[sync] Add detection of iam.serviceAccountKeys.create event (#53)

[egibs]

Goal

Detect iam.serviceAccountKeys.create method for privilege escalation in GCP.

Categorization
TA0004:T1548

Strategy Abstract

The Identity and Access Management (IAM) service manages authorization and authentication for a GCP environment. This means that there are very likely multiple privilege escalation methods that use the IAM service and/or its permissions.

Technical Context

If your user is assigned a custom IAM role, then iam.roles.update will allow you to update the “includedPermissons” on that role. Because it is assigned to you, you will gain the additional privileges, which could be anything you desire.

Blind Spots and Assumptions

Assumes proper GCP logging and audit policies.

False Positives

Legitimate administrative activity that is authorized and expected.

Validation

The exploit script for this method can be found here.

Priority

High or Critical

Response

Again, these are not vulnerabilities in GCP, they are vulnerabilities in how you have configured your GCP environment, so it is your responsibility to be aware of these attack vectors and to defend against them. Make sure to follow the principle of least-privilege in your environments to help mitigate these security risks.

Additional Resources

https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/