GCP Service Account Key Used From Multiple Countries
This rule detects the usage of a Google Cloud Platform (GCP) service account key from more than two distinct countries within a one-hour period. It leverages GeoIP enrichment data from Chronicle to identify the geographical origin of the IP addresses making the API calls. This behavior can indicate a compromised service account key being used by an attacker from multiple locations, potentially to evade detection or perform malicious activities across different regions.
YARA-L
