detection.wiki

Identity and Access Management (IAM)

methodNameDescriptionLog typeSampleRule
anyCatch-all entry for iam.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.activityNY
google.iam.IAMPolicy.GetIamPolicydata_accessNN
google.iam.IAMPolicy.SetIamPolicySets the access control policy on the specified resource. Replaces any existing policy. This method is used by BigQuery, Pub/Sub, and other services that delegate IAM to the shared IAMPolicy service.activityYY
google.iam.IAMPolicy.TestIamPermissionsdata_accessNN
google.iam.Policies.CreatePolicyCreates a policy.activityNN
google.iam.Policies.DeletePolicyDeletes a policy.activityNN
google.iam.Policies.GetPolicydata_accessNN
google.iam.Policies.ListPoliciesdata_accessNN
google.iam.Policies.UpdatePolicyUpdates the specified policy.activityNN
google.iam.WorkloadIdentityPools.DeleteWorkloadIdentityPoolDeletes a WorkloadIdentityPool. You cannot use a deleted pool to exchange external credentials for Google credentials.activityYY
google.iam.WorkloadIdentityPools.UpdateWorkloadIdentityPoolUpdates an existing WorkloadIdentityPool.activityYY
google.iam.admin.CreateRoleCreates a new custom Role.activityYY
google.iam.admin.CreateServiceAccountCreates a ServiceAccount.activityYY
google.iam.admin.CreateServiceAccountKeyCreates a ServiceAccountKey.activityYY
google.iam.admin.DeleteRoleDeletes a Role and all associated bindings.activityYY
google.iam.admin.DeleteServiceAccountDeletes a ServiceAccount.activityYY
google.iam.admin.DeleteServiceAccountKeyDeletes a ServiceAccountKey.activityNY
google.iam.admin.DisableServiceAccountactivityYY
google.iam.admin.DisableServiceAccountKeyactivityNN
google.iam.admin.EnableServiceAccountactivityNY
google.iam.admin.EnableServiceAccountKeyactivityNN
google.iam.admin.GetIamPolicydata_accessYN
google.iam.admin.GetRoledata_accessYN
google.iam.admin.GetServiceAccountdata_accessYN
google.iam.admin.GetServiceAccountKeydata_accessNN
google.iam.admin.LintPolicyactivityNN
google.iam.admin.ListRolesdata_accessYY
google.iam.admin.ListServiceAccountKeysdata_accessYY
google.iam.admin.ListServiceAccountsdata_accessYY
google.iam.admin.PatchServiceAccountactivityNY
google.iam.admin.QueryAuditableServicesdata_accessNN
google.iam.admin.QueryGrantableRolesdata_accessNN
google.iam.admin.QueryTestablePermissionsdata_accessNN
google.iam.admin.SetIamPolicyactivityYY
google.iam.admin.SignBlobactivityNN
google.iam.admin.SignJwtactivityNN
google.iam.admin.TestIamPermissionsdata_accessNN
google.iam.admin.UndeleteRoleactivityNN
google.iam.admin.UndeleteServiceAccountactivityNY
google.iam.admin.UpdateRoleUpdates a Role definition.activityYY
google.iam.admin.UpdateServiceAccountPatches a ServiceAccount.activityNY
google.iam.admin.UploadServiceAccountKeyCreates a ServiceAccountKey, obtained from an existing key pair or Google-generated key pair.activityYY
google.iam.admin.WorkforcePools.CreateWorkforcePoolCreates a workforce identity pool.activityNY
google.iam.admin.WorkforcePools.UpdateWorkforcePoolUpdates a workforce identity pool.activityNY
google.iam.WorkloadIdentityPools.CreateWorkloadIdentityPoolProviderCreates a workload identity pool provider.activityNY
google.iam.WorkloadIdentityPools.ListWorkloadIdentityPoolsList workload identity pools.data_accessYN
iam.serviceAccounts.actAsAuthorization to impersonate (actAs) a service account.activityYN
google.iam.WorkloadIdentityPools.UpdateWorkloadIdentityPoolProviderUpdates a workload identity pool provider.activityNY

any: iam.googleapis.com (any method)

#
ServiceName
iam.googleapis.com

Description

Catch-all entry for iam.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
protoPayload.authorizationInfo (panther rule field)is_not_null4 rulespanther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

  • GCP iam.roles.update Privilege Escalation source high: If your user is assigned a custom IAM role, then iam.roles.update will allow you to update the “includedPermissons” on that role. Because it is assigned to you, you will gain the additional privileges, which could be anything you desire.
  • GCP.Iam.ServiceAccountKeys.Create source high: If your user is assigned a custom IAM role, then iam.roles.update will allow you to update the “includedPermissons” on that role. Because it is assigned to you, you will gain the additional privileges, which could be anything you desire.T1548
  • GCP IAM serviceAccounts getAccessToken Privilege Escalation source high: The Identity and Access Management (IAM) service manages authorization and authentication for a GCP environment. This means that there are very likely multiple privilege escalation methods that use the IAM service and/or its permissions.T1548

Show 1 more (4 total) on the rules page

google.iam.IAMPolicy.GetIamPolicy: GetIamPolicy

#
ServiceName
iam.googleapis.com

Data Access audit logs are disabled by default.

google.iam.IAMPolicy.SetIamPolicy: Set IAM policy (IAMPolicy service)

#
ServiceName
iam.googleapis.com

Description

Sets the access control policy on the specified resource. Replaces any existing policy. This method is used by BigQuery, Pub/Sub, and other services that delegate IAM to the shared IAMPolicy service.

