Unauthorized KMS Decryption by Unexpected Service Account
Detects when a Key Management Service (KMS) decryption operation is carried out by a service account that is not in an allowlist. This behavior may indicate unauthorized access to sensitive information protected by KMS keys. The rule specifically looks for 'Decrypt' events within Google Cloud Platform (GCP) and flags any service account performing this action if it's not part of a predefined allowlist.
YARA-L
