service account disabled or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.

source: <a href=https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_service_account_disabled_or_deleted.yml>sigma
technicques: t1531

Techniques

Identifies when a service account is disabled or deleted in Google Cloud.

condition: selection
selection:
  gcp.audit.method_name|endswith:
  - .serviceAccounts.disable
  - .serviceAccounts.delete