Skip to content
attack.paths
Sign in
← RegistryDossier · 6 steps · 5 edges

GCP service account impersonation chain → project owner

Compromised low-priv SA has iam.serviceAccounts.getAccessToken on an intermediate SA; hop through 2-3 impersonations until you reach a project Owner.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target uses GCP with several service accounts and 'impersonation' permissions granted transitively (common pattern when teams mirror AWS role-assumption).

§ Steps

  1. 01
    Foothold SA credentialsInitial Access
    T1078— Valid Accounts
  2. 02
    Enumerate impersonation graphDiscovery
    T1087— Account Discovery
  3. 03
    Impersonate higher-priv SAPrivilege Escalation
    C-GCP-SA-IMPERSONATE— GCP Service Account Impersonation
  4. 04
    Impersonate intermediate SAPrivilege Escalation
    C-GCP-SA-IMPERSONATE— GCP Service Account Impersonation
  5. 05
    Create a long-lived JSON key on the Owner SAPrivilege Escalation
    C-GCP-SA-KEY-CREATE— GCP iam.serviceAccountKeys.create
  6. 06
    Backdoor low-noise SA for re-entryPersistence
    C-GCP-IAM-BACKDOOR— GCP Service Account Backdoor Key

§ References

§ Frequently asked

What is the "GCP service account impersonation chain → project owner" attack path?
Compromised low-priv SA has iam.serviceAccounts.getAccessToken on an intermediate SA; hop through 2-3 impersonations until you reach a project Owner. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Foothold SA credentials (T1078) — a initial access primitive. Assumed environment: target uses GCP with several service accounts and 'impersonation' permissions granted transitively (common pattern when teams mirror AWS role-assumption).
What is the final impact of this kill-chain?
The final step lands on Backdoor low-noise SA for re-entry (C-GCP-IAM-BACKDOOR), which falls under Persistence. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers