Title:
Google Cloud Service Account Disabled or Deleted
Status:
test
Description:Identifies when a service account is disabled or deleted in Google Cloud.
References:
-https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts
Author: Austin Songer @austinsonger
Date: 2021-08-14
modified:2022-10-09
Tags:
- -'attack.impact'
- -'attack.t1531'
Logsource:
- product: gcp
- service: gcp.audit
Detection:
selection:
gcp.audit.method_name|endswith:
-'.serviceAccounts.disable'
-'.serviceAccounts.delete'
condition:
selection
Falsepositives:
-Service Account being disabled or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
-Service Account disabled or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
Level:
medium
