LoFP / developers, notebooks, and ci service accounts execute sandbox code from new offices, home isps, or cloud egress asns until baselined. exclude known build and research identities after review.

Techniques

• T1059

Sample rules

First Time GCP Vertex AI Agent Engine Sandbox Code Execution by User and Source ASN

• source: elastic
• technicques:
  • T1059

Description

Detects the first time a Vertex AI Agent Engine caller executes code in a sandboxEnvironment from a given source autonomous system. First-time sandbox execution by a user and source ASN can indicate a new workload, stolen credentials used from an unusual network, or early Agent Engine abuse before broader sandbox reuse is visible.

Detection logic

data_stream.dataset:gcp_vertexai.auditlogs and event.action:*SandboxEnvironmentExecutionService.ExecuteSandboxEnvironment* and gcp.vertexai.audit.resource_name:*/sandboxEnvironments/* and gcp.vertexai.audit.service_name:aiplatform.googleapis.com and client.user.email:* and source.as.number:* and gcp.vertexai.audit.status.code:(0 or not *)