이 문서는 Compute Engine 리소스에서 의심스러운 활동이 발견되었을 때 대응하는 방법에 관한 비공식 가이드를 제공합니다. 권장 단계가 모든 발견 결과에 적합하지 않을 수 있으며 작업에 영향을 미칠 수 있습니다. 조치를 취하기 전에 결과를 조사하고, 수집한 정보를 평가하고, 대응 방법을 결정해야 합니다.
이 문서의 기법이 과거, 현재 또는 미래의 모든 위협에 대해 효과적이라고 보장할 수는 없습니다. Security Command Center에서 위협에 대한 공식 해결 방법을 제공하지 않는 이유를 알아보려면 위협 해결을 참고하세요.
시작하기 전에
결과 검토
영향을 받는 Compute Engine 인스턴스와 감지된 주 이메일, 호출자 IP 주소 (있는 경우)를 기록해 둡니다. 침해 지표(IP, 도메인, 파일 해시 또는 서명)에 대한 결과도 검토합니다.
조사 중인 발견 항목에 대해 자세히 알아보려면 위협 발견 항목 색인에서 발견 항목을 검색하세요.
잠재적으로 침해된 서비스 계정을 삭제하고 잠재적으로 침해된 프로젝트의 모든 서비스 계정 액세스 키를 순환 및 삭제하세요. 삭제 후에는 인증을 위해 서비스 계정을 사용하는 애플리케이션에서 액세스 권한을 잃게 됩니다. 계속하기 전에 보안팀은 영향을 받는 모든 애플리케이션을 식별하고 애플리케이션 소유자와 협력하여 비즈니스 연속성을 보장해야 합니다.
보안팀과 협력하여 Compute Engine 인스턴스, 스냅샷, 서비스 계정, IAM 사용자를 포함하여 익숙하지 않은 리소스를 확인합니다. 승인된 계정으로 생성되지 않은 리소스를 삭제합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document offers informal guidance on how you can respond to findings of suspicious\nactivities in your Compute Engine resources. The recommended steps might not be appropriate for all\nfindings and might impact your operations. Before you take any action, you should investigate the\nfindings; assess the information that you gather; and decide how to respond.\n\nThe techniques in this document aren't guaranteed to be effective against any previous, current,\nor future threats that you face. To understand why Security Command Center does not provide official\nremediation guidance for threats, see [Remediating threats](/security-command-center/docs/how-to-investigate-threats#remediating_threats).\n\nBefore you begin\n\n1. [Review the\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings). Note the affected Compute Engine instance and the detected principal email and caller IP address (if present). Also review the finding for indicators of compromise (IP, domain, file hash, or signature).\n2. To learn more about the finding that you're investigating, search for the finding in the [Threat findings\n index](/security-command-center/docs/threat-findings-index).\n\nGeneral recommendations\n\n- Contact the owner of the affected resource.\n- Investigate the potentially compromised instance and remove any discovered malware.\n- If necessary, [stop the compromised instance](/compute/docs/instances/stop-start-instance) and replace it with a new instance.\n- For forensic analysis, consider backing up the affected virtual machines and persistent disks. For more information, see [Data protection options](/compute/docs/disks/data-protection) in the Compute Engine documentation.\n- If necessary, delete the VM instance.\n- If the finding includes a principal email and caller IP, review other audit logs associated with that principal or IP address for anomalous activity. If necessary, disable or reduce the privileges of the associated account if it has been compromised.\n- For further investigation, consider using incident response services like [Mandiant](/security/consulting/mandiant-incident-response-services).\n\nIn addition, consider the recommendations in the subsequent sections on this\npage.\n\nSSH threats\n\n- Consider disabling SSH access to the VM. For information about disabling SSH keys, see [Restrict SSH keys from VMs](/compute/docs/connect/restrict-ssh-keys). This action can interrupt authorized access to the VM, so consider the needs of your organization before you proceed.\n- Only use SSH authentication with [authorized keys](/compute/docs/instances/ssh).\n- Block malicious IP addresses by [updating firewall\n rules](/vpc/docs/using-firewalls) or by using [Cloud Armor](/armor/docs/cloud-armor-overview). Consider [enabling\n Cloud Armor as an integrated\n service](/security-command-center/docs/how-to-configure-security-command-center#gcp-configure-other-services). Depending on data volume, Cloud Armor costs can be significant. For more information, see [Cloud Armor pricing](/armor/pricing).\n\nLateral movements in Compute Engine instances\n\n- Consider using\n [Secure Boot](/compute/shielded-vm/docs/shielded-vm#secure-boot)\n for your Compute Engine VM instances.\n\n- Consider\n [deleting the potentially compromised service account](/iam/docs/service-accounts-delete-undelete#deleting)\n and rotate and delete all service account access keys for the potentially\n compromised project. After deletion, applications that use the service\n account for authentication lose access. Before proceeding, your security\n team should identify all impacted applications and work with application\n owners to ensure business continuity.\n\n- Work with your security team to identify unfamiliar resources, including\n Compute Engine instances, snapshots, service accounts, and\n IAM users. Delete resources not created with authorized\n accounts.\n\n- Respond to any notifications from Cloud Customer Care.\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
