Analytics Story: GCP Cross Account Activity
Description
Track when a user assumes an IAM role in another GCP account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity.
Why it matters
Google Cloud Platform (GCP) admins manage access to GCP resources and services across the enterprise using GCP Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage GCP users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as Compute instances, the GCP Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are potentially assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period. In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment. This Analytic Story includes searches that will help you monitor your GCP Audit logs logs for evidence of suspicious cross-account activity. For example, while accessing multiple GCP accounts and roles may be perfectly valid behavior, it may be suspicious when an account requests privileges of an account it has not accessed in the past. After identifying suspicious activities, you can use the provided investigative searches to help you probe more deeply.
Detections
| Name | Technique | Type |
|---|---|---|
| GCP Detect gcploit framework | Valid Accounts | TTP |
| GCP Detect accounts with high risk roles by project | Valid Accounts | Hunting |
| GCP Detect high risk permissions by resource and account | Valid Accounts | Hunting |
| gcp detect oauth token abuse | Valid Accounts | Hunting |
Data Sources
| Name | Platform | Sourcetype | Source |
|---|
References
Source: GitHub | Version: 1