Example Audit Log Entry #

{
  "insertId": "1ac9znsd2fjr",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "pubsub.topics.setIamPolicy",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/topics/dwtop-dw743447",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.iam.v1.IAMPolicy.SetIamPolicy",
    "request": {
      "@type": "type.googleapis.com/google.iam.v1.SetIamPolicyRequest",
      "policy": {},
      "resource": "projects/example-project-id/topics/dwtop-dw743447"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.pubsub.topics.set-iam-policy invocation-id/9b23cc3d298249d09194d68167c02c7a environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:33:54.956149119Z"
      }
    },
    "resourceName": "projects/example-project-id/topics/dwtop-dw743447",
    "response": {
      "@type": "type.googleapis.com/google.iam.v1.Policy",
      "etag": "BwZVZVkZ/QY="
    },
    "serviceName": "pubsub.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T14:33:55.950710192Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id",
      "topic_id": "projects/example-project-id/topics/dwtop-dw743447"
    },
    "type": "pubsub_topic"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T14:33:54.949548550Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
action (kusto rule field)eqadd1 rulekusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

YARA-L #

google.iam.IAMPolicy.TestIamPermissions: TestIamPermissions

#
ServiceName
iam.googleapis.com

Data Access audit logs are disabled by default.

google.iam.Policies.CreatePolicy: Create IAM policy

#
ServiceName
iam.googleapis.com

Description

Creates a policy.

google.iam.Policies.DeletePolicy: Delete IAM policy

#
ServiceName
iam.googleapis.com

Description

Deletes a policy.

google.iam.Policies.GetPolicy: GetPolicy

#
ServiceName
iam.googleapis.com

Data Access audit logs are disabled by default.

google.iam.Policies.ListPolicies: ListPolicies

#
ServiceName
iam.googleapis.com

Data Access audit logs are disabled by default.

google.iam.Policies.UpdatePolicy: Update IAM policy

#
ServiceName
iam.googleapis.com

Description

Updates the specified policy.

google.iam.WorkloadIdentityPools.DeleteWorkloadIdentityPool: Delete workload identity pool

#
ServiceName
iam.googleapis.com

Description

Deletes a WorkloadIdentityPool. You cannot use a deleted pool to exchange external credentials for Google credentials.

Example Audit Log Entry #

{
  "insertId": "-oo5rv0d2low",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "operation": {
    "id": "projects/000000000000/locations/global/workloadIdentityPools/dwwip7201353/operations/bigary5yrljamehivw44oai000000000",
    "last": true,
    "producer": "iam.googleapis.com"
  },
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "methodName": "google.iam.v1.WorkloadIdentityPools.DeleteWorkloadIdentityPool",
    "requestMetadata": {
      "destinationAttributes": {},
      "requestAttributes": {}
    },
    "resourceName": "projects/example-project-id/locations/global/workloadIdentityPools/dwwip7201353",
    "response": {
      "@type": "type.googleapis.com/google.longrunning.Operation",
      "name": "projects/000000000000/locations/global/workloadIdentityPools/dwwip7201353/operations/bigary5yrljamehivw44oai000000000"
    },
    "serviceName": "iam.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:25:07.816715243Z",
  "resource": {
    "labels": {
      "method": "google.iam.v1.WorkloadIdentityPools.DeleteWorkloadIdentityPool",
      "project_id": "example-project-id",
      "service": "iam.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:25:07.419190Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

google.iam.WorkloadIdentityPools.UpdateWorkloadIdentityPool: Update workload identity pool

#
ServiceName
iam.googleapis.com

Description

Updates an existing WorkloadIdentityPool.

Example Audit Log Entry #

{
  "insertId": "1bgmgozdaq99",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "operation": {
    "first": true,
    "id": "projects/000000000000/locations/global/workloadIdentityPools/dwwip7201353/operations/bigaryvyrljamegixg7isai000000000",
    "producer": "iam.googleapis.com"
  },
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.workloadIdentityPools.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/global/workloadIdentityPools/dwwip7201353",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.iam.v1.WorkloadIdentityPools.UpdateWorkloadIdentityPool",
    "request": {
      "@type": "type.googleapis.com/google.iam.v1.UpdateWorkloadIdentityPoolRequest",
      "updateMask": "description",
      "workloadIdentityPool": {
        "description": "dw updated",
        "disabled": false,
        "name": "projects/example-project-id/locations/global/workloadIdentityPools/dwwip7201353"
      }
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.iam.workload-identity-pools.update invocation-id/3c7c516efb8c41f9a4af038ec80afed0 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:25:06.137469625Z"
      }
    },
    "resourceName": "projects/example-project-id/locations/global/workloadIdentityPools/dwwip7201353",
    "serviceName": "iam.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:25:07.099339820Z",
  "resource": {
    "labels": {
      "method": "google.iam.v1.WorkloadIdentityPools.UpdateWorkloadIdentityPool",
      "project_id": "example-project-id",
      "service": "iam.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:25:06.119456010Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

google.iam.admin.CreateRole: Create role

#
ServiceName
iam.googleapis.com

Description

Creates a new custom Role.

