Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

GCP Service Account Deletion

Identifies when a service account is deleted in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. An adversary may delete a service account in order to disrupt their target's business operations.

ATT&CK coverage

Outside the enterprise matrix

T1531

Detection requirements

Log source category: event_index

What the source says

What fires this without an attack behind it

Service accounts may be deleted by system administrators. Verify that the behavior was expected. Exceptions can be added to this rule to filter expected behavior.

References

https://cloud.google.com/iam/docs/service-accounts

Tagged by the source as

Data Source: GCPData Source: Google Cloud PlatformDomain: CloudResources: Investigation GuideTactic: ImpactUse Case: Identity and Access Audit

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.