Account has leaked credentials

This document describes a threat finding type in Security Command Center. Threat findings are generated by threat detectors when they detect a potential threat in your cloud resources. For a full list of available threat findings, see Threat findings index.

Finding description

This finding is generated when Google Cloud service account credentials are accidentally leaked online or compromised. To respond to this finding, do the following:

Step 1: Review finding details

  1. Open an account_has_leaked_credentials finding, as directed in Reviewing finding details. The details panel for the finding opens to the Summary tab.

  2. On the Summary tab, review the information in the following sections:

  • What was detected
  • Affected resource

  1. Click the Source Properties tab and note the following fields:

    • Compromised_account: the potentially compromised service account
    • Project_identifier: the project that contains the potentially leaked account credentials
    • URL: the link to the GitHub repository

  2. To see the complete JSON for the finding, click the JSON tab.

Step 2: Review project and service account permissions

  1. In the Google Cloud console, go to the IAM page.

    Go to IAM

  2. If necessary, select the project listed in Project_identifier.

  3. On the page that appears, in the Filter box, enter the account name listed in Compromised_account and check assigned permissions.

  4. In the Google Cloud console, go to the Service Accounts page.

    Go to Service Accounts

  5. On the page that appears, in the Filter box, enter the name of the compromised service account and check the service account's keys and key creation dates.

Step 3: Check logs

  1. In the Google Cloud console, go to Logs Explorer.

    Go to Logs Explorer

  2. On the Google Cloud console toolbar, select your project.

  3. On the page that loads, check logs for activity from new or updated IAM resources using the following filters:

    • proto_payload.method_name="google.iam.admin.v1.CreateServiceAccount"
    • protoPayload.methodName="SetIamPolicy"
    • resource.type="gce_instance" AND log_name="projects/Project_identifier/logs/cloudaudit.googleapis.com%2Factivity"
    • protoPayload.methodName="InsertProjectOwnershipInvite"
    • protoPayload.authenticationInfo.principalEmail="Compromised_account"

Step 4: Research attack and response methods

  1. Review the MITRE ATT&CK framework entry for this finding type: Valid Accounts: Cloud Accounts.
  2. Review related findings by clicking the link in relatedFindingURI. Related findings are the same finding type and the same instance and network.
  3. To develop a response plan, combine your investigation results with MITRE research.

Step 5: Implement your response

The following response plan might be appropriate for this finding, but might also impact operations. Carefully evaluate the information you gather in your investigation to determine the best way to resolve findings.

  • Contact the owner of the project with leaked credentials.
  • Consider deleting the compromised service account and rotate and delete all service account access keys for the compromised project. After deletion, resources that use the service account for authentication lose access. Before proceeding, your security team should identify all impacted resources and work with resource owners to ensure business continuity.
  • Work with your security team to identify unfamiliar resources, including Compute Engine instances, snapshots, service accounts, and IAM users. Delete resources not created with authorized accounts.
  • Respond to notifications from Google Cloud Support.
  • To limit who can create service accounts, use the Organization Policy Service.
  • To identify and fix overly permissive roles, use IAM Recommender.
  • Open the URL link and delete the leaked credentials. Gather more information about the compromised account and contact the owner.

What's next