Leaked GCP service account key: how to investigate it
A service account key leaked in a repo or CI log? Find its key ID, every IP that used it and what it did via serviceAccountKeyName, then contain it in order.
Series
Investigating Google Cloud attack techniques
7 posts in this series. Read them in order or jump to any one.
- Leaked GCP service account key: how to investigate it
A service account key leaked in a repo or CI log? Find its key ID, every IP that used it and what it did via serviceAccountKeyName, then contain it in order.
- GCP service account impersonation: tracing the chain
Trace service account impersonation in Google Cloud audit logs: GenerateAccessToken, SignBlob, serviceAccountDelegationInfo, actAs and Token Creator grants.
- SetIamPolicy abuse: finding owner grants and outsiders
Read SetIamPolicy audit entries like an investigator: bindingDeltas, Owner granted to Gmail accounts, unknown domains, allUsers, Token Creator, org policies.
- GCP crypto mining and startup-script backdoors: detection
Detect Compute Engine abuse in Google Cloud audit logs: startup-script backdoors, SSH keys in metadata, OS Login removed, GPU VMs, VM bursts and unused regions.
- GCS and BigQuery exfiltration: evidence in audit logs
Prove or rule out data theft from Cloud Storage and BigQuery: bulk storage.objects.get, public buckets, HMAC keys, cross-project copies, shared disk images.
- VPC Flow Logs analysis in GCP: spotting exfiltration
Use Google Cloud VPC Flow Logs in an investigation: record fields, sampling caveats, egress per external IP, and matching audit-log attacker IPs to VM traffic.
- GCP log sink deleted? Detecting defense evasion in logs
How attackers blind Google Cloud defenders: deleted or redirected log sinks, exclusions, log buckets, Data Access logging removed, SCC alerts. What remains.
All posts in this series
GCP service account impersonation: tracing the chain
Trace service account impersonation in Google Cloud audit logs: GenerateAccessToken, SignBlob, serviceAccountDelegationInfo, actAs and Token Creator grants.
SetIamPolicy abuse: finding owner grants and outsiders
Read SetIamPolicy audit entries like an investigator: bindingDeltas, Owner granted to Gmail accounts, unknown domains, allUsers, Token Creator, org policies.
GCP crypto mining and startup-script backdoors: detection
Detect Compute Engine abuse in Google Cloud audit logs: startup-script backdoors, SSH keys in metadata, OS Login removed, GPU VMs, VM bursts and unused regions.
GCS and BigQuery exfiltration: evidence in audit logs
Prove or rule out data theft from Cloud Storage and BigQuery: bulk storage.objects.get, public buckets, HMAC keys, cross-project copies, shared disk images.
VPC Flow Logs analysis in GCP: spotting exfiltration
Use Google Cloud VPC Flow Logs in an investigation: record fields, sampling caveats, egress per external IP, and matching audit-log attacker IPs to VM traffic.
GCP log sink deleted? Detecting defense evasion in logs
How attackers blind Google Cloud defenders: deleted or redirected log sinks, exclusions, log buckets, Data Access logging removed, SCC alerts. What remains.