service account being disabled or deleted may be performed by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.

source: <a href=https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_service_account_disabled_or_deleted.yml>sigma
technicques: t1531

Techniques

Identifies when a service account is disabled or deleted in Google Cloud.

condition: selection
selection:
  gcp.audit.method_name|endswith:
  - .serviceAccounts.disable
  - .serviceAccounts.delete