AI 威脅發現項目

Security Command Center 內建一般 AI 相關威脅的偵測工具，以及專為部署至 Agent Runtime 的 AI 代理設計的偵測工具。

一般 AI 威脅

Event Threat Detection 提供下列以記錄檔為基礎的偵測功能：

• Initial Access: Dormant Service Account Activity in AI Service
• Persistence: New AI API Method
• Persistence: New Geography for AI Service
• Privilege Escalation: Anomalous Impersonation of Service Account for AI Admin Activity
• Privilege Escalation: Anomalous Multistep Service Account Delegation for AI Admin Activity
• Privilege Escalation: Anomalous Multistep Service Account Delegation for AI Data Access
• Privilege Escalation: Anomalous Service Account Impersonator for AI Admin Activity
• Privilege Escalation: Anomalous Service Account Impersonator for AI Data Access

部署至 Agent Runtime 的代理程式所面臨的威脅

預覽

這項功能適用《服務專屬條款》中「一般服務條款」一節的《正式發布前產品條款》。正式發布前功能是依「原樣」提供，支援服務可能受限。 詳情請參閱推出階段說明。

Security Command Center 會對部署至 Agent Runtime Runtime 的 AI 代理執行執行階段和控制層監控。

執行階段發現項目類型

Agent Platform Threat Detection 提供下列執行階段偵測功能：

• Command and Control: Steganography Tool Detected
• Credential Access: Find Google Cloud Credentials
• Credential Access: GPG Key Reconnaissance
• Credential Access: Search Private Keys or Passwords
• Defense Evasion: Base64 ELF File Command Line
• Defense Evasion: Base64 Encoded Python Script Executed
• Defense Evasion: Base64 Encoded Shell Script Executed
• Defense Evasion: Launch Code Compiler Tool In Container
• Execution: Added Malicious Binary Executed
• Execution: Added Malicious Library Loaded
• Execution: Built in Malicious Binary Executed
• Execution: Container Escape
• Execution: Fileless Execution in /memfd:
• Execution: Kubernetes Attack Tool Execution
• Execution: Local Reconnaissance Tool Execution
• Execution: Malicious Python Executed
• Execution: Modified Malicious Binary Executed
• Execution: Modified Malicious Library Loaded
• Execution: Netcat Remote Code Execution in Container
• Execution: Possible Arbitrary Command Execution through CUPS (CVE-2024-47177)
• Execution: Possible Remote Command Execution Detected
• Execution: Program Run with Disallowed HTTP Proxy Env
• Execution: Socat Reverse Shell Detected
• Execution: Suspicious OpenSSL Shared Object Loaded
• Exfiltration: Launch Remote File Copy Tools in Container
• Impact: Detect Malicious Cmdlines
• Impact: Remove Bulk Data from Disk
• Impact: Suspicious crypto mining activity using the Stratum Protocol
• Malicious Script Executed
• Malicious URL Observed
• Privilege Escalation: Attempt to Abuse Sudo For Privilege Escalation (CVE-2019-14287)
• Privilege Escalation: Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034)
• Privilege Escalation: Sudo Potential Privilege Escalation (CVE-2021-3156)
• Reverse Shell
• Unexpected Child Shell

控制層發現項目類型

Event Threat Detection 提供下列控制層偵測功能：

• Credential Access: AI Agent Anomalous Access to Metadata Service
• Defense Evasion: Folder Level TokenCreator Role Granted to AI Agent
• Defense Evasion: Organization Level TokenCreator Role Granted to AI Agent
• Defense Evasion: Project Level TokenCreator Role Granted to AI Agent
• Discovery: AI Agent Service Account Self-Investigation
• Discovery: AI Agent Unauthorized Service Account API Call
• Discovery: Evidence of Port Scanning from AI Agent
• Exfiltration: AI Agent Initiated BigQuery Data Exfiltration to External Table
• Exfiltration: AI Agent Initiated BigQuery Data Extraction
• Exfiltration: AI Agent Initiated BigQuery VPC Perimeter Violation
• Exfiltration: AI Agent Initiated CloudSQL Exfiltration to External Bucket
• Exfiltration: AI Agent Initiated CloudSQL Exfiltration to Public Bucket
• Initial Access: AI Agent Identity Excessive Permission Denied Actions
• Persistence: Sensitive AI Permission Added to Custom Role
• Persistence: Sensitive Role Granted by AI Agent
• Persistence: Sensitive Role Granted to External AI Agent
• Privilege Escalation: AI Agent Suspicious Cross-Project Access Token Generation
• Privilege Escalation: AI Agent Suspicious Cross-Project OpenID Token Generation
• Privilege Escalation: AI Agent Suspicious Token Generation Using Implicit Delegation
• Privilege Escalation: AI Agent Suspicious Token Generation Using signJwt

後續步驟

• 瞭解 Event Threat Detection。
• 瞭解 Agent Platform Threat Detection。
• 瞭解如何回應 AI 威脅發現結果。
• 請參閱威脅發現項目索引。