GCP set IAM policy activity

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2024-12-03

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires: Gcp Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098)
Severity	Informational

Description

A cloud identity had modified a resource policy bindings.

Attacker's Goals

Escalate privileges.

Investigative actions

Verify which permissions were granted to the identity.

Variations

GCP set IAM policy activity by an identity with high administrative activity

Synopsis

ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098)
Severity	Informational

Description

A cloud identity with high administrative activity had modified a resource policy binding.

Attacker's Goals

Escalate privileges.

Investigative actions

Verify which permissions were granted to the identity.

GCP IAM add sensitive role

Synopsis

ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098)
Severity	Medium

Description

A cloud identity added an IAM sensitive role to itself.

Attacker's Goals

Escalate privileges.

Investigative actions

Verify which permissions were granted to the identity.

GCP storage add sensitive role

Synopsis

ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098)
Severity	Medium

Description

A cloud identity added a storage sensitive role to itself.

Attacker's Goals

Escalate privileges.

Investigative actions

Verify which permissions were granted to the identity.

GCP compute add sensitive role

Synopsis

ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098)
Severity	Medium

Description

A cloud identity added a compute sensitive role to itself.

Attacker's Goals

Escalate privileges.

Investigative actions

Verify which permissions were granted to the identity.

GCP secret manager add sensitive role

Synopsis

ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098)
Severity	Medium

Description

A cloud identity added a secret manager sensitive role to itself.

Attacker's Goals

Escalate privileges.

Investigative actions

Verify which permissions were granted to the identity.

GCP cloud run add sensitive role

Synopsis

ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098)
Severity	Medium

Description

A cloud identity added a cloud run sensitive role to itself.

Attacker's Goals

Escalate privileges.

Investigative actions

Verify which permissions were granted to the identity.

GCP function add sensitive role

Synopsis

ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098)
Severity	Medium

Description

A cloud identity added a function sensitive role to itself.

Attacker's Goals

Escalate privileges.

Investigative actions

Verify which permissions were granted to the identity.

GCP deployment manager add sensitive role

Synopsis

ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098)
Severity	Medium

Description

A cloud identity added a deployment manager sensitive role to itself.

Attacker's Goals

Escalate privileges.

Investigative actions

Verify which permissions were granted to the identity.