Analytics BIOC
Informational
✕
Remote usage of VM Service Account token
A GCP Service Account token, which is attached to a VM, was used externally of the cloud environment.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- Gcp Audit Log
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Steal Application Access Token (T1528) Unsecured Credentials (T1552)
Attacker's goals:
Exfiltrate token and abuse it remotely.
Investigative actions:
Check if the service account was attached to a specific VM. Check if the service account was used by a user. Check if the relevant VM is compromised.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
1 variation:
- Suspicious usage of VM Service Account token High (parent: Informational)