GCP-IAM - Service Account Deletion / Disable
This rule detects the deletion or disabling of Google Cloud IAM service accounts in GCP Audit Logs. These actions are often associated with cleanup activities by an adversary trying to remove persistence or hinder forensic investigations and incident response.
Sigma
