Google Cloud GCE instance startup script added or modified
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detect when an attempt to add or modify a startup script to the GCE instance metadata occurs.
Strategy
This rule monitors Google Cloud Audit Logs to determine when an attempt to add or modify a start up script to the GCE instance metadata has occurred. A malicious actor who has already gained initial access may try to preserve access to GCE instances by adding a custom startup script to the instance metadata.
Note: This rule triggers with a Medium severity when this activity originates from an anonymizing proxy.
Triage and response
- Reach out to the user or owner of the service account to determine if this action is legitimate.
- If the action is legitimate, consider including the IP address or ASN in a suppression list. See this article on Best practices for creating detection rules with Datadog Cloud SIEM for more information.
- Otherwise, use the Cloud SIEM - IP Investigation dashboard to see if the IP address:
{{@network.client.ip}} has taken other actions. - If the results of the triage indicate that a malicious actor has taken the action, begin your company’s Incident Response process and investigate.
Changelog
- 25 September 2024 - Updated query to replace attribute
@threat_intel.results.category:anonymizer.