Example Audit Log Entry #

{
  "insertId": "4rbuvve26rwp",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.roles.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.iam.admin.v1.CreateRole",
    "request": {
      "@type": "type.googleapis.com/google.iam.admin.v1.CreateRoleRequest",
      "parent": "projects/example-project-id",
      "role": {
        "included_permissions": [
          "resourcemanager.projects.get"
        ],
        "title": "dwgen dw739065"
      },
      "role_id": "dwgen_dw739065"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.iam.roles.create invocation-id/e2ecde64baf440bab65297ccb878a6ac environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:19:22.555442954Z"
      }
    },
    "resourceName": "projects/example-project-id/roles/dwgen_dw739065",
    "response": {
      "@type": "type.googleapis.com/google.iam.admin.v1.Role",
      "etag": "BwZVZE6Gsic=",
      "group_name": "custom",
      "group_title": "Custom",
      "included_permissions": [
        "resourcemanager.projects.get"
      ],
      "name": "projects/example-project-id/roles/dwgen_dw739065",
      "title": "dwgen dw739065"
    },
    "serviceData": {
      "@type": "type.googleapis.com/google.iam.admin.v1.AuditData",
      "permissionDelta": {
        "addedPermissions": [
          "resourcemanager.projects.get"
        ]
      }
    },
    "serviceName": "iam.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:19:24.360292093Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id",
      "role_name": "projects/example-project-id/roles/dwgen_dw739065"
    },
    "type": "iam_role"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T13:19:22.540868323Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • GCP IAM Custom Role Creation source high: Identifies an Identity and Access Management (IAM) custom role creation in Google Cloud Platform (GCP). Custom roles are user-defined, and allow for the bundling of one or more supported permissions to meet specific needs. Custom roles will not be updated automatically and could lead to privilege creep if not carefully scrutinized.T1078, T1098, T1098.003

Panther #

google.iam.admin.CreateServiceAccount: Create service account

#
ServiceName
iam.googleapis.com

Description

Creates a ServiceAccount.

Example Audit Log Entry #

{
  "insertId": "9gnal8egdtq8",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {},
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.serviceAccounts.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id",
        "resourceAttributes": {
          "type": "iam.googleapis.com/ServiceAccount"
        }
      }
    ],
    "methodName": "google.iam.admin.v1.CreateServiceAccount",
    "request": {
      "@type": "type.googleapis.com/google.iam.admin.v1.CreateServiceAccountRequest",
      "account_id": "service-000000000000",
      "name": "projects/example-project-id",
      "service_account": {
        "display_name": "Compute Engine default service account",
        "email": "000000000000-compute@developer.gserviceaccount.com"
      }
    },
    "requestMetadata": {
      "callerIp": "private",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:13:48.561353162Z"
      }
    },
    "resourceName": "projects/example-project-id",
    "response": {
      "@type": "type.googleapis.com/google.iam.admin.v1.ServiceAccount",
      "display_name": "Compute Engine default service account",
      "email": "000000000000-compute@developer.gserviceaccount.com",
      "etag": "MDEwMjE5MjA=",
      "name": "projects/example-project-id/serviceAccounts/000000000000-compute@developer.gserviceaccount.com",
      "oauth2_client_id": "112075482887738148378",
      "project_id": "example-project-id",
      "unique_id": "112075482887738148378"
    },
    "serviceName": "iam.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:13:50.169675550Z",
  "resource": {
    "labels": {
      "email_id": "000000000000-compute@developer.gserviceaccount.com",
      "project_id": "example-project-id",
      "unique_id": "112075482887738148378"
    },
    "type": "service_account"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T13:13:48.545275240Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
result (kusto rule field)eqtrue1 rulekusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • GCP Service Account Creation source low: Identifies when a new service account is created in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. If service accounts are not tracked and managed properly, they can present a security risk. An adversary may create a new service account to use during their operations in order to avoid using a standard user account and attempt to evade detection.T1136, T1136.003

Kusto #

Panther #

References #

google.iam.admin.CreateServiceAccountKey: Create service account key

#
ServiceName
iam.googleapis.com

Description

Creates a ServiceAccountKey.

Example Audit Log Entry #

{
  "insertId": "1q6uzggf1i5fxv",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.serviceAccountKeys.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/-/serviceAccounts/100186808964833041985",
        "resourceAttributes": {
          "name": "projects/-/serviceAccounts/100186808964833041985",
          "type": "iam.googleapis.com/ServiceAccountKey"
        }
      }
    ],
    "methodName": "google.iam.admin.v1.CreateServiceAccountKey",
    "request": {
      "@type": "type.googleapis.com/google.iam.admin.v1.CreateServiceAccountKeyRequest",
      "name": "projects/-/serviceAccounts/dwgen-dw739065@example-project-id.iam.gserviceaccount.com",
      "private_key_type": 2
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.iam.service-accounts.keys.create invocation-id/37a85d47a1734a80a1dc6aee233e082a environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:19:12.434817344Z"
      }
    },
    "resourceName": "projects/-/serviceAccounts/100186808964833041985",
    "response": {
      "@type": "type.googleapis.com/google.iam.admin.v1.ServiceAccountKey"
    },
    "serviceName": "iam.googleapis.com",
    "status": {
      "code": 9,
      "details": [
        {
          "@type": "type.googleapis.com/google.rpc.PreconditionFailure",
          "violations": [
            {
              "description": "Key creation is not allowed on this service account.",
              "subject": "projects/example-project-id/serviceAccounts/dwgen-dw739065@example-project-id.iam.gserviceaccount.com?configvalue=dwgen-dw739065%40example-project-id.iam.gserviceaccount.com",
              "type": "constraints/iam.disableServiceAccountKeyCreation"
            }
          ]
        }
      ],
      "message": "Key creation is not allowed on this service account."
    }
  },
  "receiveTimestamp": "2026-06-29T13:19:14.025493057Z",
  "resource": {
    "labels": {
      "email_id": "dwgen-dw739065@example-project-id.iam.gserviceaccount.com",
      "project_id": "example-project-id",
      "unique_id": "100186808964833041985"
    },
    "type": "service_account"
  },
  "severity": "ERROR",
  "timestamp": "2026-06-29T13:19:12.409399716Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
result (kusto rule field)eqtrue1 rulekusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • GCP Service Account Key Creation source high: Identifies when a new key is created for a service account in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. If private keys are not tracked and managed properly, they can present a security risk. An adversary may create a new key for a service account in order to attempt to abuse the permissions assigned to that account and evade detection.T1098, T1098.001

Kusto #

YARA-L #

Panther #

References #

google.iam.admin.DeleteRole: Delete role

#
ServiceName
iam.googleapis.com

Description

Deletes a Role and all associated bindings.

