Google Cloud Audit: Service Account Disabled or Deleted

title: "Google Cloud Audit: Service Account Disabled or Deleted"
id: 30d4a92d-1578-4b1d-bd56-bbb7138e4041
status: test
description: This rule flags Google Cloud audit events where a service account is disabled or deleted via the serviceAccounts.disable or serviceAccounts.delete API methods. Disabling or deleting service accounts can disrupt access for applications and users, or be used by attackers to remove persistence and hinder investigation. Detection relies on GCP audit log telemetry that records the method name of the IAM operation.
references:
  - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_service_account_disabled_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-14
modified: 2022-10-09
tags:
  - attack.impact
  - attack.t1531
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name|endswith:
      - .serviceAccounts.disable
      - .serviceAccounts.delete
  condition: selection
falsepositives:
  - Service Account being disabled or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Service Account disabled or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 13f81a90-a69c-4fab-8f07-b5bb55416a9f
    type: derived