O Security Command Center tem detectores para ameaças gerais relacionadas à IA e detectores projetados para agentes de IA implantados no Agent Runtime.
Ameaças gerais de IA
As seguintes detecções baseadas em registros estão disponíveis com o Event Threat Detection:
-
Initial Access: Dormant Service Account Activity in AI Service -
Persistence: New AI API Method -
Persistence: New Geography for AI Service -
Privilege Escalation: Anomalous Impersonation of Service Account for AI Admin Activity -
Privilege Escalation: Anomalous Multistep Service Account Delegation for AI Admin Activity -
Privilege Escalation: Anomalous Multistep Service Account Delegation for AI Data Access -
Privilege Escalation: Anomalous Service Account Impersonator for AI Admin Activity -
Privilege Escalation: Anomalous Service Account Impersonator for AI Data Access
Ameaças a agentes implantados no Agent Runtime
O Security Command Center realiza o monitoramento de tempo de execução e plano de controle dos agentes de IA implantados no ambiente de execução do Agent Runtime.
Tipos de descobertas de ambiente de execução
As seguintes detecções de tempo de execução estão disponíveis com a Detecção de ameaças do Agent Platform:
-
Command and Control: Steganography Tool Detected -
Credential Access: Find Google Cloud Credentials -
Credential Access: GPG Key Reconnaissance -
Credential Access: Search Private Keys or Passwords -
Defense Evasion: Base64 ELF File Command Line -
Defense Evasion: Base64 Encoded Python Script Executed -
Defense Evasion: Base64 Encoded Shell Script Executed -
Defense Evasion: Launch Code Compiler Tool In Container -
Execution: Added Malicious Binary Executed -
Execution: Added Malicious Library Loaded -
Execution: Added Malicious Skill Executed -
Execution: Added Malicious Skill Loaded -
Execution: Built in Malicious Binary Executed -
Execution: Container Escape -
Execution: Fileless Execution in /memfd: -
Execution: Kubernetes Attack Tool Execution -
Execution: Local Reconnaissance Tool Execution -
Execution: Malicious Python Executed -
Execution: Modified Malicious Binary Executed -
Execution: Modified Malicious Library Loaded -
Execution: Modified Malicious Skill Executed -
Execution: Modified Malicious Skill Loaded -
Execution: Netcat Remote Code Execution in Container -
Execution: Possible Arbitrary Command Execution through CUPS (CVE-2024-47177) -
Execution: Possible Remote Command Execution Detected -
Execution: Program Run with Disallowed HTTP Proxy Env -
Execution: Socat Reverse Shell Detected -
Execution: Suspicious OpenSSL Shared Object Loaded -
Exfiltration: Launch Remote File Copy Tools in Container -
Impact: Detect Malicious Cmdlines -
Impact: Remove Bulk Data from Disk -
Impact: Suspicious crypto mining activity using the Stratum Protocol -
Malicious Script Executed -
Malicious URL Observed -
Privilege Escalation: Attempt to Abuse Sudo For Privilege Escalation (CVE-2019-14287) -
Privilege Escalation: Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034) -
Privilege Escalation: Sudo Potential Privilege Escalation (CVE-2021-3156) -
Reverse Shell -
Unexpected Child Shell
Tipos de descobertas do plano de controle
As seguintes detecções do plano de controle estão disponíveis com a Event Threat Detection:
-
Credential Access: AI Agent Anomalous Access to Metadata Service -
Defense Evasion: Folder Level TokenCreator Role Granted to AI Agent -
Defense Evasion: Organization Level TokenCreator Role Granted to AI Agent -
Defense Evasion: Project Level TokenCreator Role Granted to AI Agent -
Discovery: AI Agent Service Account Self-Investigation -
Discovery: AI Agent Unauthorized Service Account API Call -
Discovery: Evidence of Port Scanning from AI Agent -
Exfiltration: AI Agent Initiated BigQuery Data Exfiltration to External Table -
Exfiltration: AI Agent Initiated BigQuery Data Extraction -
Exfiltration: AI Agent Initiated BigQuery VPC Perimeter Violation -
Exfiltration: AI Agent Initiated CloudSQL Exfiltration to External Bucket -
Exfiltration: AI Agent Initiated CloudSQL Exfiltration to Public Bucket -
Initial Access: AI Agent Identity Excessive Permission Denied Actions -
Persistence: Sensitive AI Permission Added to Custom Role -
Persistence: Sensitive Role Granted by AI Agent -
Persistence: Sensitive Role Granted to External AI Agent -
Privilege Escalation: AI Agent Cross-Project Access Token Generation -
Privilege Escalation: AI Agent Cross-Project OpenID Token Generation -
Privilege Escalation: AI Agent Token Generation Using Implicit Delegation -
Privilege Escalation: AI Agent Token Generation Using signJwt
A seguir
- Saiba mais sobre a Detecção de ameaças a eventos.
- Saiba mais sobre a detecção de ameaças da Agent Platform.
- Saiba como responder a descobertas de ameaças de IA.
- Consulte Índice de descobertas de ameaças.