Example Audit Log Entry #

{
  "insertId": "x0sbape18l0d",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.roles.delete",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/roles/dwrole7201353",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.iam.admin.v1.DeleteRole",
    "request": {
      "@type": "type.googleapis.com/google.iam.admin.v1.DeleteRoleRequest",
      "name": "projects/example-project-id/roles/dwrole7201353"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.iam.roles.delete invocation-id/b712774380da48bf96a58780cc0b3137 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/False python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:33:50.125139817Z"
      }
    },
    "resourceName": "projects/example-project-id/roles/dwrole7201353",
    "response": {
      "@type": "type.googleapis.com/google.iam.admin.v1.Role",
      "deleted": true,
      "etag": "BwZVZwX2sNA=",
      "group_name": "custom",
      "group_title": "Custom",
      "included_permissions": [
        "storage.buckets.get",
        "storage.buckets.list"
      ],
      "name": "projects/example-project-id/roles/dwrole7201353",
      "title": "dw7"
    },
    "serviceName": "iam.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:33:51.477752543Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id",
      "role_name": "projects/example-project-id/roles/dwrole7201353"
    },
    "type": "iam_role"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:33:50.115949175Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • GCP IAM Role Deletion source low: Identifies an Identity and Access Management (IAM) role deletion in Google Cloud Platform (GCP). A role contains a set of permissions that allows you to perform specific actions on Google Cloud resources. An adversary may delete an IAM role to inhibit access to accounts utilized by legitimate users.T1531

Panther #

google.iam.admin.DeleteServiceAccount: Delete service account

#
ServiceName
iam.googleapis.com

Description

Deletes a ServiceAccount.

Example Audit Log Entry #

{
  "insertId": "qnhh7wers7qb",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.serviceAccounts.delete",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/-/serviceAccounts/100975526755455867681",
        "resourceAttributes": {
          "name": "projects/-/serviceAccounts/100975526755455867681"
        }
      }
    ],
    "methodName": "google.iam.admin.v1.DeleteServiceAccount",
    "request": {
      "@type": "type.googleapis.com/google.iam.admin.v1.DeleteServiceAccountRequest",
      "name": "projects/-/serviceAccounts/dwc5-dw746783@example-project-id.iam.gserviceaccount.com"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.iam.service-accounts.delete invocation-id/08afef47b74e45b0a9c0afb311634952 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/False python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T15:32:05.696412799Z"
      }
    },
    "resourceName": "projects/-/serviceAccounts/100975526755455867681",
    "serviceName": "iam.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T15:32:07.428160625Z",
  "resource": {
    "labels": {
      "email_id": "dwc5-dw746783@example-project-id.iam.gserviceaccount.com",
      "project_id": "example-project-id",
      "unique_id": "100975526755455867681"
    },
    "type": "service_account"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T15:32:05.676157884Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • GCP Service Account Deletion source medium: Identifies when a service account is deleted in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. An adversary may delete a service account in order to disrupt their target's business operations.T1531

google.iam.admin.DeleteServiceAccountKey: Delete service account key

#
ServiceName
iam.googleapis.com

Description

Deletes a ServiceAccountKey.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • GCP IAM Service Account Key Deletion source low: Identifies the deletion of an Identity and Access Management (IAM) service account key in Google Cloud Platform (GCP). Each service account is associated with two sets of public/private RSA key pairs that are used to authenticate. If a key is deleted, the application will no longer be able to access Google Cloud resources using that key. A security best practice is to rotate your service account keys regularly.T1098, T1531

google.iam.admin.DisableServiceAccount: DisableServiceAccount

#
ServiceName
iam.googleapis.com

Example Audit Log Entry #

{
  "insertId": "qxhyjmecj7si",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.serviceAccounts.disable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/-/serviceAccounts/102924341947093257992",
        "resourceAttributes": {
          "name": "projects/-/serviceAccounts/102924341947093257992"
        }
      }
    ],
    "methodName": "google.iam.admin.v1.DisableServiceAccount",
    "request": {
      "@type": "type.googleapis.com/google.iam.admin.v1.DisableServiceAccountRequest",
      "name": "projects/example-project-id/serviceAccounts/dwsa7201353@example-project-id.iam.gserviceaccount.com"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.iam.service-accounts.disable invocation-id/ebe03daf71034fb5a091ca5959d1ae8e environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:25:02.401449948Z"
      }
    },
    "resourceName": "projects/-/serviceAccounts/102924341947093257992",
    "response": {
      "@type": "type.googleapis.com/google.protobuf.Empty"
    },
    "serviceName": "iam.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:25:02.789898845Z",
  "resource": {
    "labels": {
      "email_id": "dwsa7201353@example-project-id.iam.gserviceaccount.com",
      "project_id": "example-project-id",
      "unique_id": "102924341947093257992"
    },
    "type": "service_account"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:25:02.388198908Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • GCP Service Account Disabled source medium: Identifies when a service account is disabled in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. An adversary may disable a service account in order to disrupt to disrupt their target's business operations.T1531

