Panther high experimental python

GCP storage hmac keys create

There is a feature of Cloud Storage, “interoperability”, that provides a way for Cloud Storage to interact with storage offerings from other cloud providers, like AWS S3. As part of that, there are HMAC keys that can be created for both Service Accounts and regular users. We can escalate Cloud Storage permissions by creating an HMAC key for a higher-privileged Service Account.

View Source

Detection Logic

def rule(event):
    auth_info = event.deep_walk("protoPayload", "authorizationInfo", default=[])
    auth_info = auth_info if isinstance(auth_info, list) else [auth_info]

    for auth in auth_info:
        if auth.get("granted", False) and auth.get("permission", "") == "storage.hmacKeys.create":
            return True
    return False

Field Validations

Loading…

Comments (0)

Loading comments...