compute.disks.setIamPolicy

CSP: GCP

Tactics:

Privilege Escalation Persistence

Techniques:

T1098

Tags:

GCP Compute Engine

Event

Sets the IAM policy on a Compute Engine persistent disk, controlling which principals have access to it.

Security Context

• Adversaries attach overly permissive policies to maintain persistent, elevated access even after initial credentials are rotated.

Log Source

Cloud Audit Logs

Sample Event

MITRE ATT&CK Mapping

Tactics: Privilege Escalation Persistence

Techniques:

• T1098 — Account Manipulation — Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.