初始访问：AI 智能体身份权限遭拒操作次数过多

本文档介绍了 Security Command Center 中的一种威胁发现结果类型。当威胁检测器在您的云资源中检测到潜在威胁时，会生成威胁发现结果。如需查看可用威胁发现结果的完整列表，请参阅威胁发现结果索引。

概览

AI 智能体在多个方法和服务中反复触发“权限遭拒”错误。

Event Threat Detection 是此发现结果的来源。

如何应答

如需响应此发现结果，请执行以下操作：

第 1 步：查看发现结果详情

  1. 按照查看发现结果中所述，打开 Initial Access: AI Agent Identity Excessive Permission Denied Actions 发现结果。

  2. 在发现结果详情的摘要标签页上，记下以下字段的值。

    在检测到的内容下：

    • 主账号电子邮件地址：触发多个权限遭拒错误的主账号
    • 服务名称：上一次权限遭拒错误发生时正在使用的 Google Cloud 服务的 API 名称
    • 方法名称：上一次权限遭拒错误发生时调用的方法

  3. 在发现结果详情的来源属性标签页上，记下以下 JSON 字段的值：

    • properties.failedActions：发生的权限遭拒错误。对于每个条目，详细信息包括上次发生错误时的服务名称、方法名称、失败尝试次数以及错误发生时间。最多显示 10 个条目。

第 2 步：检查日志

  1. 在 Google Cloud 控制台中，点击 Cloud Logging URI 中的链接，以前往 Logs Explorer。
  2. 在 Google Cloud 控制台工具栏中，选择您的项目。

  3. 在加载的页面上，使用以下过滤条件查找相关日志：

    • protoPayload.authenticationInfo.principalEmail="PRINCIPAL_EMAIL"
    • protoPayload.status.code=7

    将 PRINCIPAL_EMAIL 替换为您在发现结果详情的主账号电子邮件地址字段中记录的值。

第 3 步：研究攻击和响应方法

  1. 查看此发现结果类型的 MITRE ATT&CK 框架条目：有效账号：云账号。
  2. 如需制定响应方案，请将您的调查结果与 MITRE 研究相结合。

第 4 步：实现响应

以下响应方案可能适合此发现结果，但也可能会影响运营。 请仔细评估您在研究中收集的信息，以确定解析发现结果的最佳方法。

  • 与主账号电子邮件地址字段中的账号所有者联系。确认合法所有者是否执行了此操作。
  • 删除该账号创建的项目资源，例如陌生的 Compute Engine 实例、快照、服务账号和 IAM 用户等。
  • 与该账号所在项目的所有者联系，并可能删除或停用该账号。

