Google Cloud Service Account Impersonation using GCPloit Exploitation Framework

gcp

Classification:

attack

Tactic:

TA0004-privilege-escalation

Technique:

T1078-valid-accounts

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect possible Google Cloud Service Account impersonation activity using the gcploit exploitation framework.

Strategy

Monitor Google Cloud Function Logs source:gcp.cloud.function and detect if the following sequence of events has occurred within a one minute window:

  • Function is created - google.cloud.functions.v1.CloudFunctionsService.CreateFunction with a timeout of 539s (@data.protoPayload.request.function.timeout:539s)
  • Function’s IAM access control policy is enumerated - google.cloud.functions.v1.CloudFunctionsService.GetIamPolicy
  • Function’s IAM access control policy is set - google.cloud.functions.v1.CloudFunctionsService.SetIamPolicy

Triage & Response

  1. Investigate if the function:{{@function.name}} was intentionally created by user {{@usr.id}}.
  2. If unauthorized:
    • Revoke access of compromised credentials.
    • Remove unauthorized cloud functions.
    • Investigate other activities performed by the user {{@usr.id}} using the Cloud SIEM - User Investigation dashboard.