google.iam.admin.DisableServiceAccountKey: DisableServiceAccountKey

#
ServiceName
iam.googleapis.com

google.iam.admin.EnableServiceAccount: EnableServiceAccount

#
ServiceName
iam.googleapis.com

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

google.iam.admin.EnableServiceAccountKey: EnableServiceAccountKey

#
ServiceName
iam.googleapis.com

google.iam.admin.GetIamPolicy: GetIamPolicy

#
ServiceName
iam.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "qxhyjmebcewf",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.serviceAccounts.getIamPolicy",
        "permissionType": "ADMIN_READ",
        "resource": "projects/-/serviceAccounts/100186808964833041985",
        "resourceAttributes": {
          "name": "projects/-/serviceAccounts/100186808964833041985"
        }
      }
    ],
    "methodName": "google.iam.admin.v1.GetIAMPolicy",
    "request": {
      "@type": "type.googleapis.com/google.iam.v1.GetIamPolicyRequest",
      "options": {
        "requested_policy_version": 3
      },
      "resource": "projects/example-project-id/serviceAccounts/dwgen-dw739065@example-project-id.iam.gserviceaccount.com"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.iam.service-accounts.add-iam-policy-binding invocation-id/d53e1c445d9c49b7a1de019720cb01f6 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:19:25.527417042Z"
      }
    },
    "resourceName": "projects/-/serviceAccounts/100186808964833041985",
    "serviceName": "iam.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:19:26.693406674Z",
  "resource": {
    "labels": {
      "email_id": "dwgen-dw739065@example-project-id.iam.gserviceaccount.com",
      "project_id": "example-project-id",
      "unique_id": "100186808964833041985"
    },
    "type": "service_account"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:19:25.505657643Z"
}

google.iam.admin.GetRole: GetRole

#
ServiceName
iam.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "1q5ooj0e227kc",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.roles.get",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id/roles/dwgen_dw739065",
        "resourceAttributes": {
          "name": "projects/example-project-id/roles/dwgen_dw739065",
          "service": "iam",
          "type": "iam.roles"
        }
      }
    ],
    "methodName": "google.iam.admin.v1.GetRole",
    "request": {
      "@type": "type.googleapis.com/google.iam.admin.v1.GetRoleRequest",
      "name": "projects/example-project-id/roles/dwgen_dw739065"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.iam.roles.describe invocation-id/f2be8c6f6b7e45b9a3828dc77e5d2599 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:19:23.856369590Z"
      }
    },
    "resourceName": "projects/example-project-id/roles/dwgen_dw739065",
    "serviceName": "iam.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:19:25.377868598Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id",
      "role_name": "projects/example-project-id/roles/dwgen_dw739065"
    },
    "type": "iam_role"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:19:23.842018568Z"
}

google.iam.admin.GetServiceAccount: GetServiceAccount

#
ServiceName
iam.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "yq6t57f1sby7s",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.serviceAccounts.get",
        "permissionType": "ADMIN_READ",
        "resource": "projects/-/serviceAccounts/100186808964833041985",
        "resourceAttributes": {
          "name": "projects/-/serviceAccounts/100186808964833041985"
        }
      }
    ],
    "methodName": "google.iam.admin.v1.GetServiceAccount",
    "request": {
      "@type": "type.googleapis.com/google.iam.admin.v1.GetServiceAccountRequest",
      "name": "projects/-/serviceAccounts/dwgen-dw739065@example-project-id.iam.gserviceaccount.com"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.iam.service-accounts.describe invocation-id/842922657a504708ab779aca6efb37a3 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:19:11.521348350Z"
      }
    },
    "resourceName": "projects/-/serviceAccounts/100186808964833041985",
    "serviceName": "iam.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:19:12.323048629Z",
  "resource": {
    "labels": {
      "email_id": "dwgen-dw739065@example-project-id.iam.gserviceaccount.com",
      "project_id": "example-project-id",
      "unique_id": "100186808964833041985"
    },
    "type": "service_account"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:19:11.497434481Z"
}

google.iam.admin.GetServiceAccountKey: GetServiceAccountKey

#
ServiceName
iam.googleapis.com

Data Access audit logs are disabled by default.

google.iam.admin.LintPolicy: LintPolicy

#
ServiceName
iam.googleapis.com

google.iam.admin.ListRoles: ListRoles

#
ServiceName
iam.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "1fc7y2de1uiio",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.roles.list",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.iam.admin.v1.ListRoles",
    "request": {
      "@type": "type.googleapis.com/google.iam.admin.v1.ListRolesRequest",
      "page_size": 3,
      "parent": "projects/example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.iam.roles.list invocation-id/27dfa9385ca34cb4bc14ea48f95bff3e environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:24:53.940174594Z"
      }
    },
    "resourceName": "projects/example-project-id",
    "serviceName": "iam.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:24:54.466638229Z",
  "resource": {
    "labels": {
      "location": "global",
      "method": "google.iam.admin.v1.ListRoles",
      "project_id": "example-project-id",
      "service": "iam.googleapis.com",
      "version": "v1"
    },
    "type": "api"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T16:24:53.921021625Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
count_ (kusto rule field)gt51 rulekusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

google.iam.admin.ListServiceAccountKeys: ListServiceAccountKeys

#
ServiceName
iam.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "qxhyjmecj7ni",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.serviceAccountKeys.list",
        "permissionType": "ADMIN_READ",
        "resource": "projects/-/serviceAccounts/102924341947093257992",
        "resourceAttributes": {
          "name": "projects/-/serviceAccounts/102924341947093257992"
        }
      }
    ],
    "methodName": "google.iam.admin.v1.ListServiceAccountKeys",
    "request": {
      "@type": "type.googleapis.com/google.iam.admin.v1.ListServiceAccountKeysRequest",
      "name": "projects/-/serviceAccounts/dwsa7201353@example-project-id.iam.gserviceaccount.com"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.iam.service-accounts.keys.list invocation-id/c17d9060a3f446d39d9f6598e50c0b04 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:25:01.436588816Z"
      }
    },
    "resourceName": "projects/-/serviceAccounts/102924341947093257992",
    "response": {
      "@type": "type.googleapis.com/google.iam.admin.v1.ListServiceAccountKeysResponse"
    },
    "serviceName": "iam.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:25:01.655105108Z",
  "resource": {
    "labels": {
      "email_id": "dwsa7201353@example-project-id.iam.gserviceaccount.com",
      "project_id": "example-project-id",
      "unique_id": "102924341947093257992"
    },
    "type": "service_account"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T16:25:01.416742617Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
count_ (kusto rule field)gt51 rulekusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

google.iam.admin.ListServiceAccounts: ListServiceAccounts

#
ServiceName
iam.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "vxw4vwf1cdg9f",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.serviceAccounts.list",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.iam.admin.v1.ListServiceAccounts",
    "request": {
      "@type": "type.googleapis.com/google.iam.admin.v1.ListServiceAccountsRequest",
      "name": "projects/example-project-id",
      "page_size": 100
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.iam.service-accounts.list invocation-id/6ef3c7390b3f4303958d9dced8335ead environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:17:52.063590821Z"
      }
    },
    "resourceName": "projects/example-project-id",
    "serviceName": "iam.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:17:52.667847717Z",
  "resource": {
    "labels": {
      "location": "global",
      "method": "google.iam.admin.v1.ListServiceAccounts",
      "project_id": "example-project-id",
      "service": "iam.googleapis.com",
      "version": "v1"
    },
    "type": "api"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:17:52.049443232Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
count_ (kusto rule field)gt51 rulekusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

google.iam.admin.PatchServiceAccount: PatchServiceAccount

#
ServiceName
iam.googleapis.com

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

google.iam.admin.QueryAuditableServices: QueryAuditableServices

#
ServiceName
iam.googleapis.com

Data Access audit logs are disabled by default.

google.iam.admin.QueryGrantableRoles: QueryGrantableRoles

#
ServiceName
iam.googleapis.com

Data Access audit logs are disabled by default.

google.iam.admin.QueryTestablePermissions: QueryTestablePermissions

#
ServiceName
iam.googleapis.com

Data Access audit logs are disabled by default.

google.iam.admin.SetIamPolicy: SetIamPolicy

#
ServiceName
iam.googleapis.com

Example Audit Log Entry #

{
  "insertId": "yq6t57f1sc35i",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.serviceAccounts.setIamPolicy",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/-/serviceAccounts/100186808964833041985",
        "resourceAttributes": {
          "name": "projects/-/serviceAccounts/100186808964833041985"
        }
      }
    ],
    "methodName": "google.iam.admin.v1.SetIAMPolicy",
    "request": {
      "@type": "type.googleapis.com/google.iam.v1.SetIamPolicyRequest",
      "policy": {
        "bindings": [
          {
            "members": [
              "user:user@example.com"
            ],
            "role": "roles/iam.serviceAccountTokenCreator"
          }
        ],
        "etag": "ACAB",
        "version": 3
      },
      "resource": "projects/example-project-id/serviceAccounts/dwgen-dw739065@example-project-id.iam.gserviceaccount.com"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.iam.service-accounts.add-iam-policy-binding invocation-id/d53e1c445d9c49b7a1de019720cb01f6 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:19:25.990775801Z"
      }
    },
    "resourceName": "projects/-/serviceAccounts/100186808964833041985",
    "response": {
      "@type": "type.googleapis.com/google.iam.v1.Policy",
      "bindings": [
        {
          "members": [
            "user:user@example.com"
          ],
          "role": "roles/iam.serviceAccountTokenCreator"
        }
      ],
      "etag": "BwZVZE63ObA=",
      "version": 1
    },
    "serviceData": {
      "@type": "type.googleapis.com/google.iam.v1.logging.AuditData",
      "policyDelta": {
        "bindingDeltas": [
          {
            "action": "ADD",
            "member": "user:user@example.com",
            "role": "roles/iam.serviceAccountTokenCreator"
          }
        ]
      }
    },
    "serviceName": "iam.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:19:26.592764265Z",
  "resource": {
    "labels": {
      "email_id": "dwgen-dw739065@example-project-id.iam.gserviceaccount.com",
      "project_id": "example-project-id",
      "unique_id": "100186808964833041985"
    },
    "type": "service_account"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T13:19:25.807060172Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • GCP IAM Service Account Impersonation Role Granted source medium: Identifies when a service account impersonation role is granted on a Google Cloud Platform (GCP) service account via a SetIamPolicy operation. Roles such as "roles/iam.serviceAccountTokenCreator", "roles/iam.serviceAccountUser", and "roles/iam.serviceAccountOpenIdTokenCreator" allow a principal to mint access or identity tokens for the target service account, or to act as it when deploying resources. Adversaries who have obtained sufficient privileges may grant themselves or an attacker-controlled principal one of these roles to impersonate a higher-privileged service account, escalating privileges and establishing durable, key-less persistence that survives credential rotation. This is a New Terms rule that alerts when the granting principal has not been observed performing this action in the last weeks.T1098, T1098.003

google.iam.admin.SignBlob: SignBlob

#
ServiceName
iam.googleapis.com

google.iam.admin.SignJwt: SignJwt

#
ServiceName
iam.googleapis.com

google.iam.admin.TestIamPermissions: TestIamPermissions

#
ServiceName
iam.googleapis.com

Data Access audit logs are disabled by default.

google.iam.admin.UndeleteRole: UndeleteRole

#
ServiceName
iam.googleapis.com

google.iam.admin.UndeleteServiceAccount: UndeleteServiceAccount

#
ServiceName
iam.googleapis.com

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

google.iam.admin.UpdateRole: Update role

#
ServiceName
iam.googleapis.com

Description

Updates a Role definition.

