CrowdStrike Expands Falcon Adversary OverWatch Threat Hunting to AI Systems and Google Cloud — What Defenders Must Do Now

---
title: GCP Service Account Key Creation by Non-Administrative Identity
id: 3f8a1c72-7d4e-4b9a-a2c1-5e6f7a8b9c0d
status: experimental
description: Detects creation of GCP service account keys by identities that do not normally perform IAM administration. Adversaries create service account keys to establish persistence in GCP environments after initial access.
references:
  - https://attack.mitre.org/techniques/T1098/001/
  - https://cloud.google.com/iam/docs/audit-logging
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1098.001
  - attack.privilege_escalation
logsource:
  product: gcp
  service: audit
detection:
  selection:
    protoPayload.methodName: 'google.iam.admin.v1.CreateServiceAccountKey'
  filter_known_admins:
    protoPayload.authenticationInfo.principalEmail|endswith:
      - '@your-admin-group.iam.gserviceaccount.com'
  condition: selection and not filter_known_admins
falsepositives:
  - CI/CD pipelines programmatically rotating service account keys
  - Terraform or infrastructure-as-code deployments creating keys
level: high
---
title: Suspicious Access to AI Model Artifacts in Cloud Storage
id: 7b2e9f41-3a5c-4d8e-b1f2-6a7c8d9e0f1a
status: experimental
description: Detects anomalous read or export operations against cloud storage buckets containing AI model weights, training data, or fine-tuned model artifacts. Adversaries targeting AI intellectual property will attempt bulk downloads or cross-project copies of model artifacts.
references:
  - https://attack.mitre.org/techniques/T1530/
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1530
  - attack.exfiltration
  - attack.t1567.002
logsource:
  product: gcp
  service: audit
detection:
  selection:
    protoPayload.methodName|contains:
      - 'storage.objects.get'
      - 'storage.objects.list'
    protoPayload.resourceName|contains:
      - 'model'
      - 'checkpoint'
      - 'weights'
      - 'training'
      - 'ml-artifacts'
      - 'huggingface'
      - '.bin'
      - '.safetensors'
      - '.ckpt'
  condition: selection
falsepositives:
  - Data scientists and ML engineers accessing model artifacts as part of normal workflows
  - Automated model deployment pipelines pulling artifacts
level: medium
---
title: Anomalous Process Execution in GKE or GCP Workload
id: 9c1d3e52-8f6a-4b7c-a3d4-2e5f6a7b8c9d
status: experimental
description: Detects execution of reconnaissance or post-exploitation tooling within GCP workloads including GKE containers and GCE instances. Adversaries operating in cloud workloads frequently use living-off-the-land techniques and cloud-native CLI tools for discovery and lateral movement.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1613/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.discovery
  - attack.t1613
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/kubectl'
      - '/gcloud'
      - '/gsutil'
      - '/curl'
      - '/wget'
  selection_cmd:
    CommandLine|contains:
      - 'kubectl exec'
      - 'kubectl get secrets'
      - 'gcloud iam service-accounts'
      - 'gcloud secrets versions access'
      - 'metadata.google.internal'
      - '169.254.169.254'
  condition: selection_img and selection_cmd
falsepositives:
  - DevOps engineers performing cluster administration
  - Automated CI/CD pipelines interacting with GCP APIs
level: high

// Hunt: GCP Service Account Key Creation + IAM Policy Changes + AI Artifact Access
// Correlates high-risk GCP control plane events over a 7-day window
let TimeWindow = 7d;
let HighRiskMethods = dynamic([
    "google.iam.admin.v1.CreateServiceAccountKey",
    "google.iam.admin.v1.UpdateServiceAccount",
    "SetIamPolicy",
    "google.iam.admin.v1.CreateServiceAccount"
]);
let AIStorageIndicators = dynamic([
    "model", "checkpoint", "weights", "training",
    "ml-artifacts", ".safetensors", ".ckpt", ".bin"
]);
// Part 1: IAM manipulation events
let IAMEvents = CommonSecurityLog
| where TimeGenerated > ago(TimeWindow)
| where DeviceVendor == "Google" or SourceSystem == "GCP"
| where Activity has_any (HighRiskMethods)
| project TimeGenerated, SourceUserID, Activity, SourceIP, DestinationHostName, AdditionalExtensions;
// Part 2: AI/ML storage access events
let AIArtifactAccess = CommonSecurityLog
| where TimeGenerated > ago(TimeWindow)
| where DeviceVendor == "Google" or SourceSystem == "GCP"
| where Activity has "storage.objects"
| where FilePath has_any (AIStorageIndicators) or RequestURL has_any (AIStorageIndicators)
| project TimeGenerated, SourceUserID, Activity, SourceIP, FilePath, RequestURL;
// Part 3: Combine and summarize by identity
union IAMEvents, AIArtifactAccess
| summarize
    EventCount = count(),
    DistinctActivities = make_set(Activity),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    SourceIPs = make_set(SourceIP)
  by SourceUserID
| where EventCount > 3  // Tune threshold for your environment
| sort by EventCount desc

// Hunt: Suspicious process execution on GCP workloads (via Syslog or EDR telemetry)
// Targets cloud-native recon and post-exploitation tooling
DeviceProcessEvents
| where TimeGenerated > ago(48h)
| where FileName in~ ("kubectl", "gcloud", "gsutil")
| where ProcessCommandLine has_any (
    "kubectl exec",
    "kubectl get secrets",
    "gcloud iam service-accounts keys create",
    "gcloud secrets versions access",
    "metadata.google.internal"
)
| project
    TimeGenerated,
    DeviceName,
    FileName,
    ProcessCommandLine,
    AccountName,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine
| sort by TimeGenerated desc

