detection.wiki

Detection rules › Panther

GCP storage hmac keys create

Severity
high
Log types
GCP.AuditLog
Reference
https://rhinosecuritylabs.com/cloud-security/privilege-escalation-google-cloud-platform-part-2/
Source
github.com/panther-labs/panther-analysis

There is a feature of Cloud Storage, “interoperability”, that provides a way for Cloud Storage to interact with storage offerings from other cloud providers, like AWS S3. As part of that, there are HMAC keys that can be created for both Service Accounts and regular users. We can escalate Cloud Storage permissions by creating an HMAC key for a higher-privileged Service Account.

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1548 Abuse Elevation Control Mechanism

Rule body yaml

AnalysisType: rule
RuleID: "GCP.Storage.Hmac.Keys.Create"
DisplayName: "GCP storage hmac keys create"
Description: "There is a feature of Cloud Storage, “interoperability”, that provides a way for Cloud Storage to interact with storage offerings from other cloud providers, like AWS S3. As part of that, there are HMAC keys that can be created for both Service Accounts and regular users. We can escalate Cloud Storage permissions by creating an HMAC key for a higher-privileged Service Account."
Enabled: true
LogTypes:
  - GCP.AuditLog
Severity: High
DedupPeriodMinutes: 60
Threshold: 1
Reference: https://rhinosecuritylabs.com/cloud-security/privilege-escalation-google-cloud-platform-part-2/
Reports:
  MITRE ATT&CK:
    - TA0004:T1548
Filename: gcp_storage_hmac_keys_create.py
Tests:
  - Name: privilege-escalation
    ExpectedResult: true
    Log:
      protoPayload:
        authorizationInfo:
          - granted: true
            permission: storage.hmacKeys.create
        methodName: v2.deploymentmanager.deployments.insert
        serviceName: deploymentmanager.googleapis.com
      receiveTimestamp: "2024-01-19 13:47:19.465856238"
      resource:
        labels:
          name: test-vm-deployment
          project_id: panther-threat-research
        type: deployment
      severity: NOTICE
      timestamp: "2024-01-19 13:47:18.279921000"
  - Name: fail
    ExpectedResult: false
    Log:
      protoPayload:
        authorizationInfo:
          - granted: false
            permission: storage.hmacKeys.create
        methodName: v2.deploymentmanager.deployments.insert
        serviceName: deploymentmanager.googleapis.com
      receiveTimestamp: "2024-01-19 13:47:19.465856238"
      resource:
        labels:
          name: test-vm-deployment
          project_id: panther-threat-research
        type: deployment
      severity: NOTICE
      timestamp: "2024-01-19 13:47:18.279921000"

Detection logic

Condition

protoPayload.authorizationInfo array_any