GCP Privilege Escalation via TagBinding

Description

Detects a sequence of events that could indicate a privilege escalation attempt via GCP's tag-based access control. The sequence includes: 1. Enumeration of IAM policies and tags 2. Creation of a tag binding 3. Performance of a privileged operation

Query

Detection:
    - Group:
        - ID: Enumeration
          RuleID: GCP.IAM.Tag.Enumeration
        - ID: TagBinding
          RuleID: GCP.Tag.Binding.Creation
        - ID: PrivilegedOperation
          RuleID: GCP.Privileged.Operation
      MatchCriteria:
        field_name:
          - GroupID: Enumeration
            Match: p_alert_context.principal
          - GroupID: TagBinding
            Match: p_alert_context.principal
          - GroupID: PrivilegedOperation
            Match: p_alert_context.principal
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 10
      LookbackWindowMinutes: 1800

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

Analyst notes

Verify if the user has legitimate business need for this sequence of operations. If unauthorized, revoke the tag binding and review IAM policies.

Raw source GCP Privilege Escalation via TagBinding · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: correlation_rule
RuleID: "GCP.Privilege.Escalation.Via.TagBinding.Group"
DisplayName: "GCP Privilege Escalation via TagBinding"
Enabled: false
Severity: Info
Description: >
  Detects a sequence of events that could indicate a privilege escalation attempt
  via GCP's tag-based access control. The sequence includes:
  1. Enumeration of IAM policies and tags
  2. Creation of a tag binding
  3. Performance of a privileged operation
Reference: https://cloud.google.com/resource-manager/docs/tags/tags-overview
Runbook: >
  Verify if the user has legitimate business need for this sequence of operations.
  If unauthorized, revoke the tag binding and review IAM policies.
Reports:
    MITRE ATT&CK:
        - TA0004:T1548  # Abuse Elevation Control Mechanism
Detection:
    - Group:
        - ID: Enumeration
          RuleID: GCP.IAM.Tag.Enumeration
        - ID: TagBinding
          RuleID: GCP.Tag.Binding.Creation
        - ID: PrivilegedOperation
          RuleID: GCP.Privileged.Operation
      MatchCriteria:
        field_name:
          - GroupID: Enumeration
            Match: p_alert_context.principal
          - GroupID: TagBinding
            Match: p_alert_context.principal
          - GroupID: PrivilegedOperation
            Match: p_alert_context.principal
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 10
      LookbackWindowMinutes: 1800
Tags:
    - attack.privilege_escalation
    - attack.t1548
    - gcp
    - iam
    - tagbinding
    - Beta
Tests:
    - Name: Complete Attack Sequence
      ExpectedResult: true
      RuleOutputs:
        - ID: Enumeration
          Matches:
            p_alert_context.principal:
              "test@example.com":
                - "2024-06-01T10:00:00Z"
        - ID: TagBinding
          Matches:
            p_alert_context.principal:
              "test@example.com":
                - "2024-06-01T10:00:05Z"
        - ID: PrivilegedOperation
          Matches:
            p_alert_context.principal:
              "test@example.com":
                - "2024-06-01T10:00:10Z"

    - Name: Incomplete Sequence
      ExpectedResult: false
      RuleOutputs:
        - ID: Enumeration
          Matches:
            p_alert_context.principal:
              "test@example.com":
                - "2024-06-01T10:00:00Z"
        - ID: PrivilegedOperation
          Matches:
            p_alert_context.principal:
              "test@example.com":
                - "2024-06-01T10:00:10Z"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.