GCP Principals Exempted from Cloud Audit Logs
Detects when principals are exempted from GCP Cloud Audit logs at either the project or organization level. This action can significantly impair an organization's ability to monitor security events and maintain compliance, as audit logs are crucial for detecting malicious activity and ensuring accountability. The rule specifically looks for 'SetIamPolicy' events targeting 'cloudresourcemanager.googleapis.com' where audit log exemptions are added for 'allServices'.
YARA-L
