Google Cloud Service Account Impersonation activity using access token generation

Classification:

attack

Tactic:

Technique:

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detect Google Cloud service account impersonation activity through the use of access tokens.

Monitor Google Cloud Admin Activity audit logs for event @evt.name:GenerateAccessToken:

Investigate if the user {{@usr.id}} from IP address:{{@network.client.ip}} intended to perform this activity.
If unauthorized:
- Revoke access of compromised user and service account.
- Investigate other activities performed by the user {{@usr.id}} using the Cloud SIEM - User Investigation dashboard.
- Investigate other activities performed by the IP {{@network.client.ip}} using the Cloud SIEM - IP Investigation dashboard.