Persistence: GCE Admin Added Startup Script

This document describes a threat finding type in Security Command Center. Threat findings are generated by threat detectors when they detect a potential threat in your cloud resources. For a full list of available threat findings, see Threat findings index .

Overview

The startup-script or startup-script-url Compute Engine instance metadata key was changed on an instance that was created more than seven days ago.

How to respond

The following response plan might be appropriate for this finding, but might also impact operations. Carefully evaluate the information you gather in your investigation to determine the best way to resolve findings.

To respond to this finding, do the following:

1. Verify whether the change was done intentionally by a member, or if it was implemented by an adversary to introduce new access to your organization.

2. Check logs using the following filters:

   protopayload.resource.labels.instance_id= INSTANCE_ID 
   protoPayload.serviceName="compute.googleapis.com"
   ((protoPayload.metadata.instanceMetaData.addedMetadataKey : "startup-script" OR
   protoPayload.metadata.instanceMetaData.modifiedMetadataKey : "startup-script" ) OR
   (protoPayload.metadata.instanceMetaData.addedMetadataKey : "startup-script-url" OR
   protoPayload.metadata.instanceMetaData.modifiedMetadataKey : "startup-script-url" ))
   logName="organizations/ ORGANIZATION_ID 
   /logs/cloudaudit.googleapis.com%2Factivity

   Replace the following:

   • INSTANCE_ID : the gceInstanceId listed in the finding
   • ORGANIZATION_ID : your organization ID

3. Research events that trigger this finding:

   • MITRE: https://attack.mitre.org/techniques/T1098/004/

What's next

• Learn how to work with threat findings in Security Command Center .
• Refer to the Threat findings index .
• Learn how to review a finding through the Google Cloud console.
• Learn about the services that generate threat findings .