Clankerusecase
GCP detection coverage
 ← Back to main site
Home/ Targets/ GCP

☁GCP detections

Clankerusecase tracks 11 detection use cases covering the GCP attack surface across 10 MITRE ATT&CK techniques.

Detections targeting Google Cloud Platform — Cloud Audit Logs, IAM, Compute, GKE.

Open Detection Library → View on the matrix
11Use cases
10Techniques
1Articles
3Kill-chain phases

Top techniques on GCP (10)

T1098Account Manipulation4T1562.008T1562.0082T1136.003Cloud Account1T1552Unsecured Credentials1T1530Data from Cloud Storage1T1078Valid Accounts1T1526Cloud Service Discovery1T1567.002Exfiltration to Cloud Storage1T1059.004Unix Shell1T1552.001Credentials In Files1

Installation (6)

GCP project external principal added as owner Internal install · alerting DD GCP Compute Engine firewall rule modified Internal install · alerting DD GCP custom IAM role created Internal install · alerting DD GCP Cloud Logging bucket deleted Internal install · alerting DD GCP Cloud Logging sink modified Internal install · alerting DD GCP Cloud Storage bucket permissions modified Internal install · alerting DD

Command & Control (1)

[LLM] Exfiltration to kubernetes-el attacker webhook.site UUIDs (Pwn Request payload) Bespoke c2 · alerting DSΣPDD

Actions on Objectives (4)

GCP service-account key created Internal actions · alerting DD Detect New Open GCP Storage Buckets ESCU actions · alerting P gcp detect oauth token abuse ESCU actions · hunting P GCP Kubernetes cluster scan detection ESCU actions · alerting P

Recent articles citing GCP-targeted detections

high kubernetes-el Compromised: How a Pwn Request Exploited a Popular Emacs Package