Techniques
Sample rules
GCP Vertex AI Caller Activity From High Number of Countries
- source: elastic
- technicques:
- T1078
- T1528
Description
Detects Vertex AI authenticated caller activity for the same client.user.email from at least three countries and three source IPs within a four-hour interval. That pattern can indicate stolen user or service-account credentials reused from multiple regions, including VPN or cloud egress and return trips where first and last locations are close.
Detection logic
from logs-gcp_vertexai.auditlogs-*
| where
data_stream.dataset == "gcp_vertexai.auditlogs" and
client.user.email is not null and
source.ip is not null and
source.geo.location is not null and
source.geo.country_name is not null and
(
event.action like "*PredictionService.GenerateContent*" or
event.action like "*PredictionService.StreamGenerateContent*" or
event.action like "*PredictionService.CountTokens*"
)
| stats
Esql.country_count = count_distinct(source.geo.country_name),
Esql.source_ip_count = count_distinct(source.ip),
Esql.user_agent_count = count_distinct(user_agent.original),
Esql.event_count = count(*),
Esql.event_action_values = values(event.action),
Esql.source_ip_values = values(source.ip),
Esql.source_geo_country_name_values = values(source.geo.country_name),
Esql.source_geo_region_name_values = values(source.geo.region_name),
Esql.source_geo_city_name_values = values(source.geo.city_name),
Esql.source_as_organization_name_values = values(source.as.organization.name),
Esql.user_agent_original_values = values(user_agent.original),
Esql.timestamp_first_seen = min(@timestamp),
Esql.timestamp_last_seen = max(@timestamp)
by
client.user.email
| where Esql.country_count >= 3 and Esql.source_ip_count >= 3
| eval source.ip = MV_FIRST(Esql.source_ip_values)
| keep
client.user.email,
source.ip,
Esql.country_count,
Esql.source_ip_count,
Esql.user_agent_count,
Esql.event_count,
Esql.event_action_values,
Esql.source_ip_values,
Esql.source_geo_country_name_values,
Esql.source_geo_region_name_values,
Esql.source_geo_city_name_values,
Esql.source_as_organization_name_values,
Esql.user_agent_original_values,
Esql.timestamp_first_seen,
Esql.timestamp_last_seen