SetIamPolicy was called 847 times in this window vs. a baseline of 3–4/day. A single service account granted Owner access to 12 production projects between 02:00–03:15 UTC. This pattern is consistent with privilege escalation following initial account compromise.
91
#2CriticalFirst seen
httpRequest.remoteIp→185.220.101.47
Source IP is a known Tor exit node (Proofpoint threat intel dataset). First appearance in 90-day log history. All 23 API calls from this IP succeeded, notably no PERMISSION_DENIED responses, suggesting valid credentials.
76
#3High
protoPayload.status.code→PERMISSION_DENIED
PERMISSION_DENIED errors spiked to 340 in 15 minutes, 98× the daily average of 3.5. This pattern (dense access failures followed by successful escalation) is consistent with automated credential or permission scanning before a pivot.
This service account has a 90-day history of read-only storage operations (GetObject, ListBucket). Executing SetIamPolicy and CreateServiceAccountKey is completely outside its behavioral baseline. The account is likely compromised.
A long-lived service account key was created for pipeline-sa. SA keys are a common persistence mechanism. Once created, an attacker retains access even after password rotation. This was created minutes after the first SetIamPolicy calls.
44
#6Medium
resource.labels.project_id→acme-prod-dr-backup
The disaster-recovery backup project received 34 API calls in this window, unusually high for a project that typically sees 0–2 calls/day. Combined with the escalation activity in the main project, this may indicate lateral movement.
This analysis reveals a coordinated privilege escalation sequence. A service account (pipeline-sa) with historically read-only behavior executed 847 SetIamPolicy calls, 211× its baseline, and successfully granted Owner access to 12 production projects. The activity originated from a Tor exit node with no prior history in 90 days of logs. The simultaneous PERMISSION_DENIED spike suggests a scanning phase before the privilege escalation. Immediate investigation and credential rotation recommended.
Flare Intelligence
Ask Flare about these findings. It has full context from the analysis.