Detection rules for Google Cloud Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 34 detection rules.

Rule Example

Below is an example of a rule definition for Anthos Security Policy Violations (view in repository):

# Rule version v1.0.0

dataTypes:
  - google
name: Anthos Security Policy Violations
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Security Control Bypass
technique: "T1562 - Impair Defenses"
adversary: origin
references:
  - https://cloud.google.com/anthos/docs/concepts/overview
  - https://attack.mitre.org/techniques/T1562/
description: |
  Detects security-related events in Google Anthos environments including policy violations, authentication failures, and suspicious container activities. Monitors Anthos Service Mesh, Config Management, and Policy Controller events.
  
  Next Steps:
  - Review the specific policy violation details in the event logs
  - Verify if the violation was authorized or represents a legitimate security concern
  - Check the source IP and user account associated with the violation
  - Examine recent configuration changes to Anthos security policies
  - Validate that security controls are properly configured and enforced
  - Consider implementing additional monitoring for the affected resources
where: |
  (
    oneOf("log.protoPayload.serviceName", ["anthos.googleapis.com", "anthospolicycontroller.googleapis.com", "anthosservicemesh.googleapis.com"]) ||
    oneOf("log.resourceType", ["k8s_cluster", "gke_cluster"])
  ) && 
  (
    contains("log.protoPayload.methodName", "Policy") ||
    oneOf("log.jsonPayload.type", ["admission.k8s.io/violation", "policy.violation", "security.alert"]) ||
    oneOf("log.severity", ["ERROR", "WARNING"])
  ) &&
  (
    equals("log.protoPayload.response.status", "PERMISSION_DENIED") ||
    contains("log.protoPayload.status.message", "violation") ||
    contains("log.protoPayload.status.message", "denied") ||
    contains("log.jsonPayload.details", "policy")
  )
groupBy:
  - lastEvent.log.protoPayload.resourceName
  - lastEvent.log.resource.labels.project_id

Rule Details

Anthos Security Policy Violations

Identifies security events across Google Anthos environments, such as policy breaches, failed authentication, and unusual container behavior. Tracks events from Anthos Service Mesh, Config Management, and Policy Controller.

• Category: Security Control Bypass

• Technique: T1562 - Impair Defenses

• Impact: C:3 / I:3 / A:2

• Rule file: anthos_security_events.yml

• Reference: https://cloud.google.com/anthos/docs/concepts/overview

• Reference: https://attack.mitre.org/techniques/T1562/

Binary Authorization Bypass Detection

Identifies efforts to circumvent Binary Authorization controls, such as breakglass deployments, policy breaches, and unapproved container deployments. Such events may signal attempts to deploy untrusted or malicious container images.

• Category: Defense Evasion

• Technique: T1553 - Subvert Trust Controls

• Impact: C:3 / I:3 / A:2

• Rule file: binary_authorization_bypasses.yml

• Reference: https://cloud.google.com/binary-authorization/docs/audit-logging

• Reference: https://cloud.google.com/binary-authorization/docs/run/using-breakglass-cloud-run

• Reference: https://attack.mitre.org/techniques/T1553/

Cloud Identity Suspicious Sign-ins Detection

Identifies suspicious login attempts to Google Cloud Identity, such as sign-ins from unknown locations, atypical IP addresses, or following repeated failures. These may point to compromised credentials or unauthorized access efforts.

• Category: Initial Access

• Technique: T1078 - Valid Accounts

• Impact: C:3 / I:2 / A:1

• Rule file: cloud_identity_suspicious_signins.yml

• Reference: https://support.google.com/cloudidentity/answer/4580120?hl=en

• Reference: https://cloud.google.com/blog/products/identity-security/logs-based-security-alerting-in-google-cloud

• Reference: https://attack.mitre.org/techniques/T1078/

GCP 2-step verification disabled

Google Cloud has detected that 2-step verification was disabled for the organization or a user

• Category: Defense Evasion

• Technique: T1562 - Impair Defenses

• Impact: C:1 / I:2 / A:3

• Rule file: gcp_two_step_verification_disabled.yml

• Reference: https://attack.mitre.org/tactics/TA0005

• Reference: https://attack.mitre.org/techniques/T1562/

GCP Audit Log Disabling or Tampering

Identifies efforts to turn off GCP audit logging, such as deleting sinks, creating log exclusion filters, and changing audit configurations. Attackers may tamper with logging infrastructure to conceal their actions from security monitoring.

• Category: Defense Evasion

• Technique: T1562.008 - Impair Defenses: Disable Cloud Logs

• Impact: C:3 / I:3 / A:2

• Rule file: gcp_audit_log_disabling.yml

• Reference: https://cloud.google.com/logging/docs/audit

• Reference: https://attack.mitre.org/techniques/T1562/008/

GCP BigQuery Data Exfiltration Detection

Identifies BigQuery activities that may signal data exfiltration, such as large exports, table copies to outside projects, and extract jobs writing to external storage. Attackers may leverage BigQuery to query and export large datasets from compromised projects.

• Category: Data Exfiltration

• Technique: T1567 - Exfiltration Over Web Service

• Impact: C:3 / I:1 / A:1

• Rule file: gcp_bigquery_exfiltration.yml

• Reference: https://cloud.google.com/bigquery/docs/audit-logging

• Reference: https://attack.mitre.org/techniques/T1567/

GCP Break-Glass Container Workload Deployed

Identifies container workload deployments that use the break-glass mechanism to circumvent Binary Authorization policy. Although valid in emergencies, this bypasses security controls and may be exploited to deploy malicious or untrusted container images.

• Category: Defense Evasion

• Technique: T1548 - Abuse Elevation Control Mechanism

• Impact: C:3 / I:3 / A:2

• Rule file: gcp_breakglass_container_deploy.yml

• Reference: https://cloud.google.com/binary-authorization/docs/using-breakglass

• Reference: https://attack.mitre.org/techniques/T1548/

GCP Cloud Function and Cloud Run Abuse

Identifies the creation or alteration of Cloud Functions and Cloud Run services, which may be used for persistence, backdoor access, or command execution. Attackers may deploy serverless functions with high-privilege service accounts to retain access or exfiltrate data.

• Category: Persistence

• Technique: T1059 - Command and Scripting Interpreter

• Impact: C:2 / I:2 / A:1

• Rule file: gcp_cloud_function_abuse.yml

• Reference: https://cloud.google.com/functions/docs/securing

• Reference: https://attack.mitre.org/techniques/T1059/

GCP Cloud Storage Data Exfiltration

Detects activity in GCP Cloud Storage that could point to data exfiltration, including making buckets publicly accessible, changing IAM policies so allUsers has access, or downloading objects in bulk. Such behavior may indicate an attacker is trying to exfiltrate data from cloud storage.

• Category: Data Exfiltration

• Technique: T1530 - Data from Cloud Storage Object

• Impact: C:3 / I:1 / A:1

• Rule file: gcp_storage_exfiltration.yml

• Reference: https://cloud.google.com/storage/docs/access-control

• Reference: https://attack.mitre.org/techniques/T1530/

GCP Cryptomining Instance Launch Detection

Identifies the creation of GPU-accelerated or high-compute GCP instances often used for cryptomining. Attackers with compromised GCP credentials frequently launch costly GPU instances (a2, g2) or compute-optimized instances in unusual regions for cryptocurrency mining.

• Category: Resource Hijacking

• Technique: T1496 - Resource Hijacking

• Impact: C:1 / I:2 / A:3

• Rule file: gcp_cryptomining_detection.yml

• Reference: https://cloud.google.com/compute/docs/machine-types

• Reference: https://attack.mitre.org/techniques/T1496/

GCP Custom Role with Overly Permissive Permissions

Identifies the creation or modification of GCP custom IAM roles that may contain overly permissive permissions for privilege escalation. Attackers may create custom roles with broad permissions such as iam.serviceAccountKeys.create, iam.serviceAccounts.actAs, or compute.instances.setMetadata to escalate privileges.

• Category: Privilege Escalation

• Technique: T1098 - Account Manipulation

• Impact: C:3 / I:3 / A:1

• Rule file: gcp_custom_role_creation.yml

• Reference: https://cloud.google.com/iam/docs/creating-custom-roles

• Reference: https://attack.mitre.org/techniques/T1098/

GCP DLP Re-Identification API Call

Detects requests to the DLP re-identification API, which undoes data de-identification. This sensitive action can reveal PII, financial data, or health records that were previously protected. Use without authorization may indicate possible data exfiltration efforts.

• Category: Collection

• Technique: T1565 - Data Manipulation

• Impact: C:3 / I:2 / A:0

• Rule file: gcp_dlp_reidentification.yml

• Reference: https://cloud.google.com/dlp/docs/reference/rest/v2/projects.content/reidentify

• Reference: https://attack.mitre.org/techniques/T1565/

GCP Domain-Wide API Access Granted

Identifies when domain-wide delegation is granted to a service account in Google Workspace. This permits the service account to impersonate any user in the domain and access their data, making it a high-impact privilege escalation vector.

• Category: Privilege Escalation

• Technique: T1098 - Account Manipulation

• Impact: C:3 / I:3 / A:2

• Rule file: gcp_domain_api_access_granted.yml

• Reference: https://cloud.google.com/iam/docs/using-iam-securely

• Reference: https://attack.mitre.org/techniques/T1098/

GCP KMS Key Destruction or Disabling

Identifies the destruction or disabling of Cloud KMS key versions, which could render encrypted data unrecoverable. Attackers may destroy encryption keys as part of a destructive attack to prevent data recovery or disrupt operations that depend on encrypted resources.

• Category: Impact

• Technique: T1552 - Unsecured Credentials

• Impact: C:1 / I:3 / A:3

• Rule file: gcp_kms_key_modifications.yml

• Reference: https://cloud.google.com/kms/docs/destroy-restore

• Reference: https://attack.mitre.org/techniques/T1552/

GCP Network Packet Capture Configuration

Identifies the creation or modification of Packet Mirroring configurations in GCP. Attackers leverage packet mirroring to capture network traffic for credential theft, data exfiltration, or reconnaissance.

• Category: Credential Access

• Technique: T1040 - Network Sniffing

• Impact: C:3 / I:1 / A:1

• Rule file: gcp_packet_capture_abuse.yml

• Reference: https://cloud.google.com/vpc/docs/packet-mirroring

• Reference: https://attack.mitre.org/techniques/T1040/

GCP Project Manipulation and Shadow Projects

Identifies GCP project creation, deletion, and undelete operations that may point to shadow project creation for persistence or project deletion for impact. Attackers may establish new projects outside organizational controls to host malicious workloads.

• Category: Account Manipulation

• Technique: T1578 - Modify Cloud Compute Infrastructure

• Impact: C:2 / I:3 / A:3

• Rule file: gcp_project_manipulation.yml

• Reference: https://cloud.google.com/resource-manager/docs/creating-managing-projects

• Reference: https://attack.mitre.org/techniques/T1578/

GCP Secret Manager Bulk Access Detection

Detects large-scale access to secrets in GCP Secret Manager, which can suggest credential harvesting. An attacker with access to a GCP project might list and pull every stored secret to collect API keys, database credentials, and other sensitive information.

• Category: Credential Access

• Technique: T1552 - Unsecured Credentials

• Impact: C:3 / I:1 / A:1

• Rule file: gcp_secret_manager_access.yml

• Reference: https://cloud.google.com/secret-manager/docs/audit-logging

• Reference: https://attack.mitre.org/techniques/T1552/

GCP Service Account Impersonation Detection

Detects service account impersonation via token generation APIs such as GenerateAccessToken, GenerateIdToken, and SignBlob. Attackers can impersonate service accounts to raise their privileges or reach resources assigned to that service account.

• Category: Credential Access

• Technique: T1550.001 - Use Alternate Authentication Material: Application Access Token

• Impact: C:3 / I:3 / A:1

• Rule file: gcp_service_account_impersonation.yml

• Reference: https://cloud.google.com/iam/docs/create-short-lived-credentials-direct

• Reference: https://attack.mitre.org/techniques/T1550/001/

GCP Workload Identity Federation Abuse

Detects when workload identity pools and providers are created or changed to allow external identities to reach GCP resources. Attackers might set up workload identity configurations that give access to identity providers they control, enabling long-term cloud access.

• Category: Credential Access

• Technique: T1078 - Valid Accounts

• Impact: C:3 / I:3 / A:1

• Rule file: gcp_workload_identity_abuse.yml

• Reference: https://cloud.google.com/iam/docs/workload-identity-federation

• Reference: https://attack.mitre.org/techniques/T1078/

GCP account is probably used for spamming

A user's account was disabled after Google learned that it had been used for spamming. Typically, spamming is used to carry out other attacks such as phishing or spreading malware.

• Category: Initial Access

• Technique: T1566 - Phishing

• Impact: C:1 / I:2 / A:3

• Rule file: gcp_account_disabled_spamming.yml

• Reference: https://attack.mitre.org/tactics/TA0001

• Reference: https://attack.mitre.org/techniques/T1566/

GCP detected account with password leak

A user's account was disabled after google detected a password leak.

• Category: Initial Access

• Technique: T1078 - Valid Accounts

• Impact: C:3 / I:3 / A:2

• Rule file: gcp_account_disabled_password_leak.yml

• Reference: https://attack.mitre.org/tactics/TA0001/

• Reference: https://attack.mitre.org/techniques/T1078

GCP probable Defense Evasion, Logging Sink Deletion

Defense Evasion covers methods adversaries employ to remain undetected during a compromise. Such techniques include removing or turning off security tools, as well as making data and scripts unclear or encrypted. Adversaries also take advantage of trusted processes to conceal and disguise their malware. Additional tactics appear here when they offer the extra advantage of undermining defenses. This identifies deletion of a Logging sink in Google Cloud Platform (GCP). Whenever a log entry is received, Logging checks it against the sinks for that resource. Any sink with a matching filter sends a copy of the log entry to its export destination. An adversary might remove a Logging sink to avoid detection.

• Category: Defense Evasion

• Technique: T1562 - Impair Defenses

• Impact: C:1 / I:2 / A:3

• Rule file: gcp_defense_evasion_logging_sink_deletion.yml

• Reference: https://cloud.google.com/logging/docs/export

• Reference: https://attack.mitre.org/techniques/T1562/

• Reference: https://attack.mitre.org/tactics/TA0005/

GCP probable Exfiltration, Logging Sink Modification

Exfiltration covers methods adversaries might use to take data from your network. After collecting data, adversaries frequently bundle it to avoid detection while extracting it. This may involve compression and encryption. Methods for moving data out of a target network usually involve sending it over their command and control channel or another channel, and can also involve limiting transmission size. This identifies a change to a Logging sink in Google Cloud Platform (GCP). Logging evaluates the log entry against the sinks in that resource. Any sink with a matching filter writes a copy of the log entry to its export destination. An adversary might modify a Logging sink to exfiltrate logs to another export destination.

• Category: Exfiltration

• Technique: T1537 - Transfer Data to Cloud Account

• Impact: C:3 / I:2 / A:2

• Rule file: gcp_exfiltration_logging_sink_modification.yml

• Reference: https://cloud.google.com/logging/docs/export#how_sinks_work

• Reference: https://cloud.google.com/logging/docs/reference/v2/rest/v2/projects.sinks#LogSink

• Reference: https://attack.mitre.org/techniques/T1537/

• Reference: https://attack.mitre.org/tactics/TA0010/

GCP probable Government-backed attack

An account belonging to one of your users may have been targeted by a government-backed attack. Attackers backed by a government are trying to reach the account of one of your users. Fewer than 0.1% of all Google Account users experience such an attack. The alert may be a false alarm. Even so, we believe we have detected activity that government-backed attackers use in attempts to steal passwords or other personal information. This activity includes the user receiving an email with a harmful attachment, links to malicious software downloads, or links to fake websites designed to obtain passwords.

• Category: Collection

• Technique: T1560 - Archive Collected Data

• Impact: C:3 / I:3 / A:2

• Rule file: gcp_gov_attack.yml

• Reference: https://attack.mitre.org/tactics/TA0009/

• Reference: https://attack.mitre.org/techniques/T1560

GCP probable Impact, Storage Bucket Deleted

Impact covers methods adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes. Techniques for impact can involve destroying or altering data. At times, business processes may appear normal but could have been changed to serve the adversaries' goals. Adversaries might use these techniques to achieve their final objective or to cover a confidentiality breach. This identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket to disrupt their target's business operations.

• Category: Impact

• Technique: T1485 - Data Destruction

• Impact: C:1 / I:2 / A:3

• Rule file: gcp_impact_storage_bucket_deleted.yml

• Reference: https://cloud.google.com/logging/docs/buckets

• Reference: https://attack.mitre.org/tactics/TA0040/

• Reference: https://attack.mitre.org/techniques/T1485/

GCP probable Password Guessing

Adversaries who lack prior knowledge of valid credentials in a system or environment might guess passwords in an effort to access accounts. With no knowledge of an account's password, an adversary may choose to guess it systematically through a repetitive or iterative process. During an operation, an adversary may guess login credentials without prior knowledge of system or environment passwords by drawing on a list of common passwords. Password guessing might or might not consider the target's password complexity policies or use policies that can lock accounts after a set number of failed attempts.

• Category: Credential Access

• Technique: T1110.001 - Brute Force: Password Guessing

• Impact: C:3 / I:3 / A:2

• Rule file: gcp_probable_password_guess.yml

• Reference: https://attack.mitre.org/tactics/TA0006

• Reference: https://attack.mitre.org/techniques/T1110/001/

GCP probable Privilege Escalation, Kubernetes role bindings created or patched

Privilege Escalation refers to techniques adversaries use to gain higher-level permissions on a system or network. Adversaries often can access and navigate a network with unprivileged access, but they require elevated permissions to meet their goals. Typical methods include taking advantage of system weaknesses, misconfigurations, and vulnerabilities. This detects the creation or modification of role bindings that may be malicious. Role bindings and cluster role bindings allow users to assign roles to Kubernetes subjects (users, groups, or service accounts).

• Category: Privilege Escalation

• Technique: T1548 - Abuse Elevation Control Mechanism

• Impact: C:1 / I:2 / A:3

• Rule file: gcp_privilege_escalation_kubernetes_rolebindings_created_or_patched.yml

• Reference: https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control

• Reference: https://attack.mitre.org/tactics/TA0004/

• Reference: https://attack.mitre.org/techniques/T1548

GCP probable hijacked account

A user's account has been disabled after Google detected suspicious activity suggesting it may have been compromised. A hijacked account can be used for other attacks, such as data collection and exfiltration.

• Category: Collection

• Technique: T1560 - Archive Collected Data

• Impact: C:3 / I:3 / A:2

• Rule file: gcp_account_disabled_hijacked.yml

• Reference: https://attack.mitre.org/tactics/TA0009/

• Reference: https://attack.mitre.org/techniques/T1560

GCP suspicious login blocked

Google Cloud detected and blocked a suspicious login to a user's account.

• Category: Initial Access

• Technique: T1078 - Valid Accounts

• Impact: C:1 / I:2 / A:3

• Rule file: gcp_suspicious_login_blocked.yml

• Reference: https://attack.mitre.org/tactics/TA0001/

• Reference: https://attack.mitre.org/techniques/T1078

GCP suspicious login from less secure app

Less secure apps (LSAs) are non-Google applications that can access your Google account using just a username and password. They leave your account more exposed to hijacking attempts.

• Category: Initial Access

• Technique: T1190 - Exploit Public-Facing Application

• Impact: C:1 / I:2 / A:3

• Rule file: gcp_suspicious_login_less_secure_app.yml

• Reference: https://attack.mitre.org/tactics/TA0001/

• Reference: https://attack.mitre.org/techniques/T1190

GCP suspicious programmatic login

Google Cloud has identified a suspicious programmatic login. Programmatic login can be used to carry out a brute force attack.

• Category: Credential Access

• Technique: T1110 - Brute Force

• Impact: C:1 / I:2 / A:3

• Rule file: gcp_suspicious_programmatic_login.yml

• Reference: https://attack.mitre.org/tactics/TA0006

• Reference: https://attack.mitre.org/techniques/T1110

GKE Kubernetes Admission Webhook Modified

This detects the creation or modification of admission webhook configurations in Google Kubernetes Engine. Attackers leverage malicious admission controllers to inject sidecar containers, alter workload specs, or intercept secrets.

• Category: Persistence

• Technique: T1078.004 - Valid Accounts: Cloud Accounts

• Impact: C:3 / I:3 / A:2

• Rule file: gcp_kubernetes_admission_controller.yml

• Reference: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/

• Reference: https://attack.mitre.org/techniques/T1078/004/

Google Cloud Service Account Key Creation Spike

This detects spikes in service account key creation, which may signal credential harvesting or preparation for unauthorized access. Service account keys offer long-term credentials that can authenticate as the service account. Several key creations by the same user in a short period may point to malicious activity or preparation for privilege escalation attacks.

• Category: Credential Access

• Technique: Account Manipulation

• Impact: C:3 / I:3 / A:2

• Rule file: service_account_key_creation_spikes.yml

• Reference: https://cloud.google.com/iam/docs/audit-logging/examples-service-accounts

• Reference: https://attack.mitre.org/techniques/T1098/001/

Google Workspace MFA Enforcement Disabled

This detects when MFA enforcement is turned off in Google Workspace. Turning off MFA eliminates a critical security control and allows credential-based attacks against every user in the organization.

• Category: Defense Evasion

• Technique: T1556 - Modify Authentication Process

• Impact: C:3 / I:3 / A:1

• Rule file: gcp_workspace_mfa_disabled.yml

• Reference: https://support.google.com/a/answer/9176657

• Reference: https://attack.mitre.org/techniques/T1556/