1Password service account token activity observed

1password

Classification:

attack

Set up the 1password integration.

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when a 1Password service account token activity is observed.

Strategy

This rule monitors 1Password audit logs to determine when any of the following actions is observed for a 1Password service account token:

  • create: A service account token was registered.
  • trename: A service account token name was updated.
  • tverify: A service account token signature was registered.
  • trevoke: A service account token was revoked.

1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional services.

Token activity from these service accounts could indicate an attacker using a non-user identity to compromise a 1Password tenant.

Triage & response

  • Investigate the user {{@usr.email}} performing the service account token activity {{@evt.name}}.
  • In the event of an accidental credentials exposure follow the 1Password Service Account security recommendation.
    • You must create a new service account with the same permissions, and delete the 1Password service account with the exposed credentials.