5.30 - Cloud Storage buckets enumerated by unfamiliar user identities

April 24, 2024 ยท View on GitHub

Cloud Storage buckets enumerated by unfamiliar user identities.

Category: Data Usage
Use Cases: Audit, Detect
Data Sources: Audit Logs - Data Access

Queries or Rules

BigQueryLog AnalyticsGoogle SecOps
SQLSQLContribute rule

Event Generation

List all buckets in a project.

Test Prerequisites

  1. Install gsutil (installed as part of Google Cloud CLI)

Test Commands

gsutil ls

Sample Event

No log samples provided. Contribute log samples to this use case.