이 문서에서는 Security Command Center의 위협 발견 항목 유형에 대해 설명합니다. 위협 발견 항목은 위협 감지기가 클라우드 리소스에서 잠재적인 위협을 감지할 때 생성됩니다. 사용 가능한 위협 발견 항목의 전체 목록은 위협 발견 항목 색인을 참고하세요.
개요
누군가 기본 system:controller:clusterrole-aggregation-controllerClusterRole을 참조하는 RBAC ClusterRoleBinding을 만들었습니다. 이 기본 ClusterRole에는 사용자가 자신의 역할 권한을 수정하여 권한 에스컬레이션을 허용하는 escalate 동사가 있습니다. 자세한 내용은 이 알림의 로그 메시지를 참조하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-10(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nSomeone created an RBAC `ClusterRoleBinding` that references the default\n`system:controller:clusterrole-aggregation-controller` `ClusterRole`. This\ndefault `ClusterRole` has the `escalate` verb, which allows subjects to modify\nthe privileges of their own roles, allowing for privilege escalation. For more\ndetails, see the log message for this alert.\n\nHow to respond\n\nTo respond to this finding, do the following:\n\n1. Review any `ClusterRoleBinding` that references the `system:controller:clusterrole-aggregation-controller` `ClusterRole`.\n2. Review any modifications to the `system:controller:clusterrole-aggregation-controller` `ClusterRole`.\n3. Determine whether there are other signs of malicious activity by the principal who created the `ClusterRoleBinding` in the audit logs in Cloud Logging.\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
