Suspicious activity

Service account was deleted from a compute engine service account

Platform(s)

  • N/A

Description

Orca detected that an API call to delete service account was made from a compute engine service account, the operation was successful. This action may indicate of a presence of an unauthorized actor in the cloud environment trying to clean the persistence mechanism in the cloud account, since this kind of action is not usually performed from internal service account.
Need help?

Get a free Security Risk Assessment. Start today

Orca Security Demo Demo the Orca Platform-> In just 10 minutes, you’ll see how Orca Security can revolutionize your cloud security strategy. Watch a recorded demo from a cloud security expert now.