Suspicious Google Cloud Service Account Disabled or Deleted (via gcp.audit)

title: Suspicious Google Cloud Service Account Disabled or Deleted (via gcp.audit)
id: a438f3e8-e736-530f-80e7-49f29be2177e
status: stable
description: This rule detects when a service account is disabled or deleted in Google Cloud.
references:
    - https://attack.mitre.org/techniques/T1531/
    - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts
author: Huntrule Team
date: 2026-04-29
tags:
    - attack.impact
    - attack.t1531
logsource:
    product: gcp
    service: gcp.audit
detection:
    selection:
        gcp.audit.method_name|endswith:
            - .serviceAccounts.disable
            - .serviceAccounts.delete
    condition: selection
falsepositives:
    - Unknown
level: medium