platform or ml engineering teams granting vertex ai access to new users and service accounts. confirm the grant against change records or the access request process.

Techniques

T1098

Sample rules

GCP Vertex AI Role Granted to Principal

source: elastic
technicques:
- T1098

Description

Identifies an IAM policy change on a Google Cloud project, folder, or organization that grants a Vertex AI role (roles/aiplatform.*) to a principal. Vertex AI roles control who can invoke models, deploy endpoints, run agents, and read prompt and training data. An adversary who has gained IAM administration rights can grant a Vertex AI role to an identity they control to keep model access after the original foothold is removed, or to run LLMjacking workloads under the victim’s billing. Google-managed service agent roles are excluded because Google grants them automatically when the API is enabled.

Detection logic

data_stream.dataset: "gcp.audit"
  and event.action: (
    "SetIamPolicy" or
    google.cloud.resourcemanager.v*.Folders.SetIamPolicy or
    google.cloud.resourcemanager.v*.Organizations.SetIamPolicy or
    google.cloud.resourcemanager.v*.Projects.SetIamPolicy
  )
  and not event.outcome: "failure"
  and gcp.audit.service_data.policy_delta.binding_deltas:{
    action: "ADD" and
    role: (roles/aiplatform.* and not (*ServiceAgent or *serviceAgent))
  }