GCP-IAM - Custom Role Creation or Update
Detects the creation or update of IAM custom roles in Google Cloud Platform. This activity can be indicative of privilege escalation or the establishment of persistence by an adversary modifying access controls.
Sigma

