GCP Cloud Run Service Created WITH Set IAM Policy

Description

Detects run.services.create method for privilege escalation in GCP. The exploit creates a new Cloud Run Service that, when invoked, returns the Service Account's access token by accessing the metadata API of the server it is running on.

Query

Detection:
    - Group:
        - ID: ServiceCreated
          RuleID: GCP.Cloud.Run.Service.Created
        - ID: SetIAMPolicy
          RuleID: GCP.Cloud.Run.Set.IAM.Policy
      MatchCriteria:
        field_name:
          - GroupID: ServiceCreated
            Match: p_alert_context.caller_ip
          - GroupID: SetIAMPolicy
            Match: p_alert_context.caller_ip
      LookbackWindowMinutes: 1800
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 5

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

Analyst notes

Confirm this was authorized and necessary behavior

Raw source GCP Cloud Run Service Created WITH Set IAM Policy · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: correlation_rule
RuleID: "GCP.Cloud.Run.Service.Created.WITH.Set.IAM.Policy"
DisplayName: "GCP Cloud Run Service Created WITH Set IAM Policy"
Enabled: false
Severity: High
Description: Detects run.services.create method for privilege escalation in GCP. The exploit creates a new Cloud Run 
  Service that, when invoked, returns the Service Account's access token by accessing the metadata API of the server 
  it is running on.
Reference: https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/
Runbook: Confirm this was authorized and necessary behavior
Reports:
    MITRE ATT&CK:
        - TA0004:T1548  # Abuse Elevation Control Mechanism
Detection:
    - Group:
        - ID: ServiceCreated
          RuleID: GCP.Cloud.Run.Service.Created
        - ID: SetIAMPolicy
          RuleID: GCP.Cloud.Run.Set.IAM.Policy
      MatchCriteria:
        field_name:
          - GroupID: ServiceCreated
            Match: p_alert_context.caller_ip
          - GroupID: SetIAMPolicy
            Match: p_alert_context.caller_ip
      LookbackWindowMinutes: 1800
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 5
Tests:
    - Name: GCP Service Run, Followed By IAM Policy Change From Same IP
      ExpectedResult: true
      RuleOutputs:
        - ID: ServiceCreated
          Matches:
            p_alert_context.caller_ip:
              1.1.1.1:
                - "2024-06-01T10:00:00Z"
        - ID: SetIAMPolicy
          Matches:
            p_alert_context.caller_ip:
              1.1.1.1:
                - "2024-06-01T10:00:01Z"
    - Name: GCP Service Run, Not Followed By IAM Policy Change
      ExpectedResult: false
      RuleOutputs:
        - ID: ServiceCreated
          Matches:
            p_alert_context.caller_ip:
              1.1.1.1:
                - "2024-06-01T10:00:00Z"
    - Name: IAM Policy Change, Not Preceeded By GCP Service Run
      ExpectedResult: false
      RuleOutputs:
        - ID: SetIAMPolicy
          Matches:
            p_alert_context.caller_ip:
              1.1.1.1:
                - "2024-06-01T10:00:01Z"
    - Name: GCP Service Run, Followed By IAM Policy Change From Different IP
      ExpectedResult: false
      RuleOutputs:
        - ID: ServiceCreated
          Matches:
            p_alert_context.caller_ip:
              1.1.1.1:
                - "2024-06-01T10:00:00Z"
        - ID: SetIAMPolicy
          Matches:
            p_alert_context.caller_ip:
              2.2.2.2:
                - "2024-06-01T10:00:01Z"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.