Respond to network threat findings

This document offers informal guidance on how you can respond to findings of suspicious activities in your network. The recommended steps might not be appropriate for all findings and might impact your operations. Before you take any action, you should investigate the findings; assess the information that you gather; and decide how to respond.

The techniques in this document aren't guaranteed to be effective against any previous, current, or future threats that you face. To understand why Security Command Center does not provide official remediation guidance for threats, see Remediating threats .

Before you begin

1. Review the finding . Note the affected resource and the detected network connections. If present, review the indicators of compromise in the finding with threat intelligence from VirusTotal.

2. To learn more about the finding that you're investigating, search for the finding in the Threat findings index .

General recommendations

• Contact the owner of the affected resource.
• Investigate the potentially compromised compute resource and remove any discovered malware.
• If necessary, stop the compromised compute resource.
• For forensic analysis, consider backing up the affected virtual machines and persistent disks. For more information, see Data protection options in the Compute Engine documentation.
• If necessary, delete the affected compute resource.
• For further investigation, consider using incident response services like Mandiant .

In addition, consider the recommendations in the subsequent sections on this page.

Malware

• To track activity and vulnerabilities that allowed the insertion of malware, check audit logs and syslogs associated with the compromised compute resource.
• Block malicious IP addresses by updating firewall rules or by using Cloud Armor . Consider enabling Cloud Armor as an integrated service . Depending on data volume, Cloud Armor costs can be significant. For more information, see Cloud Armor pricing .
• To control access and use of images, use Shielded VM and set up trusted image policies .

Cryptocurrency mining threats

If you determine that the application is a miner application, and its process is still running, terminate the process. Locate the application's executable binary in the compute resource's storage, and delete it.

What's next

• Learn how to work with threat findings in Security Command Center .
• Refer to the Threat findings index .
• Learn how to review a finding through the Google Cloud console.
• Learn about the services that generate threat findings .