持續性：新 AI API 方法

本文說明 Security Command Center 中的威脅發現項目類型。威脅偵測工具偵測到雲端資源中可能存在威脅時，就會產生威脅發現項目。如需可用威脅發現項目的完整清單，請參閱威脅發現項目索引。

總覽

系統在組織、資料夾或專案中，偵測到疑似惡意行為人對 AI 服務進行異常管理員活動。異常活動可能包括：

  • 主體在機構、資料夾或專案中進行新活動
  • 機構、資料夾或專案中的主體一段時間未執行的活動。

Event Threat Detection 是這項發現項目的來源。

回應方式

如要回應這項發現項目，請按照下列步驟操作：

步驟 1：查看調查結果詳細資料

  1. 按照「查看發現項目」一文的說明，開啟 Persistence: New AI API Method 發現項目。

  2. 在「摘要」分頁的調查結果詳細資料中，記下下列欄位的值：

    • 在「偵測到的內容」下方：
      • 主體電子郵件地址：發出呼叫的帳戶
      • 方法名稱：呼叫的方法
      • AI 資源：可能受到影響的 AI 資源，例如 Agent Platform 資源和 AI 模型。
    • 在「受影響的資源」下方：
      • 資源顯示名稱：受影響資源的名稱，可能與機構、資料夾或專案的名稱相同
      • 資源路徑：活動發生的資源階層位置

步驟 2：研究攻擊和應變方法

  1. 查看這類發現項目 的 MITRE ATT&CK 框架項目：持續性。
  2. 調查該項操作是否經過機構、資料夾或專案授權，以及是否由帳戶的合法擁有者執行。組織、資料夾或專案會顯示在「資源路徑」欄位中，帳戶則會顯示在「主體電子郵件」列中。
  3. 如要制定回應計畫，請將調查結果與 MITRE 研究結合。

發現項目 JSON 範例

以下是發現項目 JSON 的範例。

{
    "findings": {
        "access": {
         "principalEmail": "PRINCIPAL_EMAIL",
         "callerIp": "IP_ADDRESS",
         "callerIpGeo": {
            "regionCode": "US"
          },
         "serviceName": "aiplatform.googleapis.com",
         "methodName": "METHOD_NAME",
         "principalSubject": "PRINCIPAL_SUBJECT",
         "serviceAccountKeyName": "SERVICE_ACCOUNT_KEY_NAME"
        },
        "assetDisplayName": "ASSET_DISPLAY_NAME",
        "assetId": "organizations/ORGANIZATION_NUMBER/assets/ASSET_ID",
        "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",
        "category": "Persistence: New AI API Method",
        "contacts": {
         "security": {
           "contacts": [
             {
               "email": "EMAIL_ADDRESS"
             },
             {
               "email": "EMAIL_ADDRESS"
             },
             {
               "email": "EMAIL_ADDRESS"
             }
           ]
         },
         "technical": {
           "contacts": [
             {
               "email": "EMAIL_ADDRESS"
             },
             {
               "email": "EMAIL_ADDRESS"
             },
             {
               "email": "EMAIL_ADDRESS"
             }
           ]
         }
        },
        "createTime": "2023-01-12T10:35:47.381Z",
        "database": {},
        "eventTime": "2023-01-12T10:35:47.270Z",
        "exfiltration": {},
        "findingClass": "THREAT",
        "findingProviderId": "organizations/ORGANIZATION_NUMBER/firstPartyFindingProviders/etd",
        "indicator": {},
        "kernelRootkit": {},
        "kubernetes": {},
        "mitreAttack": {
          "primaryTactic": "PERSISTENCE",
        },
        "muteInfo": {
          "staticMute": {
            "state": "UNDEFINED",
            "applyTime": "1970-01-01T00:00:00Z"
          }
        },
        "domains": [
          {
            "category": "AI"
          },
          {
            "category": "IDENTITY_AND_ACCESS"
          }
        ],
        "aiModel": {
          "name": "//aiplatform.googleapis.com/projects/PROJECT_NUMBER/locations/us-central1/models/MODEL_NAME",
          "deploymentPlatform": "VERTEX_AI"
        },
        "name": "organizations/ORGANIZATION_NUMBER/sources/SOURCE_ID/findings/FINDING_ID",
        "parent": "organizations/ORGANIZATION_NUMBER/sources/SOURCE_ID",
        "parentDisplayName": "Event Threat Detection",
        "resourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
        "severity": "LOW",
        "state": "ACTIVE",
        "vulnerability": {},
        "workflowState": "NEW"
    },
    "resource": {
        "name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
        "displayName": "projects/PROJECT_NUMBER/locations/us-central1/models/MODEL_NAME",
        "gcpMetadata": {
          "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
          "projectDisplayName": "PROJECT_ID",
          "parent": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
          "parentDisplayName": "PROJECT_ID",
          "organization": "organizations/ORGANIZATION_ID"
        },
        "type": "google.aiplatform.Model",
        "folders": []
    },
    "sourceProperties": {
        "sourceId": {
         "projectNumber": "PROJECT_NUMBER",
         "customerOrganizationNumber": "ORGANIZATION_NUMBER"
        },
        "detectionCategory": {
         "ruleName": "ai_anomalous_behavior_new_api_method",
        },
        "detectionPriority": "LOW",
        "affectedResources": [
          {
            "gcpResourceName": "//aiplatform.googleapis.com/projects/PROJECT_NUMBER/locations/us-central1/models/MODEL_NAME"
          },
          {
            "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
          }
        ],
        "evidence": [
         {
           "sourceLogId": {
             "projectId": "PROJECT_ID",
             "resourceContainer": "projects/PROJECT_ID",
             "timestamp": {
               "seconds": "1673519681",
               "nanos": 728289000
             },
             "insertId": "INSERT_ID"
           }
         }
        ],
        "properties": {
         "newApiMethod": {
           "newApiMethod": {
             "serviceName": "SERVICE_NAME",
             "methodName": "METHOD_NAME"
           },
           "principalEmail": "PRINCIPAL_EMAIL",
           "callerIp": "IP_ADDRESS",
           "callerUserAgent": "CALLER_USER_AGENT",
           "resourceContainer": "projects/PROJECT_NUMBER"
         }
        },
        "findingId": "FINDING_ID",
        "contextUris": {
         "mitreUri": {
           "displayName": "MITRE Link",
           "url": "https://attack.mitre.org/tactics/TA0003/"
         }
        }
    }
}

後續步驟