GCP IAM - Service Account Keys Enumeration

Back


Id	7ad3cfed-18c0-44af-9e9d-9fb5472a2321
Rulename	GCP IAM - Service Account Keys Enumeration
Description	Detects possible service account keys enumeration.
Severity	Low
Tactics	Discovery
Techniques	T1069
Required data connectors	GCPIAMDataConnector
Kind	Scheduled
Query frequency	12h
Query period	12h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformIAM/Analytic Rules/GCPIAMServiceAccountKeysEnumeration.yaml
Version	1.0.0
Arm template	7ad3cfed-18c0-44af-9e9d-9fb5472a2321.json

KQL

let threshold = 5;
GCP_IAM
| where PayloadMethodname =~ 'google.iam.admin.v1.ListServiceAccountsKeys'
| summarize count() by PayloadAuthenticationinfoPrincipalemail, bin(TimeGenerated, 1h)
| where count_ > threshold
| extend AccountCustomEntity = PayloadAuthenticationinfoPrincipalemail

YAML

queryPeriod: 12h
query: |
  let threshold = 5;
  GCP_IAM
  | where PayloadMethodname =~ 'google.iam.admin.v1.ListServiceAccountsKeys'
  | summarize count() by PayloadAuthenticationinfoPrincipalemail, bin(TimeGenerated, 1h)
  | where count_ > threshold
  | extend AccountCustomEntity = PayloadAuthenticationinfoPrincipalemail  
name: GCP IAM - Service Account Keys Enumeration
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
queryFrequency: 12h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformIAM/Analytic Rules/GCPIAMServiceAccountKeysEnumeration.yaml
requiredDataConnectors:
- connectorId: GCPIAMDataConnector
  dataTypes:
  - GCP_IAM
description: |
    'Detects possible service account keys enumeration.'
kind: Scheduled
version: 1.0.0
status: Available
severity: Low
relevantTechniques:
- T1069
triggerOperator: gt
triggerThreshold: 0
tactics:
- Discovery
id: 7ad3cfed-18c0-44af-9e9d-9fb5472a2321

ARM