Suspicious Change of Google Cloud Service Account (via gcp.audit)

title: Suspicious Change of Google Cloud Service Account (via gcp.audit)
id: b1c798ef-2fe1-5da4-a7a5-f880118e0f75
status: stable
description: This rule detects when a service account is modified in Google Cloud.
references:
    - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts
author: Huntrule Team
date: 2026-03-21
tags:
    - attack.impact
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1098
logsource:
    product: gcp
    service: gcp.audit
detection:
    selection:
        gcp.audit.method_name|endswith:
            - .serviceAccounts.patch
            - .serviceAccounts.create
            - .serviceAccounts.update
            - .serviceAccounts.enable
            - .serviceAccounts.undelete
    condition: selection
falsepositives:
    - Unknown
level: medium