GCP Service Account Key Created for Escalation

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•11

This rule detects the creation of a new service account key within Google Cloud Platform (GCP) via the 'iam.googleapis.com' API. Specifically, it looks for HTTP POST requests to URIs containing 'serviceAccounts' and 'keys'. This activity can be indicative of privilege escalation, where an attacker creates a new key for an existing service account to gain persistent access or elevate their privileges.