Google Cloud Service Account Impersonation using GCPloit Exploitation Framework

Docs > Datadog Security > OOTB Rules > Google Cloud Service Account Impersonation using GCPloit Exploitation Framework

Classification:

attack

Tactic:

TA0004-privilege-escalation

Technique:

T1078-valid-accounts

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect possible Google Cloud Service Account impersonation activity using the gcploit exploitation framework.

Strategy

Monitor Google Cloud Function Logs source:gcp.cloud.function and detect if the following sequence of events has occurred within a one minute window:

Function is created - google.cloud.functions.v1.CloudFunctionsService.CreateFunction with a timeout of 539s (@data.protoPayload.request.function.timeout:539s)
Function’s IAM access control policy is enumerated - google.cloud.functions.v1.CloudFunctionsService.GetIamPolicy
Function’s IAM access control policy is set - google.cloud.functions.v1.CloudFunctionsService.SetIamPolicy

Triage & Response

Investigate if the function:{{@function.name}} was intentionally created by user {{@usr.id}}.
If unauthorized:
- Revoke access of compromised credentials.
- Remove unauthorized cloud functions.
- Investigate other activities performed by the user {{@usr.id}} using the Cloud SIEM - User Investigation dashboard.