GCP Vertex AI Jailbreak Prompt Heuristics

  1[metadata]
  2creation_date = "2026/10/02"
  3integration = ["gcp_vertexai"]
  4maturity = "production"
  5min_stack_comments = "gcp_vertexai prompt_response_logs requires integration 1.4.0+ (Kibana ^9.2.0)."
  6min_stack_version = "9.3.0"
  7updated_date = "2026/10/02"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Detects Vertex AI GenerateContent prompts that match common jailbreak / instruction-override heuristics (for example
 13ignore previous instructions, DAN or developer mode, unrestricted-AI language, or explicit safety-filter bypass).
 14Typical prompt_response_logs exports do not populate HARM_CATEGORY_JAILBREAK (unlike hate/harassment/dangerous
 15ratings); Model Armor findings remain the preferred first-party jailbreak signal when that API is enabled.
 16"""
 17false_positives = [
 18    """
 19    Approved red-team or evaluation prompts that deliberately include jailbreak strings. Exclude known test principals
 20    or lower severity for those models.
 21    """,
 22]
 23from = "now-60m"
 24interval = "10m"
 25language = "esql"
 26license = "Elastic License v2"
 27name = "GCP Vertex AI Jailbreak Prompt Heuristics"
 28note = """## Triage and analysis
 29
 30### Investigating GCP Vertex AI Jailbreak Prompt Heuristics
 31
 32The user prompt matched common jailbreak / instruction-override language (for example "ignore
 33previous instructions", DAN/"Do Anything Now", or "bypass the safety filter"). This is a content
 34heuristic on prompt text — not a Model Armor finding or a Gemini `HARM_CATEGORY_JAILBREAK`
 35safety rating (that category is often absent from prompt_response_logs). Read the response to
 36see whether the model refused or complied.
 37
 38#### Possible investigation steps
 39
 40- Read `full_request.contents.parts.text` and `full_response.candidates.content.parts.text`. Confirm
 41  intent is instruction override or filter bypass versus an innocent mention of the word
 42  "jailbreak".
 43- Note `finish_reason`: `STOP` with a helpful reply after a jailbreak attempt is higher priority
 44  than a clear refusal; `SAFETY` means the provider blocked generation.
 45- Correlate with `logs-gcp_vertexai.auditlogs-*` GenerateContent in the same window for `source.ip`
 46  and `client.user.email`.
 47- Check for related alerts: repeated refusals, elevated safety ratings, credentials in prompt, or
 48  BLOCK_NONE from the same caller/model.
 49
 50### False positive analysis
 51
 52- Approved red-team, evaluation, or Model Armor test suites that deliberately include jailbreak
 53  strings. Exclude known test principals or models.
 54- Documentation that mentions "developer mode" or "without restrictions" in a non-adversarial
 55  context. Read the full prompt before escalating.
 56
 57### Response and remediation
 58
 59- If not an approved test: investigate the calling principal/IP, restrict or rotate credentials, and
 60  add application-side input filtering.
 61- Prefer enabling Model Armor / AI Protection for a first-party jailbreak or prompt-injection signal
 62  when available.
 63"""
 64references = [
 65    "https://www.elastic.co/docs/reference/integrations/gcp_vertexai",
 66    "https://cloud.google.com/blog/products/identity-security/introducing-ai-protection-security-for-the-ai-era",
 67    "https://github.com/elastic/integrations/issues/20740",
 68]
 69risk_score = 47
 70rule_id = "42cc9ad9-4ad1-4702-8abc-7d55096f6ee0"
 71setup = """## Setup
 72
 73Requires GCP Vertex AI `prompt_response_logs`. For a higher-fidelity jailbreak signal, enable Model Armor / AI Protection
 74and ingest those findings separately when available.
