Temuan ancaman AI

Security Command Center memiliki detektor untuk ancaman umum terkait AI dan detektor yang dirancang untuk agen AI yang di-deploy ke Runtime Vertex AI Agent Engine.

Ancaman AI umum

Deteksi berbasis log berikut tersedia dengan Event Threat Detection:

• Initial Access: Dormant Service Account Activity in AI Service
• Persistence: New AI API Method
• Persistence: New Geography for AI Service
• Privilege Escalation: Anomalous Impersonation of Service Account for AI Admin Activity
• Privilege Escalation: Anomalous Multistep Service Account Delegation for AI Admin Activity
• Privilege Escalation: Anomalous Multistep Service Account Delegation for AI Data Access
• Privilege Escalation: Anomalous Service Account Impersonator for AI Admin Activity
• Privilege Escalation: Anomalous Service Account Impersonator for AI Data Access

Ancaman terhadap agen yang di-deploy ke Runtime Vertex AI Agent Engine

Pratinjau

Fitur ini tunduk pada "Persyaratan Penawaran Pra-GA" di bagian Persyaratan Layanan Umum dari Persyaratan Khusus Layanan. Fitur pra-GA tersedia "sebagaimana adanya" dan mungkin memiliki dukungan terbatas. Untuk mengetahui informasi selengkapnya, lihat deskripsi tahap peluncuran.

Security Command Center melakukan pemantauan runtime dan control plane terhadap agen AI yang di-deploy ke Runtime Vertex AI Agent Engine.

Jenis temuan runtime

Deteksi runtime berikut tersedia dengan Deteksi Ancaman Mesin Agen:

• Execution: Added Malicious Binary Executed
• Execution: Added Malicious Library Loaded
• Execution: Built in Malicious Binary Executed
• Execution: Container Escape
• Execution: Kubernetes Attack Tool Execution
• Execution: Local Reconnaissance Tool Execution
• Execution: Malicious Python Executed
• Malicious Script Executed
• Malicious URL Observed
• Execution: Modified Malicious Binary Executed
• Execution: Modified Malicious Library Loaded
• Reverse Shell
• Unexpected Child Shell

Jenis temuan bidang kontrol

Deteksi bidang kontrol berikut tersedia dengan Event Threat Detection:

• Exfiltration: Agent Engine Initiated BigQuery Data Extraction
• Exfiltration: Agent Engine Initiated BigQuery Data Exfiltration
• Exfiltration: Agent Engine Initiated Cloud SQL Exfiltration
• Initial Access: Agent Engine Identity Excessive Permission Denied Actions
• Discovery: Agent Engine Service Account Self-Investigation
• Privilege Escalation: Agent Engine Suspicious Token Generation (cross-project access token)
• Privilege Escalation: Agent Engine Suspicious Token Generation (cross-project OpenID token)
• Privilege Escalation: Agent Engine Suspicious Token Generation (implicit delegation)

Langkah berikutnya

• Pelajari Event Threat Detection.
• Pelajari Deteksi Ancaman Agent Engine.
• Lihat Indeks temuan ancaman.