LoFP / infrastructure-as-code tooling (e.g. terraform), ci/cd pipelines, and platform automation routinely grant serviceaccountuser or serviceaccounttokencreator when wiring up workloads, deployments, or impersonation chains. identify the expected automation principals and target service accounts and add exceptions for them.

Techniques

• T1098

Sample rules

GCP IAM Service Account Impersonation Role Granted

• source: elastic
• technicques:
  • T1098

Description

Identifies when a service account impersonation role is granted on a Google Cloud Platform (GCP) service account via a SetIamPolicy operation. Roles such as “roles/iam.serviceAccountTokenCreator”, “roles/iam.serviceAccountUser”, and “roles/iam.serviceAccountOpenIdTokenCreator” allow a principal to mint access or identity tokens for the target service account, or to act as it when deploying resources. Adversaries who have obtained sufficient privileges may grant themselves or an attacker-controlled principal one of these roles to impersonate a higher-privileged service account, escalating privileges and establishing durable, key-less persistence that survives credential rotation. This is a New Terms rule that alerts when the granting principal has not been observed performing this action in the last weeks.

Detection logic

data_stream.dataset: "gcp.audit"
  and event.action: google.iam.admin.v*.SetIAMPolicy
  and event.outcome: "success"
  and gcp.audit.service_data.policy_delta.binding_deltas:{
    action: "ADD" and
    role: (
      "roles/iam.serviceAccountTokenCreator" or
      "roles/iam.serviceAccountUser" or
      "roles/iam.serviceAccountOpenIdTokenCreator"
    )
  }