GCP.Iam.ServiceAccountKeys.Create

AnalysisType: rule
RuleID: "GCP.iam.serviceAccountKeys.create"
DisplayName: "GCP.Iam.ServiceAccountKeys.Create"
Description:
  If your user is assigned a custom IAM role, then iam.roles.update will allow you to update
  the “includedPermissons” on that role. Because it is assigned to you, you will gain the additional privileges,
  which could be anything you desire.
Enabled: true
Filename: gcp_iam_service_account_key_create.py
LogTypes:
  - GCP.AuditLog
Severity: High
DedupPeriodMinutes: 60
Threshold: 1
Reference: https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/
Runbook:
  Confirm this was authorized and necessary behavior. This is not a vulnerability in GCP, it is a vulnerability
  in how GCP environment is configured, so it is necessary to be aware of these attack vectors and to defend against
  them. It’s also important to remember that privilege escalation does not necessarily need to pass through the
  IAM service to be effective. Make sure to follow the principle of least-privilege in your environments to help
  mitigate these security risks.
Reports:
  MITRE ATT&CK:
    - TA0004:T1548
Tests:
  - Name: privilege-escalation
    ExpectedResult: true
    Log:
      protoPayload:
        authorizationInfo:
          - granted: true
            permission: iam.serviceAccountKeys.create
        methodName: v2.deploymentmanager.deployments.insert
        serviceName: deploymentmanager.googleapis.com
      receiveTimestamp: "2024-01-19 13:47:19.465856238"
      resource:
        labels:
          name: test-vm-deployment
          project_id: panther-threat-research
        type: deployment
      severity: NOTICE
      timestamp: "2024-01-19 13:47:18.279921000"
  - Name: fail
    ExpectedResult: false
    Log:
      protoPayload:
        authorizationInfo:
          - granted: false
            permission: iam.serviceAccountKeys.create
        methodName: v2.deploymentmanager.deployments.insert
        serviceName: deploymentmanager.googleapis.com
      receiveTimestamp: "2024-01-19 13:47:19.465856238"
      resource:
        labels:
          name: test-vm-deployment
          project_id: panther-threat-research
        type: deployment
      severity: NOTICE
      timestamp: "2024-01-19 13:47:18.279921000"


# ------ paired body: gcp_iam_service_account_key_create.py ------

from panther_gcp_helpers import gcp_alert_context


def rule(event):
    authorization_info = event.deep_walk("protoPayload", "authorizationInfo")
    if not authorization_info:
        return False

    for auth in authorization_info:
        if (
            auth.get("permission") == "iam.serviceAccountKeys.create"
            and auth.get("granted") is True
        ):
            return True
    return False


def title(event):
    actor = event.deep_get(
        "protoPayload", "authenticationInfo", "principalEmail", default="<ACTOR_NOT_FOUND>"
    )
    operation = event.deep_get("protoPayload", "methodName", default="<OPERATION_NOT_FOUND>")
    project_id = event.deep_get("resource", "labels", "project_id", default="<PROJECT_NOT_FOUND>")

    return f"[GCP]: [{actor}] performed [{operation}] on project [{project_id}]"


def alert_context(event):
    return gcp_alert_context(event)