示例发现结果 JSON

以下是省略了默认值的发现结果 JSON 示例。

{
  "finding": {
    "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global/findings/FINDING_ID",
    "parent": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global",
    "resourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "state": "ACTIVE",
    "category": "Initial Access: AI Agent Identity Excessive Permission Denied Actions",
    "securityMarks": {
      "name": "organizations/ORGANIZATION_ID/sources/SOURCE_ID/locations/global/findings/FINDING_ID/securityMarks"
    },
    "eventTime": "TIMESTAMP",
    "createTime": "TIMESTAMP",
    "severity": "MEDIUM",
    "canonicalName": "projects/PROJECT_NUMBER/sources/SOURCE_ID/locations/global/findings/FINDING_ID",
    "findingClass": "THREAT",
    "contacts": {
      "security": {
        "contacts": [
          {
            "email": "USER_EMAIL"
          }
        ]
      },
      "technical": {
        "contacts": [
          {
            "email": "USER_EMAIL"
          }
        ]
      }
    },
    "access": {
      "callerIp": "IP_ADDRESS",
      "callerIpGeo": {
        "regionCode": "COUNTRY_CODE"
      },
      "userAgent": "USER_AGENT",
      "serviceName": "SERVICE_NAME",
      "methodName": "METHOD_NAME",
      "principalSubject": "principal://agents.global.org-ORGANIZATION_ID.system.id.goog/resources/aiplatform/projects/PROJECT_NUMBER/locations/LOCATION/reasoningEngines/REASONING_ENGINE_ID"
    },
    "mitreAttack": {
      "primaryTactic": "INITIAL_ACCESS",
      "primaryTechniques": [
        "VALID_ACCOUNTS",
        "CLOUD_ACCOUNTS"
      ]
    },
    "parentDisplayName": "Event Threat Detection",
    "domains": [
      {
        "category": "AI"
      },
      {
        "category": "IDENTITY_AND_ACCESS"
      }
    ],
    "logEntries": [
      {
        "cloudLoggingEntry": {
          "insertId": "INSERT_ID",
          "logId": "cloudaudit.googleapis.com/activity",
          "resourceContainer": "projects/PROJECT_ID",
          "timestamp": "TIMESTAMP"
        }
      }
    ]
  },
  "resource": {
    "name": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
    "displayName": "PROJECT_ID",
    "type": "google.cloud.resourcemanager.Project",
    "cloudProvider": "GOOGLE_CLOUD_PLATFORM",
    "service": "cloudresourcemanager.googleapis.com",
    "gcpMetadata": {
      "project": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER",
      "projectDisplayName": "PROJECT_ID",
      "parent": "//cloudresourcemanager.googleapis.com/folders/FOLDER_ID",
      "parentDisplayName": "FOLDER_NAME",
      "folders": [
        {
          "resourceFolder": "//cloudresourcemanager.googleapis.com/folders/FOLDER_ID",
          "resourceFolderDisplayName": "FOLDER_NAME"
        }
      ],
      "organization": "organizations/ORGANIZATION_ID"
    },
    "resourcePath": {
      "nodes": [
        {
          "nodeType": "GCP_PROJECT",
          "id": "projects/PROJECT_NUMBER",
          "displayName": "PROJECT_ID"
        },
        {
          "nodeType": "GCP_FOLDER",
          "id": "folders/FOLDER_ID",
          "displayName": "FOLDER_NAME"
        },
        {
          "nodeType": "GCP_ORGANIZATION",
          "id": "organizations/ORGANIZATION_ID"
        }
      ]
    },
    "resourcePathString": "organizations/ORGANIZATION_ID/folders/FOLDER_ID/projects/PROJECT_NUMBER"
  },
  "sourceProperties": {
    "sourceId": {
      "projectNumber": "PROJECT_NUMBER",
      "customerOrganizationNumber": "ORGANIZATION_ID"
    },
    "detectionCategory": {
      "ruleName": "agent_engine_excessive_failed_attempt"
    },
    "detectionPriority": "MEDIUM",
    "affectedResources": [
      {
        "gcpResourceName": "//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER"
      }
    ],
    "evidence": [
      {
        "sourceLogId": {
          "projectId": "PROJECT_ID",
          "resourceContainer": "projects/PROJECT_ID",
          "timestamp": {
            "seconds": "TIMESTAMP_SECONDS",
            "nanos": TIMESTAMP_NANOS
          },
          "insertId": "INSERT_ID",
          "logId": "cloudaudit.googleapis.com/activity"
        }
      }
    ],
    "properties": {
      "failedActions": [
        {
          "methodName": "METHOD_NAME",
          "serviceName": "SERVICE_NAME",
          "attemptTimes": "TIMES",
          "lastOccurredTime": "TIMESTAMP"
        },
        {
          "methodName": "METHOD_NAME",
          "serviceName": "SERVICE_NAME",
          "attemptTimes": "TIMES",
          "lastOccurredTime": "TIMESTAMP"
        }
      ]
    },
    "findingId": "FINDING_ID",
    "contextUris": {
      "mitreUri": {
        "displayName": "MITRE Link",
        "url": "https://attack.mitre.org/techniques/T1078/004/"
      },
      "cloudLoggingQueryUri": [
        {
          "displayName": "Cloud Logging Query Link",
          "url": "https://console.cloud.google.com/logs/query;query=timestamp%3D%22TIMESTAMP%22%0AinsertId%3D%22INSERT_ID%22?project=PROJECT_ID"
        }
      ]
    },
    "domains": [
      {
        "category": "AI"
      },
      {
        "category": "IDENTITY_AND_ACCESS"
      }
    ]
  }
}

后续步骤