Google Cloud Service Account Impersonation using GCPloit Exploitation Framework
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detect possible Google Cloud Service Account impersonation activity using the gcploit exploitation framework.
Strategy
Monitor Google Cloud Function Logs source:gcp.cloud.function and detect if the following sequence of events has occurred within a one minute window:
- Function is created -
google.cloud.functions.v1.CloudFunctionsService.CreateFunction with a timeout of 539s (@data.protoPayload.request.function.timeout:539s) - Function’s IAM access control policy is enumerated -
google.cloud.functions.v1.CloudFunctionsService.GetIamPolicy - Function’s IAM access control policy is set -
google.cloud.functions.v1.CloudFunctionsService.SetIamPolicy
Triage & Response
- Investigate if the function:
{{@function.name}} was intentionally created by user {{@usr.id}}. - If unauthorized:
- Revoke access of compromised credentials.
- Remove unauthorized cloud functions.
- Investigate other activities performed by the user
{{@usr.id}} using the Cloud SIEM - User Investigation dashboard.
