GCP Service Account Impersonation via IAM Credentials API

Lacey Cochrane@NullVectorX

•updated Jul 6, 2026•7•0•10

Detects the usage of the Google Cloud IAM Credentials API to generate OAuth access tokens, OIDC ID tokens, sign JWTs, or sign blobs as a service account. This behavior indicates an identity assuming a service account's permissions, a common technique for privilege escalation or lateral movement in GCP environments.