Microsoft Sentinel low experimental kql

GCP IAM - Service Account Enumeration

'Detects possible service account enumeration.'

View Source

Detection Logic

let threshold = 5;
GCP_IAM
| where PayloadMethodname =~ 'google.iam.admin.v1.ListServiceAccounts'
| summarize count() by PayloadAuthenticationinfoPrincipalemail, bin(TimeGenerated, 1h)
| where count_ > threshold
| extend AccountCustomEntity = PayloadAuthenticationinfoPrincipalemail

Field Validations

Loading…

Comments (0)

Loading comments...