GCP IAM and Tag Enumeration

AnalysisType: rule
RuleID: GCP.IAM.Tag.Enumeration
Description: >
  Detects enumeration of IAM policies and tags in GCP, which could be a precursor
  to privilege escalation attempts via tag-based access control.
DisplayName: GCP IAM and Tag Enumeration
Enabled: true
Filename: gcp_iam_tag_enumeration.py
LogTypes:
  - GCP.AuditLog
CreateAlert: false
Runbook: |
  Review if the user has legitimate business need for these enumeration operations.
  If unauthorized, review and update IAM policies.
Severity: Info
Tags:
  - attack.reconnaissance
  - attack.t1548
  - gcp
  - iam
  - tagbinding
Tests:
  - Name: IAM Policy Enumeration
    ExpectedResult: true
    Log:
      {
        "protoPayload": {
          "methodName": "GetIamPolicy",
          "authenticationInfo": {
            "principalEmail": "test@example.com"
          },
          "resourceName": "projects/test-project"
        },
        "resource": {
          "labels": {
            "project_id": "test-project"
          }
        },
        "timestamp": "2024-01-01T00:00:00Z"
      }

  - Name: Tag Keys Enumeration
    ExpectedResult: true
    Log:
      {
        "protoPayload": {
          "methodName": "TagKeys.ListTagKeys",
          "authenticationInfo": {
            "principalEmail": "test@example.com"
          },
          "resourceName": "projects/test-project"
        },
        "resource": {
          "labels": {
            "project_id": "test-project"
          }
        },
        "timestamp": "2024-01-01T00:00:00Z"
      }

  - Name: Normal Operation
    ExpectedResult: false
    Log:
      {
        "protoPayload": {
          "methodName": "compute.instances.list",
          "authenticationInfo": {
            "principalEmail": "test@example.com"
          },
          "resourceName": "projects/test-project"
        },
        "resource": {
          "labels": {
            "project_id": "test-project"
          }
        },
        "timestamp": "2024-01-01T00:00:00Z"
      } 


# ------ paired body: gcp_iam_tag_enumeration.py ------

from panther_gcp_helpers import gcp_alert_context


def rule(event):
    enum_iam_tags = [
        "GetIamPolicy",
        "TagKeys.ListTagKeys",
        "TagKeys.ListTagValues",
        "TagBindings.ListEffectiveTags",
    ]

    method_name = event.deep_get("protoPayload", "methodName", default="")
    return any(tag in method_name for tag in enum_iam_tags)


def title(event):
    principal = event.deep_get(
        "protoPayload", "authenticationInfo", "principalEmail", default="<UNKNOWN>"
    )
    method = event.deep_get("protoPayload", "methodName", default="<UNKNOWN>")
    return f"GCP IAM and Tag Enumeration by {principal} - {method}"


def alert_context(event):
    return gcp_alert_context(event)