运行时反弹shell事件详细信息

1. 接口描述

接口请求域名： tcss.tencentcloudapi.com 。

查询运行时反弹shell事件详细信息

默认接口请求频率限制：20次/秒。

2. 输入参数

以下请求参数列表仅列出了接口请求参数和部分公共参数，完整公共参数列表见 公共请求参数。

3. 输出参数

4. 示例

示例1 运行时反弹shell事件详细信息

输入示例

https://tcss.tencentcloudapi.com/?Action=DescribeReverseShellDetail
&EventId=100
&<公共请求参数>

输出示例

{
    "Response": {
        "AncestorProcessInfo": {
            "ProcessParam": "bash",
            "ProcessPath": "/usr/bin/bash",
            "ProcessStartUser": "root",
            "ProcessUserGroup": "root"
        },
        "EventBaseInfo": {
            "ClientIP": "43.138.142.111",
            "ClusterID": "",
            "ClusterName": "",
            "ContainerId": "dc56fda9-58c8-4c4f-9e8c-b7296836c1fe",
            "ContainerIsolateOperationSrc": "",
            "ContainerName": "/fervent_goodall",
            "ContainerNetStatus": "NORMAL",
            "ContainerNetSubStatus": "NONE",
            "EventCount": 1,
            "EventId": "464567",
            "EventName": "反弹shell",
            "EventType": "REVERSE_SHELL_EVENT_TYPE",
            "FoundTime": "2024-10-09 10:17:07",
            "HostID": "45641324-6360-4fd4-bfc7-843162cb8116",
            "HostIP": "10.0.1.233",
            "ImageId": "sha256:345234541324b561b4c16bcb82328cfe5809ab675bb17ab3a16c517c9",
            "ImageName": "centos:7",
            "LatestFoundTime": "2024-10-09 10:17:07",
            "Namespace": "",
            "NodeID": "",
            "NodeName": "k8s-node1",
            "NodeSubNetCIDR": "",
            "NodeSubNetID": "",
            "NodeSubNetName": "",
            "NodeType": "NORMAL",
            "NodeUniqueID": "",
            "PodIP": "",
            "PodName": "--",
            "PodStatus": "",
            "Status": "EVENT_UNDEAL",
            "WorkloadType": ""
        },
        "EventDetail": {
            "Description": "/fervent_goodall容器(ID:b18a9a3726...)内存在疑似反弹shell行为",
            "DstAddress": "175.178.80.251:3387",
            "OperationTime": "1970-01-01 00:00:01",
            "Remark": "",
            "Solution": "清理容器内反弹shell进程，检查容器内服务是否存在漏洞、弱密码等风险"
        },
        "ParentProcessInfo": {
            "ProcessId": 737356,
            "ProcessName": "bash",
            "ProcessParam": "sh -c bash ",
            "ProcessPath": "/usr/bin/bash",
            "ProcessStartUser": "",
            "ProcessUserGroup": ""
        },
        "ProcessInfo": {
            "ProcessAuthority": "-rwxr-xr-x",
            "ProcessId": 737357,
            "ProcessMd5": "81a7701a194c3a1179cfe4a7ac836626",
            "ProcessName": "bash",
            "ProcessParam": "bash -i",
            "ProcessPath": "/usr/bin/bash",
            "ProcessStartUser": "",
            "ProcessTree": "bash(737357)|bash(737356)|bash(733933)|containerd-shim-runc-v2(2178890)|systemd(1)",
            "ProcessUserGroup": "root"
        },
        "RequestId": "a14b6d46-6fa0-48bb-829f-acfa7a58b47a"
    }
}

5. 开发者资源

腾讯云 API 平台

腾讯云 API 平台 是综合 API 文档、错误码、API Explorer 及 SDK 等资源的统一查询平台，方便您从同一入口查询及使用腾讯云提供的所有 API 服务。

API Inspector

用户可通过 API Inspector 查看控制台每一步操作关联的 API 调用情况，并自动生成各语言版本的 API 代码，也可前往 API Explorer 进行在线调试。

SDK

云 API 3.0 提供了配套的开发工具集（SDK），支持多种编程语言，能更方便的调用 API。

• Tencent Cloud SDK 3.0 for Python: GitHub Gitee
• Tencent Cloud SDK 3.0 for Java: GitHub Gitee
• Tencent Cloud SDK 3.0 for PHP: GitHub Gitee
• Tencent Cloud SDK 3.0 for Go: GitHub Gitee
• Tencent Cloud SDK 3.0 for Node.js: GitHub Gitee
• Tencent Cloud SDK 3.0 for .NET: GitHub Gitee
• Tencent Cloud SDK 3.0 for C++: GitHub Gitee
• Tencent Cloud SDK 3.0 for Ruby: GitHub Gitee

命令行工具

• Tencent Cloud CLI 3.0

6. 错误码

以下仅列出了接口业务逻辑相关的错误码，其他错误码详见 公共错误码。