Security Command Center tiene detectores para amenazas generales relacionadas con la IA y detectores diseñados para agentes de IA implementados en el entorno de ejecución de Vertex AI Agent Engine.
Amenazas generales de IA
Las siguientes detecciones basadas en registros están disponibles en Event Threat Detection:
-
Initial Access: Dormant Service Account Activity in AI Service -
Persistence: New AI API Method -
Persistence: New Geography for AI Service -
Privilege Escalation: Anomalous Impersonation of Service Account for AI Admin Activity -
Privilege Escalation: Anomalous Multistep Service Account Delegation for AI Admin Activity -
Privilege Escalation: Anomalous Multistep Service Account Delegation for AI Data Access -
Privilege Escalation: Anomalous Service Account Impersonator for AI Admin Activity -
Privilege Escalation: Anomalous Service Account Impersonator for AI Data Access
Amenazas para los agentes implementados en el entorno de ejecución de Vertex AI Agent Engine
Security Command Center ejecuta la supervisión del entorno de ejecución y del plano de control de los agentes de IA implementados en el entorno de ejecución de Vertex AI Agent Engine.
Tipos de hallazgos del entorno de ejecución
Las siguientes detecciones del entorno de ejecución están disponibles con Agent Engine Threat Detection:
-
Execution: Added Malicious Binary Executed -
Execution: Added Malicious Library Loaded -
Execution: Built in Malicious Binary Executed -
Execution: Container Escape -
Execution: Kubernetes Attack Tool Execution -
Execution: Local Reconnaissance Tool Execution -
Execution: Malicious Python Executed -
Execution: Modified Malicious Binary Executed -
Execution: Modified Malicious Library Loaded -
Malicious Script Executed -
Malicious URL Observed -
Reverse Shell -
Unexpected Child Shell
Tipos de hallazgos del plano de control
Las siguientes detecciones del plano de control están disponibles con Event Threat Detection:
-
Credential Access: AI Agent Anomalous Access to Metadata Service -
Discovery: AI Agent Service Account Self-Investigation -
Discovery: AI Agent Unauthorized Service Account API Call -
Discovery: Evidence of Port Scanning from AI Agent -
Exfiltration: AI Agent Initiated BigQuery Data Exfiltration to External Table -
Exfiltration: AI Agent Initiated BigQuery Data Extraction -
Exfiltration: AI Agent Initiated BigQuery VPC Perimeter Violation -
Exfiltration: AI Agent Initiated CloudSQL Exfiltration to External Bucket -
Exfiltration: AI Agent Initiated CloudSQL Exfiltration to Public Bucket -
Initial Access: AI Agent Identity Excessive Permission Denied Actions -
Privilege Escalation: AI Agent Suspicious Cross-Project Access Token Generation -
Privilege Escalation: AI Agent Suspicious Cross-Project OpenID Token Generation -
Privilege Escalation: AI Agent Suspicious Token Generation Using Implicit Delegation -
Privilege Escalation: AI Agent Suspicious Token Generation Using signJwt
¿Qué sigue?
- Obtén información sobre Event Threat Detection.
- Obtén información sobre Agent Engine Threat Detection.
- Aprende a responder a los hallazgos de amenazas de IA.
- Consulta el Índice de hallazgos de amenazas.