Detecting suspicious service account behavior with SCC Premium
In this community post, we’ll take a closer look at detecting suspicious service account behavior in Google Cloud using SCC Premium.
Service accounts are commonly leveraged by attackers to establish a foothold in cloud environments as part of an attack scenario. Compromised service accounts can exhibit suspicious activity in a number of ways. Our research has identified attackers who gain access to compromised service accounts will enumerate the IAM roles and permissions associated with that account to understand their ability to move laterally within an environment. Doing so establishes potential next steps in leveraging the account for future malicious activity.
In this scenario, we’ll use a VM Instance in GCP to manually trigger a finding in SCC Premium related to service account self-investigation. We’ll cover the required configuration needed to trigger this finding, then execute a
