GCP Vertex AI Role Granted to Principal

  1[metadata]
  2creation_date = "2026/10/23"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/10/23"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies an IAM policy change on a Google Cloud project, folder, or organization that grants a Vertex AI role
 11(`roles/aiplatform.*`) to a principal. Vertex AI roles control who can invoke models, deploy endpoints, run agents, and
 12read prompt and training data. An adversary who has gained IAM administration rights can grant a Vertex AI role to an
 13identity they control to keep model access after the original foothold is removed, or to run LLMjacking workloads under
 14the victim's billing. Google-managed service agent roles are excluded because Google grants them automatically when the
 15API is enabled.
 16"""
 17false_positives = [
 18    """
 19    Platform or ML engineering teams granting Vertex AI access to new users and service accounts. Confirm the grant
 20    against change records or the access request process.
 21    """,
 22    """
 23    Infrastructure-as-code pipelines that manage project IAM bindings. Add exceptions for the service accounts that run
 24    these pipelines.
 25    """,
 26]
 27from = "now-9m"
 28index = ["logs-gcp.audit-*"]
 29language = "kuery"
 30license = "Elastic License v2"
 31name = "GCP Vertex AI Role Granted to Principal"
 32note = """## Triage and analysis
 33
 34### Investigating GCP Vertex AI Role Granted to Principal
 35
 36A Google Cloud IAM policy change added a binding for a Vertex AI role (`roles/aiplatform.*`). Roles such as
 37`roles/aiplatform.admin` and `roles/aiplatform.user` allow the member to call models, manage endpoints and agents, and
 38access prompt and training data in the project.
 39
 40### Possible investigation steps
 41
 42- Identify the caller that changed the policy from `client.user.email`, and review `source.ip` and
 43  `user_agent.original` for the change.
 44- Review `gcp.audit.service_data.policy_delta.binding_deltas` for the role and member that were added. Members outside
 45  the organization's domain, newly created service accounts, and `allUsers` or `allAuthenticatedUsers` are the most
 46  concerning.
 47- Check `gcp.audit.resource_name` to see whether the grant was made at the project, folder, or organization level.
 48  Grants above the project level reach every project underneath.
 49- Look for follow-on activity by the new member in Vertex AI audit logs, such as inference calls from new networks,
 50  endpoint deployment, or agent creation.
 51- Review other recent IAM changes by the same caller, especially service account key creation and grants of IAM admin
 52  roles.
 53
 54### False positive analysis
 55
 56- Approved access requests for ML and data science teams. Confirm with the request owner.
 57- IAM automation that reapplies bindings. Exclude those service accounts by email.
 58
 59### Response and remediation
 60
 61- If the grant is not authorized, remove the binding and review what the member accessed since the grant.
 62- Investigate how the caller obtained IAM administration rights, rotate its credentials, and review its other changes.
 63- Restrict `resourcemanager.projects.setIamPolicy` to a small set of administrators and consider an Organization Policy
 64  that limits allowed member domains.
 65"""
 66references = [
 67    "https://cloud.google.com/vertex-ai/docs/general/access-control",
 68    "https://cloud.google.com/iam/docs/audit-logging",
 69    "https://www.elastic.co/docs/reference/integrations/gcp/audit",
 70]
 71risk_score = 47
 72rule_id = "23b73162-cfaf-457d-9ba1-333b907d2a39"
 73setup = """## Setup
 74
 75This rule requires Google Cloud Audit Logs ingested via the GCP integration (`gcp.audit` data stream). IAM policy
 76changes are Admin Activity audit logs and are always logged.
 77"""
 78severity = "medium"
 79tags = [
 80    "Domain: Cloud",
 81    "Domain: GenAI",
 82    "Domain: Identity",
 83    "Data Source: GCP",
 84    "Data Source: Google Cloud Platform",
 85    "Platform: GCP",
 86    "Service: GCP Vertex AI",
 87    "Use Case: Identity and Access Audit",
 88    "Use Case: Threat Detection",
 89    "Tactic: Persistence",
 90    "Tactic: Privilege Escalation",
 91    "Threat: Unauthorized AI Usage",
 92    "Mitre Atlas: AML.T0012",
 93    "Resources: Investigation Guide",
 94    "Rule Type: Custom Query (KQL)",
 95]
 96timestamp_override = "event.ingested"
 97type = "query"
 98
 99query = '''
100data_stream.dataset: "gcp.audit"
101  and event.action: (
102    "SetIamPolicy" or
103    google.cloud.resourcemanager.v*.Folders.SetIamPolicy or
104    google.cloud.resourcemanager.v*.Organizations.SetIamPolicy or
105    google.cloud.resourcemanager.v*.Projects.SetIamPolicy
106  )
107  and not event.outcome: "failure"
108  and gcp.audit.service_data.policy_delta.binding_deltas:{
109    action: "ADD" and
110    role: (roles/aiplatform.* and not (*ServiceAgent or *serviceAgent))
111  }
112'''
113
114
115[[rule.threat]]
116framework = "MITRE ATT&CK"
117[[rule.threat.technique]]
118id = "T1098"
119name = "Account Manipulation"
120reference = "https://attack.mitre.org/techniques/T1098/"
121[[rule.threat.technique.subtechnique]]
122id = "T1098.003"
123name = "Additional Cloud Roles"
124reference = "https://attack.mitre.org/techniques/T1098/003/"
125
126
127
128[rule.threat.tactic]
129id = "TA0003"
130name = "Persistence"
131reference = "https://attack.mitre.org/tactics/TA0003/"
132[[rule.threat]]
133framework = "MITRE ATT&CK"
134[[rule.threat.technique]]
135id = "T1098"
136name = "Account Manipulation"
137reference = "https://attack.mitre.org/techniques/T1098/"
138[[rule.threat.technique.subtechnique]]
139id = "T1098.003"
140name = "Additional Cloud Roles"
141reference = "https://attack.mitre.org/techniques/T1098/003/"
142
143
144
145[rule.threat.tactic]
146id = "TA0004"
147name = "Privilege Escalation"
148reference = "https://attack.mitre.org/tactics/TA0004/"
149[[rule.threat_mappings]]
150framework = "MITRE ATLAS"
151version = "2026.09"
152[[rule.threat_mappings.threat]]
153framework = "MITRE ATLAS"
154[[rule.threat_mappings.threat.technique]]
155id = "AML.T0012"
156name = "Valid Accounts"
157reference = "https://atlas.mitre.org/techniques/AML.T0012/"
158
159
160[rule.threat_mappings.threat.tactic]
161id = "AML.TA0012"
162name = "Privilege Escalation"
163reference = "https://atlas.mitre.org/tactics/AML.TA0012/"
164
165[rule.investigation_fields]
166field_names = [
167    "@timestamp",
168    "client.user.email",
169    "event.action",
170    "gcp.audit.resource_name",
171    "gcp.audit.service_data.policy_delta.binding_deltas.action",
172    "gcp.audit.service_data.policy_delta.binding_deltas.role",
173    "gcp.audit.service_data.policy_delta.binding_deltas.member",
174    "source.ip",
175    "user_agent.original",
176]