GCP Audit: Service Account Modified via IAM Patch/Create/Update/Enable/Undelete

title: "GCP Audit: Service Account Modified via IAM Patch/Create/Update/Enable/Undelete"
id: e047eb5b-d0ae-4561-a967-9cd8c4c5240f
status: test
description: This rule identifies Google Cloud service account changes by matching GCP audit events whose method name ends with serviceAccounts.patch, .serviceAccounts.create, .serviceAccounts.update, .serviceAccounts.enable, or .serviceAccounts. Modifying a service account can be used to alter identities and permissions, enabling persistence or privilege changes. It relies on GCP audit log telemetry that records the audit method name for IAM service account operations.
references:
  - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_service_account_modified.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-14
modified: 2022-10-09
tags:
  - attack.impact
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name|endswith:
      - .serviceAccounts.patch
      - .serviceAccounts.create
      - .serviceAccounts.update
      - .serviceAccounts.enable
      - .serviceAccounts.undelete
  condition: selection
falsepositives:
  - Service Account being modified may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Service Account modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 6b67c12e-5e40-47c6-b3b0-1e6b571184cc
    type: derived