GCP-VM - Instance Service Account or Scope Change
Detects modifications to the service account assigned to a Google Compute Engine (GCE) instance. An adversary might alter the attached service account to escalate privileges, gain access to additional resources, or maintain persistence by leveraging an identity with higher permissions.
Sigma
