GCP Security Command Center - Detect projects with API Keys present

Detects Google Cloud projects that have API Keys present using Security Command Center API_KEY_EXISTS findings. Projects with API Keys may expose credentials that enable unauthorized access if keys are leaked.

Detection logic

Detection requirements

Platform: Containers IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: googlesccdefinition
Log source service: googlecloudscc

Detection rules

GCP Security Command Center - Detect projects with API Keys present

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules