Detection rules › By event

GCP-iam.googleapis.com

Event	Rules
any	4
google.iam.IAMPolicy.SetIamPolicy	2
google.iam.WorkloadIdentityPools.DeleteWorkloadIdentityPool	1
google.iam.WorkloadIdentityPools.UpdateWorkloadIdentityPool	1
google.iam.admin.CreateRole	2
google.iam.admin.CreateServiceAccount	4
google.iam.admin.CreateServiceAccountKey	4
google.iam.admin.DeleteRole	2
google.iam.admin.DeleteServiceAccount	2
google.iam.admin.DeleteServiceAccountKey	1
google.iam.admin.DisableServiceAccount	2
google.iam.admin.EnableServiceAccount	1
google.iam.admin.ListRoles	1
google.iam.admin.ListServiceAccountKeys	1
google.iam.admin.ListServiceAccounts	1
google.iam.admin.PatchServiceAccount	1
google.iam.admin.SetIamPolicy	1
google.iam.admin.UndeleteServiceAccount	1
google.iam.admin.UpdateRole	1
google.iam.admin.UpdateServiceAccount	1
google.iam.admin.UploadServiceAccountKey	1
google.iam.admin.WorkforcePools.CreateWorkforcePool	1
google.iam.admin.WorkforcePools.UpdateWorkforcePool	1
google.iam.WorkloadIdentityPools.CreateWorkloadIdentityPoolProvider	1
google.iam.WorkloadIdentityPools.UpdateWorkloadIdentityPoolProvider	1

any

4 detection rules reference this event. View event page.

Panther (4)

GCP IAM serviceAccounts getAccessToken Privilege Escalation severity high T1548
GCP IAM serviceAccounts signBlob severity high T1548
GCP iam.roles.update Privilege Escalation severity high
GCP.Iam.ServiceAccountKeys.Create severity high T1548

google.iam.IAMPolicy.SetIamPolicy

2 detection rules reference this event. View event page.

Kusto (1)

GCP IAM - Publicly exposed storage bucket severity medium T1069

YARA-L (1)

GCP BigQuery Datasets Opened To Public severity high T1685

google.iam.WorkloadIdentityPools.DeleteWorkloadIdentityPool

1 detection rules reference this event. View event page.

YARA-L (1)

GCP Workload Identity Pool Disabled Or Deleted severity high T1078, T1078.004

google.iam.WorkloadIdentityPools.UpdateWorkloadIdentityPool

1 detection rules reference this event. View event page.

YARA-L (1)

GCP Workload Identity Pool Disabled Or Deleted severity high T1078, T1078.004

google.iam.admin.CreateRole

2 detection rules reference this event. View event page.

Elastic (1)

GCP IAM Custom Role Creation severity high T1078, T1098, T1098.003

Panther (1)

GCP IAM Role Has Changed severity informational T1078

google.iam.admin.CreateServiceAccount

4 detection rules reference this event. View event page.

Sigma (1)

Google Cloud Service Account Modified severity medium

Elastic (1)

GCP Service Account Creation severity low T1136, T1136.003

Kusto (1)

GCP IAM - New Service Account severity low T1136

Panther (1)

GCP Service Account or Keys Created severity low

google.iam.admin.CreateServiceAccountKey

4 detection rules reference this event. View event page.

Elastic (1)

GCP Service Account Key Creation severity high T1098, T1098.001

Kusto (1)

GCP IAM - New Service Account Key severity low T1550

YARA-L (1)

Google Cloud Service Account Key Created or Uploaded severity medium T1098, T1098.001

Panther (1)

GCP Service Account or Keys Created severity low

google.iam.admin.DeleteRole

2 detection rules reference this event. View event page.

Elastic (1)

GCP IAM Role Deletion severity low T1531

Panther (1)

GCP IAM Role Has Changed severity informational T1078

google.iam.admin.DeleteServiceAccount

2 detection rules reference this event. View event page.

Sigma (1)

Google Cloud Service Account Disabled or Deleted severity medium T1531

Elastic (1)

GCP Service Account Deletion severity medium T1531

google.iam.admin.DeleteServiceAccountKey

1 detection rules reference this event. View event page.

Elastic (1)

GCP IAM Service Account Key Deletion severity low T1098, T1531

google.iam.admin.DisableServiceAccount

2 detection rules reference this event. View event page.

Sigma (1)

Google Cloud Service Account Disabled or Deleted severity medium T1531

Elastic (1)

GCP Service Account Disabled severity medium T1531

google.iam.admin.EnableServiceAccount

1 detection rules reference this event. View event page.

Sigma (1)

Google Cloud Service Account Modified severity medium

google.iam.admin.ListRoles

1 detection rules reference this event. View event page.

Kusto (1)

GCP IAM - Privileges Enumeration severity low T1069

google.iam.admin.ListServiceAccountKeys

1 detection rules reference this event. View event page.

Kusto (1)

GCP IAM - Service Account Keys Enumeration severity low T1069

google.iam.admin.ListServiceAccounts

1 detection rules reference this event. View event page.

Kusto (1)

GCP IAM - Service Account Enumeration severity low T1087

google.iam.admin.PatchServiceAccount

1 detection rules reference this event. View event page.

Sigma (1)

Google Cloud Service Account Modified severity medium

google.iam.admin.SetIamPolicy

1 detection rules reference this event. View event page.

Elastic (1)

GCP IAM Service Account Impersonation Role Granted severity medium T1098, T1098.003

google.iam.admin.UndeleteServiceAccount

1 detection rules reference this event. View event page.

Sigma (1)

Google Cloud Service Account Modified severity medium

google.iam.admin.UpdateRole

1 detection rules reference this event. View event page.

Panther (1)

GCP IAM Role Has Changed severity informational T1078

google.iam.admin.UpdateServiceAccount

1 detection rules reference this event. View event page.

Sigma (1)

Google Cloud Service Account Modified severity medium

google.iam.admin.UploadServiceAccountKey

1 detection rules reference this event. View event page.

YARA-L (1)

Google Cloud Service Account Key Created or Uploaded severity medium T1098, T1098.001

google.iam.admin.WorkforcePools.CreateWorkforcePool

1 detection rules reference this event. View event page.

Panther (1)

GCP Workforce Pool Created or Updated severity high T1098.003, T1136.003

google.iam.admin.WorkforcePools.UpdateWorkforcePool

1 detection rules reference this event. View event page.

Panther (1)

GCP Workforce Pool Created or Updated severity high T1098.003, T1136.003

google.iam.WorkloadIdentityPools.CreateWorkloadIdentityPoolProvider

1 detection rules reference this event. View event page.

Panther (1)

GCP Workload Identity Pool Created or Updated severity high T1098.003, T1136.003

google.iam.WorkloadIdentityPools.UpdateWorkloadIdentityPoolProvider

1 detection rules reference this event. View event page.

Panther (1)

GCP Workload Identity Pool Created or Updated severity high T1098.003, T1136.003