GCP Privileged Operation

AnalysisType: rule
RuleID: GCP.Privileged.Operation
Description: >
  Detects privileged operations in GCP that could be part of a privilege
  escalation attempt, especially when following tag binding creation.
DisplayName: GCP Privileged Operation
Enabled: true
Filename: gcp_privileged_operation.py
LogTypes:
  - GCP.AuditLog
CreateAlert: false
Runbook: |
  Check if the user has legitimate business need for this privileged operation.
  If unauthorized, revoke any recently created tag bindings and review IAM policies.
Severity: Info
Tags:
  - attack.privilege_escalation
  - attack.t1548
  - gcp
  - iam
  - tagbinding
Tests:
  - Name: Privileged Operation
    ExpectedResult: true
    Log:
      {
        "protoPayload": {
          "methodName": "compute.instances.setIamPolicy",
          "authenticationInfo": {
            "principalEmail": "test@example.com"
          },
          "resourceName": "projects/test-project"
        },
        "resource": {
          "labels": {
            "project_id": "test-project"
          }
        },
        "timestamp": "2024-01-01T00:00:00Z"
      }

  - Name: Normal Operation
    ExpectedResult: false
    Log:
      {
        "protoPayload": {
          "methodName": "compute.instances.list",
          "authenticationInfo": {
            "principalEmail": "test@example.com"
          },
          "resourceName": "projects/test-project"
        },
        "resource": {
          "labels": {
            "project_id": "test-project"
          }
        },
        "timestamp": "2024-01-01T00:00:00Z"
      } 


# ------ paired body: gcp_privileged_operation.py ------

from panther_gcp_helpers import gcp_alert_context

PRIVILEGED_OPERATIONS = [
    "iam.serviceAccounts.getAccessToken",
    "orgpolicy.policy.set",
    "storage.hmacKeys.create",
    "serviceusage.apiKeys.create",
    "serviceusage.apiKeys.list",
]


def rule(event):
    method_name = event.deep_get("protoPayload", "methodName", default="")
    return (
        method_name.endswith("setIamPolicy")
        or method_name.endswith("setIamPermissions")
        or method_name in PRIVILEGED_OPERATIONS
    )


def title(event):
    principal = event.deep_get(
        "protoPayload", "authenticationInfo", "principalEmail", default="<UNKNOWN>"
    )
    method = event.deep_get("protoPayload", "methodName", default="<UNKNOWN>")
    return f"GCP Privileged Operation by {principal} - {method}"


def alert_context(event):
    return gcp_alert_context(event)