GCP Audit: Service Account Modified via IAM Patch/Create/Update/Enable/Undelete
Flags GCP audit events indicating service account create, update, enable, undelete, or patch operations.
FreeReviewedSigma · Medium · v4
- Product
- gcp
- Service
- gcp.audit
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-08-14
- Updated
- 2026-07-31
What it detects
This rule identifies Google Cloud service account changes by matching GCP audit events whose method name ends with serviceAccounts.patch, .serviceAccounts.create, .serviceAccounts.update, .serviceAccounts.enable, or .serviceAccounts. Modifying a service account can be used to alter identities and permissions, enabling persistence or privilege changes. It relies on GCP audit log telemetry that records the audit method name for IAM service account operations.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
gcp-audit-service-account-modified-via-service-accounts-api-methods-6b67c12e
title: "GCP Audit: Service Account Modified via IAM Patch/Create/Update/Enable/Undelete"
id: e047eb5b-d0ae-4561-a967-9cd8c4c5240f
status: test
description: This rule identifies Google Cloud service account changes by matching GCP audit events whose method name ends with serviceAccounts.patch, .serviceAccounts.create, .serviceAccounts.update, .serviceAccounts.enable, or .serviceAccounts. Modifying a service account can be used to alter identities and permissions, enabling persistence or privilege changes. It relies on GCP audit log telemetry that records the audit method name for IAM service account operations.
references:
- https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_service_account_modified.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-14
modified: 2022-10-09
tags:
- attack.impact
logsource:
product: gcp
service: gcp.audit
detection:
selection:
gcp.audit.method_name|endswith:
- .serviceAccounts.patch
- .serviceAccounts.create
- .serviceAccounts.update
- .serviceAccounts.enable
- .serviceAccounts.undelete
condition: selection
falsepositives:
- Service Account being modified may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
- Service Account modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
- id: 6b67c12e-5e40-47c6-b3b0-1e6b571184cc
type: derived