Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Dokumen ini menjelaskan jenis temuan ancaman di Security Command Center. Temuan ancaman dibuat oleh
pendeteksi ancaman saat mendeteksi
potensi ancaman di resource cloud Anda. Untuk daftar lengkap temuan ancaman yang tersedia, lihat Indeks temuan ancaman.
Ringkasan
Aktivitas admin yang tidak normal untuk layanan AI oleh aktor yang berpotensi berbahaya terdeteksi di organisasi, folder, atau project. Aktivitas yang tidak wajar dapat berupa salah satu dari berikut ini:
Aktivitas baru oleh akun utama di organisasi, folder, atau project
Aktivitas yang sudah lama tidak terlihat, yang dilakukan oleh prinsipal dalam organisasi, folder, atau project
Cara merespons
Untuk menanggapi temuan ini, lakukan hal berikut:
Langkah 1: Tinjau detail temuan
Buka temuan Persistence: New AI API Method seperti yang diarahkan dalam Meninjau temuan.
Di detail temuan, pada tab Ringkasan, catat nilai kolom berikut:
Di bagian Yang terdeteksi:
Email utama: akun yang melakukan panggilan
Nama metode: metode yang dipanggil
Resource AI: resource AI yang berpotensi terpengaruh, seperti resource Vertex AI dan model AI.
Di bagian Resource yang terpengaruh:
Nama tampilan resource: nama resource yang terpengaruh, yang dapat sama dengan nama organisasi, folder, atau project
Jalur resource: lokasi dalam hierarki resource tempat aktivitas terjadi
Langkah 2: Meneliti metode serangan dan respons
Tinjau entri framework MITRE ATT&CK untuk jenis temuan ini: Persistensi.
Selidiki apakah tindakan tersebut diperlukan di organisasi, folder, atau project dan apakah tindakan tersebut dilakukan oleh pemilik akun yang sah. Organisasi, folder, atau project ditampilkan di kolom Jalur resource dan akun ditampilkan di baris Email utama.
Untuk mengembangkan rencana respons, gabungkan hasil penyelidikan Anda dengan riset MITRE.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-05 UTC."],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nAnomalous admin activity for AI services by a potentially malicious actor was\ndetected in an organization, folder, or project. Anomalous activity can be\neither of the following:\n\n- New activity by a principal in an organization, folder, or project\n- Activity that has not been seen in a while, performed by a principal in an organization, folder, or project\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nStep 1: Review finding details\n\n1. Open the `Persistence: New AI API Method` finding as directed in [Reviewing findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings).\n2. In the finding details, on the **Summary** tab, note the values of the following fields:\n\n - Under **What was detected** :\n - **Principal email**: the account that made the call\n - **Method name**: the method that was called\n - AI resources: the potentially impacted AI resources, such as the Vertex AI resources and the AI model.\n - Under **Affected resource** :\n - **Resource display name**: the name of the affected resource, which can be the same as the name of the organization, folder, or project\n - **Resource path**: the location in the resource hierarchy where the activity took place\n\nStep 2: Research attack and response methods\n\n1. Review MITRE ATT\\&CK framework entries for this finding type: **Persistence**.\n2. Investigate whether the action was warranted in the organization, folder, or project and whether the action was taken by the legitimate owner of the account. The organization, folder, or project is displayed on the **Resource path** field and the account is displayed in the **Principal email** row.\n3. To develop a response plan, combine your investigation results with MITRE research.\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