Example Audit Log Entry #

{
  "insertId": "1g5zr40dpjz8",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.roles.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/roles/dwrole7201353",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.iam.admin.v1.UpdateRole",
    "request": {
      "@type": "type.googleapis.com/google.iam.admin.v1.UpdateRoleRequest",
      "name": "projects/example-project-id/roles/dwrole7201353",
      "role": {
        "etag": "BwZVZuVV2Ls=",
        "included_permissions": [
          "storage.buckets.get",
          "storage.buckets.list"
        ]
      },
      "update_mask": {
        "paths": [
          "included_permissions"
        ]
      }
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.iam.roles.update invocation-id/e290e75f3a2547b4a88072a2ed2618c8 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:24:52.826707321Z"
      }
    },
    "resourceName": "projects/example-project-id/roles/dwrole7201353",
    "response": {
      "@type": "type.googleapis.com/google.iam.admin.v1.Role",
      "etag": "BwZVZuXwuwQ=",
      "group_name": "custom",
      "group_title": "Custom",
      "included_permissions": [
        "storage.buckets.get",
        "storage.buckets.list"
      ],
      "name": "projects/example-project-id/roles/dwrole7201353",
      "title": "dw7"
    },
    "serviceData": {
      "@type": "type.googleapis.com/google.iam.admin.v1.AuditData",
      "permissionDelta": {
        "addedPermissions": [
          "storage.buckets.list"
        ]
      }
    },
    "serviceName": "iam.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:24:54.370807526Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id",
      "role_name": "projects/example-project-id/roles/dwrole7201353"
    },
    "type": "iam_role"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:24:52.801344016Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

google.iam.admin.UpdateServiceAccount: Update service account

#
ServiceName
iam.googleapis.com

Description

Patches a ServiceAccount.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

google.iam.admin.UploadServiceAccountKey: Upload service account key

#
ServiceName
iam.googleapis.com

Description

Creates a ServiceAccountKey, obtained from an existing key pair or Google-generated key pair.

Example Audit Log Entry #

{
  "insertId": "vxw4vwf1d26h8",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.serviceAccountKeys.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/-/serviceAccounts/102924341947093257992",
        "resourceAttributes": {
          "name": "projects/-/serviceAccounts/102924341947093257992",
          "type": "iam.googleapis.com/ServiceAccountKey"
        }
      }
    ],
    "methodName": "google.iam.admin.v1.UploadServiceAccountKey",
    "request": {
      "@type": "type.googleapis.com/google.iam.admin.v1.UploadServiceAccountKeyRequest",
      "name": "projects/example-project-id/serviceAccounts/dwsa7201353@example-project-id.iam.gserviceaccount.com",
      "publicKeyData": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMrekNDQWVPZ0F3SUJBZ0lVQ0NLRUFXY2N0akNreVF5cm4zdndDcSszOHBjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0RURUxNQWtHQTFVRUF3d0NaSGN3SGhjTk1qWXdOakk1TVRZeU5UQXpXaGNOTWpZd05qTXdNVFl5TlRBegpXakFOTVFzd0NRWURWUVFEREFKa2R6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCCkFLVDlNUVNveW9kRGY5anBwSFlXcWNVTFYvTkdBMGNzMHk2TUVEMXgrSkd1K0ZubjJoSFlGNVZBdk9RM3hFYmEKN2NmNEsrN0d0eWMwcGhjeHg5UHF1UjBldUZHTm5RVHhLcU5WZXhSTXVibDdpRm5YU3kxekJIUDdOZVlwNWdWTwpSYXZJemFqYUVrYkVURmx2Y3ZwU1hCN2Zhb1dqd3g1Rmx3ZFFpZXBieVloQzhSemlLT0pSeGJIcjFLeWVxTjE4Cjl3Q0FhM3VMTWRpUFNaTVlXazl6N2FPbkdsSytzRGNLQnlQZUxscVQxZm1RL0FkaXZDZTJGSEN2eHdmYWFscFEKUnprT3lkSHUzVGRBTzV6WEFlMGFCNnFxQ0UvdmJMeDdLTjBiM1N4KzFuSnlzRVFzK0pkWGVpcDdleDVCRlNDawpJdVJXQUE2aEJ4U2FzZ3BVQ25MMWMxa0NBd0VBQWFOVE1GRXdIUVlEVlIwT0JCWUVGQVF3Tm1jWlVSMnhHSmRCCkpndW5NT1R1TnNVN01COEdBMVVkSXdRWU1CYUFGQVF3Tm1jWlVSMnhHSmRCSmd1bk1PVHVOc1U3TUE4R0ExVWQKRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFBejBsQUFsVVFRbmhKMFB0KzI2M2o4Ugo2R1M3ampIUGNsTklpbjl3K2dYQTJCTkhqNTJWbGpWTkNCenk5b25JSXFNTTR2MGlhRERuUUNERHhOdmQwQzltCnFPTkZINHVJU1JWWVFhMmxTMnpZYXovU1V4OUd4OWNJUGpnVXFJU2JueHhiU2pBVWRTRE5KSWtyY0tXVnBzOWwKcHRYL2lEUitqeG5aUzlUaW9zZGlvQ3grL2FUejJjYlBvWkdDeG04MnE1Qi9SUlJPWW5kZFk1emg4cTVSNU13WgpjUEJ6ZXJtTTNIWEgrTE0vWWl3STM5bm9ocXp4YUdmUnEwdXdiOWk2R2tCVnlqYmVCQlVrVkVUQXdUWW1kQmU0CkViL21CMkFoVnBsUFBIQkd2WTVZTVBuc09aUG5ad1NpUHgvTmNjNHBwK2J4UTFlbU1NSUdBVFRWdW50ZUxhcz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ=="
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.iam.service-accounts.keys.upload invocation-id/9d3d72e8839c404babcc83efc588a38e environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/False python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:25:03.809387901Z"
      }
    },
    "resourceName": "projects/-/serviceAccounts/102924341947093257992",
    "response": {
      "@type": "type.googleapis.com/google.iam.admin.v1.ServiceAccountKey"
    },
    "serviceName": "iam.googleapis.com",
    "status": {
      "code": 9,
      "details": [
        {
          "@type": "type.googleapis.com/google.rpc.PreconditionFailure",
          "violations": [
            {
              "description": "Constraint `constraints/iam.disableServiceAccountKeyUpload` violated for service account projects/example-project-id/serviceAccounts/dwsa7201353@example-project-id.iam.gserviceaccount.com attempting to upload public key.",
              "subject": "projects/example-project-id/serviceAccounts/dwsa7201353@example-project-id.iam.gserviceaccount.com?configvalue=dwsa7201353%40example-project-id.iam.gserviceaccount.com",
              "type": "constraints/iam.disableServiceAccountKeyUpload"
            }
          ]
        }
      ],
      "message": "Constraint `constraints/iam.disableServiceAccountKeyUpload` violated for service account projects/example-project-id/serviceAccounts/dwsa7201353@example-project-id.iam.gserviceaccount.com attempting to upload public key."
    }
  },
  "receiveTimestamp": "2026-06-29T16:25:04.158255063Z",
  "resource": {
    "labels": {
      "email_id": "dwsa7201353@example-project-id.iam.gserviceaccount.com",
      "project_id": "example-project-id",
      "unique_id": "102924341947093257992"
    },
    "type": "service_account"
  },
  "severity": "ERROR",
  "timestamp": "2026-06-29T16:25:03.767917476Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

