-
GCP Vertex AI Caller Activity From High Number of Countries
Oct 7, 2026 · Domain: GenAI Domain: Cloud Data Source: GCP Vertex AI Data Source: GCP Data Source: Google Cloud Platform Platform: GCP Service: GCP Vertex AI Use Case: Threat Detection Tactic: Credential Access Tactic: Initial Access Threat: Impossible Travel Threat: LLMjacking Threat: Unauthorized AI Usage Mitre Atlas: AML.T0012 Mitre Atlas: AML.T0091 Mitre Atlas: AML.T0091.000 Resources: Investigation Guide Rule Type: ES|QL ·Detects Vertex AI authenticated caller activity for the same client.user.email from at least three countries and three source IPs within a four-hour interval. That pattern can indicate stolen user or service-account credentials reused from multiple regions, including VPN or cloud egress and return trips where first and last locations are close.
Read More -
GCP Vertex AI Caller Impossible Travel
Oct 7, 2026 · Domain: GenAI Domain: Cloud Data Source: GCP Vertex AI Data Source: GCP Data Source: Google Cloud Platform Platform: GCP Service: GCP Vertex AI Use Case: Threat Detection Tactic: Credential Access Tactic: Initial Access Threat: Impossible Travel Threat: LLMjacking Threat: Unauthorized AI Usage Mitre Atlas: AML.T0012 Mitre Atlas: AML.T0091 Mitre Atlas: AML.T0091.000 Resources: Investigation Guide Rule Type: ES|QL ·Detects the same Vertex AI authenticated caller (client.user.email) generating aiplatform audit activity from geographically distant source IPs within a short window at an impossible travel speed. That pattern can indicate a stolen user or service-account credential used from multiple regions. Related: GCP Vertex AI Caller Activity From High Number of Countries covers slower multi-country reuse without a high-speed hop.
Read More