GCP Audit: Service Account Modified via Service Accounts API Methods

Flags GCP audit events indicating service account create, update, enable, undelete, or patch operations.

FreeUnreviewedSigmamediumv1

gcp-audit-service-account-modified-via-service-accounts-api-methods-6b67c12e

title: "GCP Audit: Service Account Modified via Service Accounts API Methods"
id: e047eb5b-d0ae-4561-a967-9cd8c4c5240f
status: test
description: This rule identifies Google Cloud service account changes by matching GCP audit events whose method name ends with service account patch, create, update, enable, or undelete operations. Attackers may modify service accounts to change access, restore previously disabled accounts, or establish persistence using legitimate cloud identities. It relies on GCP audit telemetry that records the API method name and is emitted under the GCP audit log source.
references:
  - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_service_account_modified.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-14
modified: 2022-10-09
tags:
  - attack.impact
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name|endswith:
      - .serviceAccounts.patch
      - .serviceAccounts.create
      - .serviceAccounts.update
      - .serviceAccounts.enable
      - .serviceAccounts.undelete
  condition: selection
falsepositives:
  - Service Account being modified may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Service Account modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 6b67c12e-5e40-47c6-b3b0-1e6b571184cc
    type: derived

What it detects

This rule identifies Google Cloud service account changes by matching GCP audit events whose method name ends with service account patch, create, update, enable, or undelete operations. Attackers may modify service accounts to change access, restore previously disabled accounts, or establish persistence using legitimate cloud identities. It relies on GCP audit telemetry that records the API method name and is emitted under the GCP audit log source.

Known false positives

Service Account being modified may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
Service Account modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.