 75"""
 76severity = "medium"
 77tags = [
 78    "Domain: GenAI",
 79    "Domain: Cloud",
 80    "Data Source: GCP Vertex AI",
 81    "Data Source: GCP",
 82    "Data Source: Google Cloud Platform",
 83    "Platform: GCP",
 84    "Service: GCP Vertex AI",
 85    "Use Case: Threat Detection",
 86    "Tactic: Defense Evasion",
 87    "Threat: Unauthorized AI Usage",
 88    "Mitre Atlas: AML.T0051",
 89    "Mitre Atlas: AML.T0054",
 90    "Resources: Investigation Guide",
 91    "Rule Type: ES|QL",
 92]
 93timestamp_override = "event.ingested"
 94type = "esql"
 95
 96query = '''
 97from logs-gcp_vertexai.prompt_response_logs-* metadata _id, _version, _index
 98| where data_stream.dataset == "gcp_vertexai.prompt_response_logs"
 99| eval request_text = to_lower(coalesce(mv_concat(gcp.vertexai.prompt_response_logs.full_request.contents.parts.text, " "), ""))
100| where
101    request_text rlike ".*ignore (all |your )?(previous|prior) instructions.*" or
102    request_text rlike ".*disregard (your |all |the )?(system|developer|prior).*" or
103    request_text rlike ".*(dan|stan|aim|dude) mode.*" or
104    request_text rlike ".*do anything now.*" or
105    request_text like "*bypass*safety*" or
106    request_text like "*bypass*content*filter*" or
107    request_text like "*bypass*content*polic*" or
108    request_text like "*no safety filter*" or
109    request_text rlike ".*without (any |your |content |safety )?restrictions?.*" or
110    request_text like "*no content restriction*" or
111    request_text like "*unrestricted ai*" or
112    request_text like "*jailbreak*" or
113    request_text like "*forget everything you were told*" or
114    request_text like "*you are dan*" or
115    request_text like "*developer mode*" or
116    request_text like "*override your safety*" or
117    request_text like "*hidden system prompt*" or
118    request_text like "*ignore the content policy*" or
119    request_text like "*ignore all previous*" or
120    request_text like "*ignore prior instructions*" or
121    request_text like "*ignore your previous*"
122| keep
123    _id,
124    _version,
125    _index,
126    @timestamp,
127    cloud.project.id,
128    gcp.vertexai.prompt_response_logs.model,
129    gcp.vertexai.prompt_response_logs.api_method,
130    gcp.vertexai.prompt_response_logs.full_request.contents.parts.text,
131    gcp.vertexai.prompt_response_logs.full_response.candidates.content.parts.text,
132    gcp.vertexai.prompt_response_logs.full_response.candidates.finish_reason
133'''
134
135
136[[rule.threat]]
137framework = "MITRE ATT&CK"
138[[rule.threat.technique]]
139id = "T1562"
140name = "Impair Defenses"
141reference = "https://attack.mitre.org/techniques/T1562/"
142
143
144[rule.threat.tactic]
145id = "TA0005"
146name = "Defense Evasion"
147reference = "https://attack.mitre.org/tactics/TA0005/"
148[[rule.threat_mappings]]
149framework = "MITRE ATLAS"
150version = "2026.08"
151[[rule.threat_mappings.threat]]
152framework = "MITRE ATLAS"
153[[rule.threat_mappings.threat.technique]]
154id = "AML.T0051"
155name = "LLM Prompt Injection"
156reference = "https://atlas.mitre.org/techniques/AML.T0051/"
157
158
159[rule.threat_mappings.threat.tactic]
160id = "AML.TA0005"
161name = "Execution"
162reference = "https://atlas.mitre.org/tactics/AML.TA0005/"
163[[rule.threat_mappings.threat]]
164framework = "MITRE ATLAS"
165[[rule.threat_mappings.threat.technique]]
166id = "AML.T0054"
167name = "LLM Jailbreak"
168reference = "https://atlas.mitre.org/techniques/AML.T0054/"
169
170
171[rule.threat_mappings.threat.tactic]
172id = "AML.TA0007"
173name = "Defense Evasion"
174reference = "https://atlas.mitre.org/tactics/AML.TA0007/"
175
176[rule.investigation_fields]
177field_names = [
178    "cloud.project.id",
179    "gcp.vertexai.prompt_response_logs.model",
180    "gcp.vertexai.prompt_response_logs.api_method",
181    "gcp.vertexai.prompt_response_logs.full_request.contents.parts.text",
182    "gcp.vertexai.prompt_response_logs.full_response.candidates.content.parts.text",
183    "gcp.vertexai.prompt_response_logs.full_response.candidates.finish_reason",
184]