat-detection-overview) is the source of\nthis finding.\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nStep 1: Review finding details\n\n1. Open a `Brute Force: SSH` finding, as directed in [Reviewing findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings).\n2. On the **Summary** tab of the finding details panel, review the\n information in the following sections:\n\n - **What was detected, especially the following fields:**\n\n - **Caller IP**: the IP address that launched the attack.\n - **User name**: the account that logged in.\n - **Affected resource**\n\n - **Related links**, especially the following fields:\n\n - **Cloud Logging URI**: link to Logging entries.\n - **MITRE ATT\\&CK method**: link to the MITRE ATT\\&CK documentation.\n - **Related findings**: links to any related findings.\n3. Click the **JSON** tab.\n\n4. In the JSON, note the following fields.\n\n - `sourceProperties`:\n - `evidence`:\n - `sourceLogId`: the project ID and timestamp to identify the log entry\n - `projectId`: the project that contains the finding\n - `properties`:\n - `attempts`:\n - `Attempts`: the number of login attempts\n - `username`: the account that logged in\n - `vmName`: the name of the virtual machine\n - `authResult`: the SSH authentication result\n\nStep 2: Review permissions and settings\n\n1. In the Google Cloud console, go to the **Dashboard**.\n\n \u003cbr /\u003e\n\n [Go to the Dashboard](https://console.cloud.google.com/home)\n\n \u003cbr /\u003e\n\n2. Select the project that is specified in\n `projectId`.\n\n3. Navigate to the **Resources** card and click **Compute Engine**.\n\n4. Click the VM instance that matches the name and zone in `vmName`. Review\n instance details, including network and access settings.\n\n5. In the navigation pane, click **VPC Network** , then click **Firewall**.\n Remove or disable overly permissive firewall rules on port 22.\n\nStep 3: Check logs\n\n1. In the Google Cloud console, go to **Logs Explorer** by clicking the link in **Cloud Logging URI**.\n2. On the page that loads, find VPC Flow Logs related to the IP address that is listed on the **Principal email** row in the **Summary** tab of the finding details by using the following filter:\n - `logName=\"projects/`\u003cvar class=\"edit\" translate=\"no\"\u003eprojectId\u003c/var\u003e`/logs/syslog\"`\n - `labels.\"compute.googleapis.com/resource_name\"=\"`\u003cvar class=\"edit\" translate=\"no\"\u003evmName\u003c/var\u003e`\"`\n\nStep 4: Research attack and response methods\n\n1. Review the MITRE ATT\\&CK framework entry for this finding type: [Valid Accounts: Local Accounts](https://attack.mitre.org/techniques/T1078/003/).\n2. Review related findings by clicking the link on the **Related findings** on the **Related findings** row in the **Summary** tab of the finding details. Related findings are the same finding type and the same instance and network.\n3. To develop a response plan, combine your investigation results with MITRE research.\n\nStep 5: Implement your response\n\n\nThe following response plan might be appropriate for this finding, but might also impact operations.\nCarefully evaluate the information you gather in your investigation to determine the best way to\nresolve findings.\n\n- Contact the owner of the project with the successful brute force attempt.\n- Investigate the potentially compromised instance and remove any discovered malware. To assist with detection and removal, use an endpoint detection and response solution.\n- Consider disabling SSH access to the VM. For information about disabling SSH keys, see [Restrict SSH keys from\n VMs](/compute/docs/connect/restrict-ssh-keys). This step could interrupt authorized access to the VM, so consider the needs of your organization before you proceed.\n- Only use SSH authentication with [authorized\n keys](/compute/docs/instances/ssh).\n- Block the malicious IP addresses by [updating firewall\n rules](/vpc/docs/using-firewalls) or by using Google Cloud Armor. You can enable Cloud Armor on the Security Command Center [Integrated\n Services](https://console.cloud.google.com/security/command-center/config/integrated-services) page. Depending on the quantity of information, Cloud Armor costs can be significant. See the [Cloud Armor pricing guide](/armor/pricing) for more information.\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
