gcp-scc-read-findings-and-assets

id: gcp-scc-read-findings-and-assets
emits: CanRead
description: Principal with both securitycenter.findings.list and securitycenter.assets.list can enumerate
  all SCC findings and the full GCP asset inventory, providing complete org-wide resource reconnaissance.
match:
- - principal: null
  - HasPermission
  - scc: null
where:
- node_type(?scc) == SecurityService
- ?scc.provider_type in ['google.securitycenter.OrganizationSettings', 'google.securitycenter.ProjectSettings']
- ?principal has EFFECTIVE securitycenter.findings.list AND securitycenter.assets.list at the scope of
  ?scc
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?scc
  permissions:
  - securitycenter.findings.list
  - securitycenter.assets.list
  conditions:
  - iam_permission
  state_logic: ACTIVE when ?principal holds both securitycenter.findings.list and securitycenter.assets.list
    at ?scc.scope (both are required for full recon). BLOCKED if an IAM deny policy or VPC-SC perimeter
    denies either action. Confidence 0.75 reflects that combined read access is low direct attack value
    without a subsequent exploitation step, but higher than findings-only.
  confidence: 0.75
  derived_from:
  - HasPermission(?principal, securitycenter.findings.list, ?scc)
  - HasPermission(?principal, securitycenter.assets.list, ?scc)
  false_positive_note: "Read access to SCC findings and full asset inventory is low direct attack value\
    \ on its own \u2014 it provides complete reconnaissance but does not suppress findings or grant access.\
    \ Many legitimate roles (SOC analysts, security engineers, audit accounts) hold this permission. Confidence\
    \ is 0.75. SCC findings do NOT contain credentials or secret material; do NOT emit ContainsSecret\
    \ or CanReadSecret for SCC finding content. Findings may point to a misconfigured resource (e.g.,\
    \ a public GCS bucket), but that is a recon pointer, not a credential in the SCC payload itself. This\
    \ is RECON-only; do NOT chain to CanExecuteAs, CanEnterProject, or CanEscalateTo."
  narrative: '{principal.name} can list SCC findings and the full GCP asset inventory at {scc.scope} (securitycenter.findings.list
    + securitycenter.assets.list). This reveals the complete asset graph and all misconfigured resources
    across all projects in scope (e.g., PUBLIC_BUCKET_ACL, OPEN_FIREWALL, SERVICE_ACCOUNT_KEY_CREATED
    findings) without requiring direct read access to those resources. This reconnaissance capability
    provides a complete attack surface map for lateral movement planning.'