Cloud GPU Instance Launched for Resource Hijacking

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects the launch of a GPU instance in Google Cloud Platform (GCP) by monitoring HTTP traffic. Specifically, it looks for HTTP requests to 'compute.googleapis.com' with the URI containing '/instances' and the client body containing 'acceleratorType' (case-insensitive). This combination suggests an attempt to provision a GPU-enabled virtual machine, which could be indicative of resource hijacking for purposes like cryptocurrency mining or other compute-intensive malicious activities.