Google Cloud Service Account Modified

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Identifies when a service account is modified, created, updated, enabled, or undeleted in Google Cloud. This rule specifically looks for API calls related to service account management, which could indicate an attacker establishing persistence, escalating privileges, or otherwise manipulating cloud resources.