On July 23, 2024, an alert was triggered when Emily Eaton, identified by her email emily.eaton@thisisarealcompany.com and serving as VP of Information Technology, assigned the roles/owner admin privileges to Noah Nichols at noah.nichols@thisisarealcompany.com within the GCP environment of project integration-419004. The assignment occurred at 19:16:41 UTC, with the alert following at 19:23:16 UTC. The IP address used by Emily Eaton during this assignment was 256.212.1.10, which is associated with Amazon.com, Inc. and located in Boardman, Oregon, United States. This IP address does not match her typical usage from a Comcast Cable Communications IP in Bellevue, Washington.
Noah Nichols, whose job title is "Marketing Operations Specialist," does not typically require admin privileges, raising concerns about the appropriateness of this privilege escalation. Following the assignment, Noah attempted to create instances within the same project, specifically instance-20240723-192605 and instance-20240723-193102, but encountered errors. These activities, combined with the unusual IP address used for the admin role assignment, suggest a potential security issue within the GCP project.
- Emily Eaton's job title is
VP of Information Technologywithin theInformation Technology department. - It is typical for a
VP of Information Technologyto have the authority to assign administrative roles in Google Workspace.
- The GCP principal
emily.eaton@thisisarealcompany.comis a user account. - The distinct IP address used by Emily Eaton from June 23, 2024, to July 22, 2024, was
256.165.237.116. - The IP address
256.165.237.116is located in Bellevue, Washington, US, owned by Comcast Cable Communications, LLC, and is a residential broadband service IP. - Emily Eaton's activities in the GCP environment between June 23, 2024, and July 22, 2024, included using the
SearchProjectsmethod onprojects/integration-419004, initiating thev1.compute.instances.startmethod onprojects/integration-419004/zones/us-central1-a/instances/instance-20240719-165508, and modifying metadata with thev1.compute.instances.setMetadatamethod on the same instance.
- The IP address
256.212.1.10is associated with the Autonomous System Number (ASN)AS16509, owned byAmazon.com, Inc. - The geographical location of
256.212.1.10is Boardman, Oregon, United States. - This IP is classified as benign, likely used for hosting or cloud services, and has a neutral reputation score of
0on VirusTotal. - There are no suspicious or malicious activities linked to
256.212.1.10.
- The IP address
256.212.1.10is associated with ASNAS16509, owned by Amazon.com, Inc., and is geolocated in Boardman, Oregon, US. - The principal
emily.eaton@thisisarealcompany.comdid not use the IP address256.212.1.10from one month before the alert creation time until one hour before the alert creation time, as per GCP logs queried through Panther SIEM. - No other GCP principals have been associated with the IP address
256.212.1.10during the specified timeframe, according to Panther SIEM.
- The job title of
noah.nichols@thisisarealcompany.comis"Marketing Operations Specialist"within the Marketing department. - Typically, the job title
"Marketing Operations Specialist"does not require admin privileges in the organization.
- The GCP principal
noah.nichols@thisisarealcompany.comis identified as a Google Account, which is a type of user account in Google Cloud Platform (GCP). - There were no distinct IP addresses or logs found for
noah.nichols@thisisarealcompany.comfrom June 23, 2024, to July 22, 2024, indicating a lack of available data for this period. - No actions were recorded for
noah.nichols@thisisarealcompany.comin GCP from June 23, 2024, to July 22, 2024, suggesting no activities were logged for this user during the specified period.
noah.nichols@thisisarealcompany.comattempted to insert instances in theintegration-419004project, specificallyinstance-20240723-192605andinstance-20240723-193102in theus-central1-bzone. Errors were encountered during these attempts, including anERRORdue toEXTERNAL_RESOURCE_NOT_FOUND.- No network configuration changes, including firewall rule modifications or VPN setups, were made by
noah.nichols@thisisarealcompany.comin GCP. noah.nichols@thisisarealcompany.comcreated VM instancesinstance-20240723-192605andinstance-20240723-193102along with associated disks, established a service accountsplunk-admin, and set critical IAM policies granting administrative roles.- Unusual activities included failed attempts to create compute instances and actions from geographically distant IP addresses
2603:7000:aaf0:7b50:6498:581f:3ea0:c701and256.212.1.10, along with service account creation and IAM policy settings.
The user 'noah.nichols@thisisarealcompany.com' exhibited several unusual activities in GCP between July 23, 2024, 19:16:41 UTC and the current time, including failed attempts to create compute instances at timestamps 2024-07-23 19:27:06.934 and 2024-07-23 19:57:09.083, and activities from two geographically distant IP addresses 2603:7000:aaf0:7b50:6498:581f:3ea0:c701 and 256.212.1.10. Additionally, there were actions involving service account creation and IAM policy settings, which are suspicious and could potentially indicate a compromised account if they deviate from the user's typical behavior. Further investigation is recommended to confirm any suspicious activity.