Service account was deleted from a compute engine service account
Suspicious activity
Service account was deleted from a compute engine service account
Risk Level
Informational (4)
Platform(s)
N/A
Description
Orca detected that an API call to delete service account was made from a compute engine service account, the operation was successful. This action may indicate of a presence of an unauthorized actor in the cloud environment trying to clean the persistence mechanism in the cloud account, since this kind of action is not usually performed from internal service account.
Recommended Mitigation
It is recommended to review the permissions which were used to make this api call. In addition, review the actions of the deleted service account.