2026 Critical Cloud Control Plane Detection - GCP Service Account Impersonation Chain Abuse
Detects anomalous GCP IAM Service Account Credential API calls where a principal impersonates multiple distinct service accounts within a short time window. This behavior often indicates a credential delegation chain or a multi-stage privilege escalation attempt within a GCP environment.
YARA-L
