Potential Google Cloud cryptomining attack from Tor IP
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.Goal
Detect when a Google Compute Engine cryptomining attack is observed from a Tor IP.
Strategy
This rule monitors Google Cloud Audit Logs to determine when a compute network creation, compute image creation, or firewall rule creation event coincides with the creation of a compute engine and originates from a Tor client. Datadog enriches all ingested logs with expert-curated threat intelligence in real time. An attacker may use a Tor client to anonymize their true origin.
Triage and response
- Determine if the actions
{{@evt.name}} taken by the user {{@usr.id}} from Tor IP address: {{@network.client.ip}} are legitimate by looking at past activity and the type of API calls occurring. - Furthermore, use the Cloud SIEM - IP Investigation & User Investigation dashboards to see if the IP address:
{{@network.client.ip}} & {{@usr.id}} have taken other actions. - If the results of the triage indicate that an attacker has taken the action, begin your company’s incident response process and investigate.
Changelog
- 17 August 2023 - Updated query to replace attribute
@threat_intel.results.subcategory:tor with @threat_intel.results.category:tor.