google.iam.admin.WorkforcePools.CreateWorkforcePool: CreateWorkforcePool

#
ServiceName
iam.googleapis.com

Description

Creates a workforce identity pool.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

google.iam.admin.WorkforcePools.UpdateWorkforcePool: UpdateWorkforcePool

#
ServiceName
iam.googleapis.com

Description

Updates a workforce identity pool.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

google.iam.WorkloadIdentityPools.CreateWorkloadIdentityPoolProvider: CreateWorkloadIdentityPoolProvider

#
ServiceName
iam.googleapis.com

Description

Creates a workload identity pool provider.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

google.iam.WorkloadIdentityPools.ListWorkloadIdentityPools: ListWorkloadIdentityPools

#
ServiceName
iam.googleapis.com

Description

List workload identity pools.

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "rryb4rdpwgi",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.workloadIdentityPools.list",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id/locations/global",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.iam.v1.WorkloadIdentityPools.ListWorkloadIdentityPools",
    "request": {
      "@type": "type.googleapis.com/google.iam.v1.ListWorkloadIdentityPoolsRequest",
      "parent": "projects/example-project-id/locations/global",
      "showDeleted": false
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.iam.workload-identity-pools.list invocation-id/f4b8d3881e9a46f9bd3d518fc387395a environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T15:38:39.372426855Z"
      }
    },
    "resourceName": "projects/example-project-id/locations/global",
    "response": {
      "@type": "type.googleapis.com/google.iam.v1.ListWorkloadIdentityPoolsResponse"
    },
    "serviceName": "iam.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T15:38:40.331910663Z",
  "resource": {
    "labels": {
      "method": "google.iam.v1.WorkloadIdentityPools.ListWorkloadIdentityPools",
      "project_id": "example-project-id",
      "service": "iam.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T15:38:39.359577326Z"
}

iam.serviceAccounts.actAs: serviceAccounts.actAs

#
ServiceName
iam.googleapis.com

Description

Authorization to impersonate (actAs) a service account.

Example Audit Log Entry #

{
  "insertId": "r8i4aoexq69u",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "principalEmail": "user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "iam.serviceAccounts.actAs",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/-/serviceAccounts/000000000000-compute@developer.gserviceaccount.com"
      }
    ],
    "methodName": "iam.serviceAccounts.actAs",
    "request": {
      "@type": "type.googleapis.com/CanActAsServiceAccountRequest",
      "name": "000000000000-compute@developer.gserviceaccount.com",
      "project_number": "000000000000"
    },
    "resourceName": "projects/-/serviceAccounts/000000000000-compute@developer.gserviceaccount.com",
    "response": {
      "@type": "type.googleapis.com/CanActAsServiceAccountResponse",
      "success": true
    },
    "serviceName": "iam.googleapis.com"
  },
  "receiveTimestamp": "2026-06-29T13:21:01.009636567Z",
  "resource": {
    "labels": {
      "method": "iam.serviceAccounts.actAs",
      "project_id": "example-project-id",
      "service": "iam.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T13:21:01.009636567Z"
}

google.iam.WorkloadIdentityPools.UpdateWorkloadIdentityPoolProvider: UpdateWorkloadIdentityPoolProvider

#
ServiceName
iam.googleapis.com

Description

Updates a workload identity pool provider.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #