gcp-scc-disable-service

Principal with securitycenter.settings.update can disable SCC detection services at org or project scope, permanently stopping finding generation for the disabled services.

derived gcp emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'scc': None}

where

node_type(?scc) == SecurityService ?scc.provider_type in ['google.securitycenter.OrganizationSettings', 'google.securitycenter.ProjectSettings'] ?principal has EFFECTIVE securitycenter.settings.update at the scope of ?scc (via IAM allow policy at org, folder, or project)

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?scc`
permissions	`securitycenter.settings.update`
conditions	`iam_permission`
state logic	ACTIVE when ?principal holds effective securitycenter.settings.update at ?scc.scope (via roles/securitycenter.admin, roles/securitycenter.adminEditor, or a custom role containing the permission). BLOCKED if an IAM deny policy or org policy explicitly denies securitycenter.settings.update at ?scc.scope. Org-scoped SCC settings (OrganizationSettings) require the binding at the org node; project-scoped settings (ProjectSettings) require the binding at or above the project. Do not emit BLOCKED merely because SCC services are currently ENABLED — BLOCKED is for IAM/policy guardrails, not the current service state.

Narrative

{principal.name} holds securitycenter.settings.update at {scc.scope} and can call UpdateOrganizationSettings / UpdateProjectSettings to disable SCC detection services (Event Threat Detection, VM Threat Detection, Container Threat Detection) for {scc.scope}. Disabling a service permanently stops finding generation for that service until explicitly re-enabled, creating a persistent detection blind spot. This is a cover-tracks primitive - it reduces detection probability; it does not grant access to resources or credentials.

Raw rule rules/derived/gcp/scc.yaml

id: gcp-scc-disable-service
emits: CanModifyConfiguration
description: Principal with securitycenter.settings.update can disable SCC detection services at org or
  project scope, permanently stopping finding generation for the disabled services.
match:
- - principal: null
  - HasPermission
  - scc: null
where:
- node_type(?scc) == SecurityService
- ?scc.provider_type in ['google.securitycenter.OrganizationSettings', 'google.securitycenter.ProjectSettings']
- ?principal has EFFECTIVE securitycenter.settings.update at the scope of ?scc (via IAM allow policy at
  org, folder, or project)
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?scc
  permissions:
  - securitycenter.settings.update
  conditions:
  - iam_permission
  state_logic: "ACTIVE when ?principal holds effective securitycenter.settings.update at ?scc.scope (via\
    \ roles/securitycenter.admin, roles/securitycenter.adminEditor, or a custom role containing the permission).\
    \ BLOCKED if an IAM deny policy or org policy explicitly denies securitycenter.settings.update at\
    \ ?scc.scope. Org-scoped SCC settings (OrganizationSettings) require the binding at the org node;\
    \ project-scoped settings (ProjectSettings) require the binding at or above the project. Do not emit\
    \ BLOCKED merely because SCC services are currently ENABLED \u2014 BLOCKED is for IAM/policy guardrails,\
    \ not the current service state."
  confidence: 0.95
  derived_from:
  - HasPermission(?principal, securitycenter.settings.update, ?scc)
  false_positive_note: "This is DEFENSE EVASION only \u2014 disabling SCC services stops detection but\
    \ does NOT grant access to any resource, credential, or identity. Do NOT chain to CanExecuteAs, CanEnterProject,\
    \ CanEnterOrganization, or CanEscalateTo. Detective controls do not set BLOCKED state on capability\
    \ edges. securitycenter.settings.update can disable individual services (ETD, VMTD, CTD) without disabling\
    \ SCC globally; the narrative should not claim \"SCC is disabled\" unless the API call sets the top-level\
    \ enable flag. Scope the edge to the SCC node the effective permission actually reaches: an org-scoped\
    \ binding creates CanModifyConfiguration on the OrganizationSettings node; a project-scoped binding\
    \ creates it on that ProjectSettings node only. A VPC Service Controls perimeter denying securitycenter.googleapis.com\
    \ is a BLOCKED guardrail."
  narrative: "{principal.name} holds securitycenter.settings.update at {scc.scope} and can call UpdateOrganizationSettings\
    \ / UpdateProjectSettings to disable SCC detection services (Event Threat Detection, VM Threat Detection,\
    \ Container Threat Detection) for {scc.scope}. Disabling a service permanently stops finding generation\
    \ for that service until explicitly re-enabled, creating a persistent detection blind spot. This is\
    \ a cover-tracks primitive \u2014 it reduces detection probability; it does not grant access to resources\
    \ or credentials."