Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,181 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects unauthorized or suspicious use of Google Cloud Config Connector (KCC) service accounts to apply high-privilege IAM roles ('roles/owner' or 'roles/resourcemanager.organizationAdmin') at the Organization or Folder scope. This rule monitors for 'SetIamPolicy' API calls where the principal is identified as a KCC-related service account, flagging potential exploitation of KCC's authority to grant excessive permissions.
This rule detects unauthorized attempts by non-automation Kubernetes users to create or update IAM policies for Google Cloud resources via Config Connector (KCC). It specifically monitors for actions that assign high-privilege roles (e.g., Organization Owner, Organization Admin) to Organization-scoped resources, excluding authorized platform service accounts and KCC reconciliation traffic.
This rule detects unauthorized attempts by non-automation Kubernetes users to create or update IAM policies for Google Cloud resources via Config Connector (KCC). It specifically monitors for actions that assign high-privilege roles (e.g., Organization Owner, Organization Admin) to Organization-scoped resources, excluding authorized platform service accounts and KCC reconciliation traffic.
This rule detects unauthorized attempts by non-automation Kubernetes users to create or update IAM policies for Google Cloud resources via Config Connector (KCC). It specifically monitors for actions that assign high-privilege roles (e.g., Organization Owner, Organization Admin) to Organization-scoped resources, excluding authorized platform service accounts and KCC reconciliation traffic.
This rule detects unauthorized attempts by non-automation Kubernetes users to create or update IAM policies for Google Cloud resources via Config Connector (KCC). It specifically monitors for actions that assign high-privilege roles (e.g., Organization Owner, Organization Admin) to Organization-scoped resources, excluding authorized platform service accounts and KCC reconciliation traffic.
This rule detects unauthorized attempts by non-automation Kubernetes users to create or update IAM policies for Google Cloud resources via Config Connector (KCC). It specifically monitors for actions that assign high-privilege roles (e.g., Organization Owner, Organization Admin) to Organization-scoped resources, excluding authorized platform service accounts and KCC reconciliation traffic.
Detects Kubernetes RBAC Role or ClusterRole creation or update events that grant the 'create' verb on Config Connector (KCC) IAM custom resources (iampolicymembers, iampolicies, iampartialpolicies) by non-approved user identities. This could indicate an attempt to gain unauthorized control over cloud IAM policies through the Kubernetes API.
Detects Kubernetes RBAC Role or ClusterRole creation or update events that grant the 'create' verb on Config Connector (KCC) IAM custom resources (iampolicymembers, iampolicies, iampartialpolicies) by non-approved user identities. This could indicate an attempt to gain unauthorized control over cloud IAM policies through the Kubernetes API.
Detects Kubernetes RBAC Role or ClusterRole creation or update events that grant the 'create' verb on Config Connector (KCC) IAM custom resources (iampolicymembers, iampolicies, iampartialpolicies) by non-approved user identities. This could indicate an attempt to gain unauthorized control over cloud IAM policies through the Kubernetes API.
Detects Kubernetes RBAC Role or ClusterRole creation or update events that grant the 'create' verb on Config Connector (KCC) IAM custom resources (iampolicymembers, iampolicies, iampartialpolicies) by non-approved user identities. This could indicate an attempt to gain unauthorized control over cloud IAM policies through the Kubernetes API.
Page 266 of 756