이 문서에서는 네트워크에서 의심스러운 활동이 발견되었을 때 대응하는 방법을 비공식적으로 안내합니다. 권장 단계가 모든 발견 결과에 적합하지 않을 수 있으며 작업에 영향을 미칠 수 있습니다. 조치를 취하기 전에 결과를 조사하고, 수집한 정보를 평가하고, 대응 방법을 결정해야 합니다.
이 문서의 기법이 과거, 현재 또는 미래의 모든 위협에 대해 효과적이라고 보장할 수는 없습니다. Security Command Center에서 위협에 대한 공식 해결 방법을 제공하지 않는 이유를 알아보려면 위협 해결을 참고하세요.
시작하기 전에
결과 검토
영향을 받는 리소스와 감지된 네트워크 연결을 기록해 둡니다. 있는 경우 VirusTotal의 위협 인텔리전스를 사용하여 발견 항목의 침해 지표를 검토합니다.
조사 중인 발견 항목에 대해 자세히 알아보려면 위협 발견 항목 색인에서 발견 항목을 검색하세요.
일반 권장사항
영향을 받는 리소스의 소유자에게 문의하세요.
도용 가능성이 있는 컴퓨팅 리소스를 조사하고 발견된 멀웨어를 삭제합니다.
필요한 경우 침해된 컴퓨팅 리소스를 중지합니다.
포렌식 분석을 위해 영향을 받는 가상 머신과 영구 디스크를 백업하는 것이 좋습니다. 자세한 내용은 Compute Engine 문서의 데이터 보호 옵션을 참고하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document offers informal guidance on how you can respond to findings of suspicious\nactivities in your network. The recommended steps might not be appropriate for all\nfindings and might impact your operations. Before you take any action, you should investigate the\nfindings; assess the information that you gather; and decide how to respond.\n\nThe techniques in this document aren't guaranteed to be effective against any previous, current,\nor future threats that you face. To understand why Security Command Center does not provide official\nremediation guidance for threats, see [Remediating threats](/security-command-center/docs/how-to-investigate-threats#remediating_threats).\n\nBefore you begin\n\n1. [Review the\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings).\n Note the affected resource and the detected network connections. If present,\n review the indicators of compromise in the finding with threat intelligence\n from VirusTotal.\n\n2. To learn more about the finding that you're investigating, search for the\n finding in the [Threat findings\n index](/security-command-center/docs/threat-findings-index).\n\nGeneral recommendations\n\n- Contact the owner of the affected resource.\n- Investigate the potentially compromised compute resource and remove any discovered malware.\n- If necessary, stop the compromised compute resource.\n- For forensic analysis, consider backing up the affected virtual machines and persistent disks. For more information, see [Data protection options](/compute/docs/disks/data-protection) in the Compute Engine documentation.\n- If necessary, delete the affected compute resource.\n- For further investigation, consider using incident response services like [Mandiant](/security/consulting/mandiant-incident-response-services).\n\nIn addition, consider the recommendations in the subsequent sections on this\npage.\n\nMalware\n\n- To track activity and vulnerabilities that allowed the insertion of malware, check audit logs and syslogs associated with the compromised compute resource.\n- Block malicious IP addresses by [updating firewall\n rules](/vpc/docs/using-firewalls) or by using [Cloud Armor](/armor/docs/cloud-armor-overview). Consider [enabling\n Cloud Armor as an integrated\n service](/security-command-center/docs/how-to-configure-security-command-center#gcp-configure-other-services). Depending on data volume, Cloud Armor costs can be significant. For more information, see [Cloud Armor pricing](/armor/pricing).\n- To control access and use of images, use [Shielded VM](/security/shielded-cloud/shielded-vm) and set up [trusted image policies](/compute/docs/images/restricting-image-access).\n\nCryptocurrency mining threats\n\nIf you determine that the application is a miner application, and its process\nis still running, terminate the process. Locate the application's executable\nbinary in the compute resource's storage, and delete it.\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
