First Time GCP Vertex AI Agent Engine Sandbox Code Execution by User and Source ASN

  1[metadata]
  2creation_date = "2026/10/02"
  3integration = ["gcp_vertexai"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the first time a Vertex AI Agent Engine caller executes code in a sandboxEnvironment from a given source
 11autonomous system. First-time sandbox execution by a user and source ASN can indicate a new workload, stolen
 12credentials used from an unusual network, or early Agent Engine abuse before broader sandbox reuse is visible.
 13"""
 14false_positives = [
 15    """
 16    Developers, notebooks, and CI service accounts execute sandbox code from new offices, home ISPs, or cloud egress
 17    ASNs until baselined. Exclude known build and research identities after review.
 18    """,
 19]
 20from = "now-60m"
 21index = ["logs-gcp_vertexai.auditlogs-*"]
 22interval = "10m"
 23language = "kuery"
 24license = "Elastic License v2"
 25name = "First Time GCP Vertex AI Agent Engine Sandbox Code Execution by User and Source ASN"
 26note = """## Triage and analysis
 27
 28### Investigating First Time GCP Vertex AI Agent Engine Sandbox Code Execution by User and Source ASN
 29
 30This new-terms rule alerts when `client.user.email` combined with `source.as.number` first appears on a successful
 31Agent Engine `ExecuteSandboxEnvironment` call in the history window. It is an informational starting point for
 32reviewing who is running code in sandboxes and from where, not proof of hijacking.
 33
 34#### Possible investigation steps
 35
 36- Review `client.user.email`, `source.ip`, `source.as.number`, `source.as.organization.name`, and
 37  `gcp.vertexai.audit.resource_name` (sandbox path).
 38- Confirm whether the principal is expected to use Agent Engine and whether the ASN matches approved office, VPN, or
 39  cloud egress.
 40- Hunt nearby CreateSandboxEnvironment and additional ExecuteSandboxEnvironment events for the same sandbox or
 41  principal. Inspect application traces or captured code when available; audit logs omit submitted Python.
 42
 43### False positive analysis
 44
 45- First-time legitimate developers, CI service accounts, and research projects commonly match until identities and
 46  ASNs are baselined.
 47- Shared automation identities that rotate egress networks can create recurring first-seen pairs; prefer
 48  principal-scoped exceptions after ownership review.
 49
 50### Response and remediation
 51
 52- If the principal or ASN is unexpected: restrict or rotate credentials, review IAM grants, and inspect recent
 53  sandbox activity for unauthorized code execution.
 54- Prefer separate sandboxes across users or tenants and treat tool output as untrusted input to the agent.
 55"""
 56references = [
 57    "https://www.beyondtrust.com/blog/entry/vertex-ai-agent-engine-sandbox-hijack",
 58    "https://docs.cloud.google.com/gemini-enterprise-agent-platform/scale/sandbox/code-execution-quickstart",
 59    "https://www.elastic.co/docs/reference/integrations/gcp_vertexai",
 60]
 61risk_score = 21
 62rule_id = "0280de77-4296-42e0-b986-60da7e7ba15d"
 63setup = """## Setup
 64
 65Requires GCP Vertex AI `auditlogs` for `aiplatform.googleapis.com`, including
 66`SandboxEnvironmentExecutionService.ExecuteSandboxEnvironment`, with `client.user.email` and `source.as.number`
 67populated. Submitted code is not present in these events; obtain application code records or traces separately when
 68available.
 69"""
 70severity = "low"
 71tags = [
 72    "Domain: GenAI",
 73    "Domain: Cloud",
 74    "Data Source: GCP Vertex AI",
 75    "Data Source: GCP",
 76    "Data Source: Google Cloud Platform",
 77    "Platform: GCP",
 78    "Service: GCP Vertex AI",
 79    "Use Case: Threat Detection",
 80    "Tactic: Execution",
 81    "Threat: Unauthorized AI Usage",
 82    "Mitre Atlas: AML.T0053",
 83    "Mitre Atlas: AML.T0110",
 84    "Mitre Atlas: AML.T0110.002",
 85    "Resources: Investigation Guide",
 86    "Rule Type: New Terms",
 87]
 88timestamp_override = "event.ingested"
 89type = "new_terms"
 90
 91query = '''
 92data_stream.dataset:gcp_vertexai.auditlogs and event.action:*SandboxEnvironmentExecutionService.ExecuteSandboxEnvironment* and gcp.vertexai.audit.resource_name:*/sandboxEnvironments/* and gcp.vertexai.audit.service_name:aiplatform.googleapis.com and client.user.email:* and source.as.number:* and gcp.vertexai.audit.status.code:(0 or not *)
 93'''
 94
 95[rule.new_terms]
 96field = "new_terms_fields"
 97value = ["client.user.email", "source.as.number"]
 98
 99[[rule.new_terms.history_window_start]]
100field = "history_window_start"
101value = "now-14d"
102
103[[rule.threat]]
104framework = "MITRE ATT&CK"
105[[rule.threat.technique]]
106id = "T1059"
107name = "Command and Scripting Interpreter"
108reference = "https://attack.mitre.org/techniques/T1059/"
109[[rule.threat.technique.subtechnique]]
110id = "T1059.006"
111name = "Python"
112reference = "https://attack.mitre.org/techniques/T1059/006/"
113
114
115
116[rule.threat.tactic]
117id = "TA0002"
118name = "Execution"
119reference = "https://attack.mitre.org/tactics/TA0002/"
120[[rule.threat_mappings]]
121framework = "MITRE ATLAS"
122version = "2026.08"
123[[rule.threat_mappings.threat]]
124framework = "MITRE ATLAS"
125[[rule.threat_mappings.threat.technique]]
126id = "AML.T0053"
127name = "AI Agent Tool Invocation"
128reference = "https://atlas.mitre.org/techniques/AML.T0053/"
129
130
131[rule.threat_mappings.threat.tactic]
132id = "AML.TA0005"
133name = "Execution"
134reference = "https://atlas.mitre.org/tactics/AML.TA0005/"
135[[rule.threat_mappings.threat]]
136framework = "MITRE ATLAS"
137[[rule.threat_mappings.threat.technique]]
138id = "AML.T0110"
139name = "AI Agent Tool Poisoning"
140reference = "https://atlas.mitre.org/techniques/AML.T0110/"
141[[rule.threat_mappings.threat.technique.subtechnique]]
142id = "AML.T0110.002"
143name = "Runtime Response"
144reference = "https://atlas.mitre.org/techniques/AML.T0110.002/"
145
146
147
148[rule.threat_mappings.threat.tactic]
149id = "AML.TA0006"
150name = "Persistence"
151reference = "https://atlas.mitre.org/tactics/AML.TA0006/"
152
153[rule.investigation_fields]
154field_names = [
155    "client.user.email",
156    "source.as.number",
157    "source.as.organization.name",
158    "source.ip",
159    "gcp.vertexai.audit.resource_name",
160    "user_agent.original",
161    "event.action",
162]