Google Cloud: Service Account Disabled or Deleted via IAM Audit Events

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1531Account Access Removal

What it detects

This rule identifies Google Cloud IAM service account disablement or deletion actions by matching audit method names that end with .serviceAccounts.disable and .serviceAccounts.delete. Attackers may disable or remove service accounts to break access paths or to cover tracks after gaining control. The detection relies on GCP audit log telemetry that records the IAM method name for these account lifecycle changes.

Reporting behind it

Related detections9 linkedT1531 — drag to rearrange

Malicious Mass Device Wipe via Intune Remote Actions (via m365)

Suspicious Account Disable via net user active no (via process_creation)

AWS IAM SAML Provider Deletion via CloudTrail

Linux userdel Execution: User Account Deletion via userdel

Linux groupdel Executed to Delete a User Group

Windows Security Logoff Events (Event ID 4634/4647)

Windows PowerShell Script: Remove Account From Domain Admin Group via Remove-ADGroupMember

Okta User Account Lockout Triggered by Max Sign-In Attempts

Azure Kubernetes Service Service Account Modified or Deleted Activity Log Events

Google Cloud: Service Account Disabled or Deleted via IAM Audit Events

Pivot detection · T1531 · 9 related

Changelog

v4

v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

google-cloud-audit-service-account-disabled-or-deleted-13f81a90

title: "Google Cloud: Service Account Disabled or Deleted via IAM Audit Events"
id: 30d4a92d-1578-4b1d-bd56-bbb7138e4041
status: test
description: This rule identifies Google Cloud IAM service account disablement or deletion actions by matching audit method names that end with .serviceAccounts.disable and .serviceAccounts.delete. Attackers may disable or remove service accounts to break access paths or to cover tracks after gaining control. The detection relies on GCP audit log telemetry that records the IAM method name for these account lifecycle changes.
references:
  - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_service_account_disabled_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-14
modified: 2022-10-09
tags:
  - attack.impact
  - attack.t1531
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name|endswith:
      - .serviceAccounts.disable
      - .serviceAccounts.delete
  condition: selection
falsepositives:
  - Service Account being disabled or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Service Account disabled or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 13f81a90-a69c-4fab-8f07-b5bb55416a9f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL