Google Cloud Compute Engine GPU virtual machine instance created
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.Goal
Detect when an attempt to create a GPU-based virtual machine (VM) instance in Google Compute Engine occurs.
Strategy
This rule monitors Google Cloud Audit Logs to determine when an attempt to create a GPU-based VM instance in Google Compute Engine has occurred. An attacker who has already gained initial access may try to create GPU-based VM instances with goal mining cryptocurrency.
Notes:
- This rule triggers with a
Medium severity when the activity originates from an anonymizing proxy. - This rule triggers with a
High severity when the activity originates from an anonymizing proxy and more than 10 VM instances are created.
Triage and response
- Reach out to the user or owner of the service account to determine if this action is legitimate.
- If the action is legitimate, consider including the user in a suppression list. See this article on Best practices for creating detection rules with Datadog Cloud SIEM for more information.
- Otherwise, use the Cloud SIEM - User Investigation dashboard to see if the user
{{@usr.id}} has taken other actions. - If the results of the triage indicate that an attacker has taken the action, begin your company’s incident response process and an investigation.
Changelog
- 25 September 2024 - Updated query to replace attribute
@threat_intel.results.category:anonymizer.
