GCP Service Account Key Creation

 1[metadata]
 2creation_date = "2020/09/21"
 3integration = ["gcp"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies when a new key is created for a service account in Google Cloud Platform (GCP). A service account is a
11special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use
12service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud
13Identity users through domain-wide delegation. If private keys are not tracked and managed properly, they can present a
14security risk. An adversary may create a new key for a service account in order to attempt to abuse the permissions
15assigned to that account and evade detection.
16"""
17false_positives = [
18    """
19    Service account keys may be created by system administrators. Verify that the configuration change was expected.
20    Exceptions can be added to this rule to filter expected behavior.
21    """,
22]
23index = ["filebeat-*", "logs-gcp*"]
24language = "kuery"
25license = "Elastic License v2"
26name = "GCP Service Account Key Creation"
27note = """## Setup
28
29The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
30references = [
31    "https://cloud.google.com/iam/docs/service-accounts",
32    "https://cloud.google.com/iam/docs/creating-managing-service-account-keys",
33]
34risk_score = 21
35rule_id = "0e5acaae-6a64-4bbc-adb8-27649c03f7e1"
36severity = "low"
37tags = [
38    "Domain: Cloud",
39    "Data Source: GCP",
40    "Data Source: Google Cloud Platform",
41    "Use Case: Identity and Access Audit",
42    "Tactic: Persistence",
43]
44timestamp_override = "event.ingested"
45type = "query"
46
47query = '''
48event.dataset:gcp.audit and event.action:google.iam.admin.v*.CreateServiceAccountKey and event.outcome:success
49'''
50
51
52[[rule.threat]]
53framework = "MITRE ATT&CK"
54[[rule.threat.technique]]
55id = "T1098"
56name = "Account Manipulation"
57reference = "https://attack.mitre.org/techniques/T1098/"
58
59
60[rule.threat.tactic]
61id = "TA0003"
62name = "Persistence"
63reference = "https://attack.mitre.org/tactics/TA0003/"