Microsoft Sentinel low experimental kql

GCP IAM - Privileges Enumeration

'Detects possible privileges enumeration.'

View Source

Detection Logic

let threshold = 5;
GCP_IAM
| where PayloadMethodname =~ 'google.iam.admin.v1.ListRoles'
| summarize count() by PayloadAuthenticationinfoPrincipalemail, bin(TimeGenerated, 1h)
| where count_ > threshold
| extend AccountCustomEntity = PayloadAuthenticationinfoPrincipalemail

Field Validations

Loading…

Comments (0)

Loading comments...