GCP Service Account Key Creation

 1[metadata]
 2creation_date = "2020/09/21"
 3integration = ["gcp"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies when a new key is created for a service account in Google Cloud Platform (GCP). A service account is a
13special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use
14service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud
15Identity users through domain-wide delegation. If private keys are not tracked and managed properly, they can present a
16security risk. An adversary may create a new key for a service account in order to attempt to abuse the permissions
17assigned to that account and evade detection.
18"""
19false_positives = [
20    """
21    Service account keys may be created by system administrators. Verify that the configuration change was expected.
22    Exceptions can be added to this rule to filter expected behavior.
23    """,
24]
25index = ["filebeat-*", "logs-gcp*"]
26language = "kuery"
27license = "Elastic License v2"
28name = "GCP Service Account Key Creation"
29note = """## Setup
30
31The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
32references = [
33    "https://cloud.google.com/iam/docs/service-accounts",
34    "https://cloud.google.com/iam/docs/creating-managing-service-account-keys",
35]
36risk_score = 21
37rule_id = "0e5acaae-6a64-4bbc-adb8-27649c03f7e1"
38severity = "low"
39tags = ["Domain: Cloud", "Data Source: GCP", "Data Source: Google Cloud Platform", "Use Case: Identity and Access Audit", "Tactic: Persistence"]
40timestamp_override = "event.ingested"
41type = "query"
42
43query = '''
44event.dataset:gcp.audit and event.action:google.iam.admin.v*.CreateServiceAccountKey and event.outcome:success
45'''
46
47
48[[rule.threat]]
49framework = "MITRE ATT&CK"
50[[rule.threat.technique]]
51id = "T1098"
52name = "Account Manipulation"
53reference = "https://attack.mitre.org/techniques/T1098/"
54
55
56[rule.threat.tactic]
57id = "TA0003"
58name = "Persistence"
59reference = "https://attack.mitre.org/tactics/TA0003/"