LoFP LoFP / high risk permissions are part of any gcp environment, however it is important to track resource and accounts usage, this search may produce false positives.

Techniques

Sample rules

GCP Detect high risk permissions by resource and account

Description

This search provides detection of high risk permissions by resource and accounts. These are permissions that can allow attackers with compromised accounts to move laterally and escalate privileges.

Detection logic

`google_gcp_pubsub_message` data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.getaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create 
|table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.response.bindings{}.members{} data.resource.labels.project_id 
| `gcp_detect_high_risk_permissions_by_resource_and_account_filter`