-- Hunt: Cloud metadata service access and credential file discovery on GCP workloads
-- Targets adversary reconnaissance and credential theft in cloud environments

-- Part 1: Processes accessing GCP instance metadata
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'metadata\\.google\\.internal'
   OR CommandLine =~ '169\\.254\\.169\\.254'
   OR CommandLine =~ 'gcloud.*iam.*service-accounts.*keys'
   OR CommandLine =~ 'kubectl.*get.*secrets'

-- Part 2: Discover service account key files and cloud credential caches
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
    '/home/*/.config/gcloud/**',
    '/root/.config/gcloud/**',
    '/home/*/.kube/config',
    '/root/.kube/config',
    '/tmp/*.json',
    '/var/run/secrets/kubernetes.io/**'
])
WHERE Mtime > timestamp(epoch=now() - 604800)  -- Modified in last 7 days
ORDER BY Mtime DESC

#!/bin/bash
# GCP Service Account and AI Storage Security Audit
# Run with appropriate GCP IAM permissions (SecurityReviewer or higher)
# Usage: ./gcp_security_audit.sh PROJECT_ID

set -euo pipefail

PROJECT_ID="${1:?Usage: $0 <PROJECT_ID>}"
REPORT="gcp_audit_$(date +%Y%m%d_%H%M%S).txt"

echo "=== GCP Security Audit: $PROJECT_ID ===" | tee "$REPORT"

# --- 1. Audit: List all service accounts with user-managed keys ---
echo -e "\n[1] Service Accounts with User-Managed Keys (Persistence Risk)" | tee -a "$REPORT"
gcloud iam service-accounts list --project="$PROJECT_ID" --format="value(email)" | while read -r SA; do
    KEYS=$(gcloud iam service-accounts keys list \
        --iam-account="$SA" \
        --managed-by=user \
        --format="value(name)" 2>/dev/null || true)
    if [ -n "$KEYS" ]; then
        echo "  [!] $SA has user-managed keys:" | tee -a "$REPORT"
        echo "$KEYS" | tee -a "$REPORT"
    fi
done

# --- 2. Audit: Overly permissive IAM bindings ---
echo -e "\n[2] Overly Permissive IAM Bindings (roles/owner, roles/editor)" | tee -a "$REPORT"
gcloud projects get-iam-policy "$PROJECT_ID" \
    --flatten="bindings[].members" \
    --filter="bindings.role:roles/owner OR bindings.role:roles/editor" \
    --format="table(bindings.role, bindings.members)" | tee -a "$REPORT"

# --- 3. Audit: Service accounts with overly broad roles ---
echo -e "\n[3] Service Accounts with Broad Roles (roles/editor or roles/owner)" | tee -a "$REPORT"
gcloud projects get-iam-policy "$PROJECT_ID" \
    --flatten="bindings[].members" \
    --filter="bindings.members:serviceAccount AND (bindings.role:roles/owner OR bindings.role:roles/editor)" \
    --format="table(bindings.role, bindings.members)" | tee -a "$REPORT"

# --- 4. Audit: Publicly accessible GCS buckets (potential AI artifact exposure) ---
echo -e "\n[4] Publicly Accessible Storage Buckets (AI/ML Data Exposure Risk)" | tee -a "$REPORT"
gcloud storage buckets list --project="$PROJECT_ID" --format="value(name)" | while read -r BUCKET; do
    IAM=$(gcloud storage buckets get-iam-policy "gs://$BUCKET" 2>/dev/null || true)
    if echo "$IAM" | grep -q "allUsers\|allAuthenticatedUsers"; then
        echo "  [CRITICAL] gs://$BUCKET is publicly accessible" | tee -a "$REPORT"
    fi
done

# --- 5. Audit: Check if Uniform Bucket-Level Access is enabled ---
echo -e "\n[5] Buckets Without Uniform Bucket-Level Access (Legacy ACL Risk)" | tee -a "$REPORT"
gcloud storage buckets list --project="$PROJECT_ID" \
    --format="value(name,uniform_bucket_level_access_enabled)" | while read -r BUCKET UBLA; do
    if [ "$UBLA" != "True" ]; then
        echo "  [WARNING] gs://$BUCKET does not have uniform bucket-level access enabled" | tee -a "$REPORT"
    fi
done

# --- 6. Remediation: Enable Uniform Bucket-Level Access on all buckets ---
echo -e "\n[6] Remediation: Enabling Uniform Bucket-Level Access" | tee -a "$REPORT"
read -p "Apply uniform bucket-level access to all buckets? (yes/no): " CONFIRM
if [ "$CONFIRM" = "yes" ]; then
    gcloud storage buckets list --project="$PROJECT_ID" --format="value(name)" | while read -r BUCKET; do
        gcloud storage buckets update "gs://$BUCKET" --uniform-bucket-level-access 2>/dev/null && \
            echo "  [OK] Enabled UBLA on gs://$BUCKET" | tee -a "$REPORT" || \
            echo "  [FAIL] Could not update gs://$BUCKET" | tee -a "$REPORT"
    done
fi

# --- 7. Audit: Check for Workload Identity usage in GKE (recommended over SA keys) ---
echo -e "\n[7] GKE Clusters Without Workload Identity" | tee -a "$REPORT"
gcloud container clusters list --project="$PROJECT_ID" \
    --format="value(name,workloadIdentityConfig.workloadPool)" 2>/dev/null | while read -r CLUSTER WI; do
    if [ -z "$WI" ]; then
        echo "  [WARNING] Cluster $CLUSTER does not have Workload Identity enabled" | tee -a "$REPORT"
    fi
done

echo -e "\n=== Audit Complete. Report saved to $REPORT ==="