Cloud Incident ResponseGCP
GCP routes everything through the Log Router into two built-in buckets: _Required (Admin Activity, System Event, Access Transparency; 400 days, immutable) and _Default (30 days). The defining gap is that Data Access logs are off everywhere except BigQuery, so object reads, secret access, and impersonation are invisible until enabled in IAM auditConfigs. Understand sinks before trusting any GCP log.
Cheat sheet by domain
Status: Enabled by default Partial / mixed OFF - must enable
| Domain | What is included | Key logs | On by default? | How to obtain | Example ATT&CK |
|---|---|---|---|---|---|
| Identity & Access | Human + non-human identities, sign-in / authentication, MFA, federation & SSO trust, role/permission grants, OAuth app consent, token & session activity. Covers credential/session revocation and non-human identity (NHI) inventory. |
| Enabled by default | Identity/Login audit ON (Admin Activity, ~400d) - ask client to export or grant Cloud Logging read. IAM Recommender is advisory only. Revoke: delete SA key (gcloud iam service-accounts keys delete); disable SA. | T1078.004 Cloud Accounts, T1098.001 Additional Cloud Credentials, T1556 Modify Auth Process, T1069.003 Cloud Groups, T1621 MFA Request Generation |
| Control Plane & Management Activity | All management-plane API activity (Console/GUI, CLI, SDK). Audit-log architecture, log-tampering & immutability, resource/config changes, org-policy and tenant hierarchy changes, service enumeration. |
| Partial / mixed | Admin Activity ON (400d); Data Access OFF - request enable per resource. Ask client to export Admin Activity or grant Cloud Logging read. Request Security Command Center access for threat hunting. | T1562.008 Disable Cloud Logs, T1526 Cloud Service Discovery, T1580 Cloud Infra Discovery, T1654 Log Enumeration, T1666 Modify Resource Hierarchy |
| Workloads & Runtime | Compute & runtime: VMs, serverless, containers/Kubernetes. Instance metadata (IMDS) access, runtime threat detection, image trust, cryptojacking / resource hijacking, lateral movement to hosts. |
| Partial / mixed | GKE audit ON (Admin Activity 400d; Data Access opt-in, 30d); Logging Agent & Container Threat Detection need enable. Ask client to export a snapshot or attach disk to forensic VM. Enforce Binary Authorization for image trust. | T1496.001 Compute Hijacking, T1552.005 Cloud Instance Metadata API, T1578.001 Create Snapshot, T1648 Serverless Execution (Cloud Functions), T1204.003 Malicious Image |
| Network & Connectivity | Ingress/egress & lateral traffic: VPC flows, DNS, load balancers, WAF, firewall rules. Edge exploitation, C2/tunnelling, DDoS, exfil-over-network detection. |
| Partial / mixed | VPC Flow can be enabled per subnet (sampled, 5-min); Cloud DNS query OFF. Ask client to export or grant Cloud Logging read. Cloud Armor ON if in use. Route/peering changes tracked in Cloud Audit. | T1190 Exploit Public-Facing App, T1048 Exfil Alt Protocol, T1071 App Layer Protocol (network/endpoint technique - outside Cloud matrix), T1498 Network DoS, T1046 Network Service Discovery |
| Data Services & Storage | Object/blob storage, databases, data warehouses, key-management. Data-plane (object-level) logging, cross-account shares, snapshots, immutable backups, mass-read / ransomware / destruction. |
| OFF - must enable | GCS Data Access OFF - request enable per bucket & export. BigQuery/KMS audit ON via Cloud Audit (400d). If ingested, grant Cloud Logging read. Uniform Bucket-Level Access + Public Access Prevention. | T1530 Data from Cloud Storage, T1619 Storage Object Discovery, T1537 Transfer Data to Cloud Account, T1485 Data Destruction, T1213.006 Databases (BigQuery export) |
| DevSecOps & Pipelines | CI/CD pipelines, source repos, artifact registries, secrets in build. OIDC/federated build identities, supply-chain & dependency tampering, malicious workflow, pipeline secret theft. |
| Partial / mixed | Cloud Build & Secret Manager audit ON via Cloud Audit (400d) - request read or export. Revoke offending SA key; audit WIF OIDC exchanges. Enforce image signing / Binary Authorization at deploy. | T1195 Supply Chain Compromise, T1677 Poisoned Pipeline Execution, T1552.001 Credentials In Files, T1213.003 Code Repositories, T1098.001 Additional Cloud Credentials |
| SaaS & Collaboration Platforms | SaaS & collaboration: M365 / Google Workspace / Okta / GitHub org. Mailbox & file audit, OAuth-app abuse, inbox/forwarding rules, refresh-token replay, helpdesk-reset abuse. |
| Enabled by default | Most Workspace audit logs ON with good retention - ask client to export or grant Admin console/BigQuery-export access. Revoke OAuth app; remove forwarding (gam ... delete forwardingaddress); reset password + revoke tokens. | T1114 Email Collection, T1213.003 Code Repositories, T1567 Exfil Over Web Service (Drive), T1098.002 Delegate Perms, T1671 Cloud App Integration |
| AI/ML Services | Managed AI/ML: model invocation, training-data buckets, inference endpoints, guardrails. Model/data exfil, prompt injection, abuse of stolen API keys (detect via cost anomalies), poisoning. |
| OFF - must enable | Vertex Admin Activity ON (400d); Data Access (invocation/training access) OFF - request enable & export. Revoke on inference spike; audit training-data bucket reads; watch KMS key deletion on AI keys. | T1496.004 Cloud Service Hijacking, T1657 Financial Theft, T1530 Data from Cloud Storage, T1567 Exfil Over Web Service; MITRE ATLAS AML.T0019, OWASP LLM06 Data Poisoning |
Threat matrix
Adversary behaviours most relevant to each domain, and the log that first reveals them. Cross-check IDs against the live ATT&CK Cloud matrices.
| Domain | Example adversary behaviours (ATT&CK) | Primary detection log |
|---|---|---|
| Identity & Access | T1078.004 Cloud Accounts, T1098.001 Additional Cloud Credentials, T1556 Modify Auth Process, T1069.003 Cloud Groups, T1621 MFA Request Generation | Cloud Identity audit logs |
| Control Plane & Management Activity | T1562.008 Disable Cloud Logs, T1526 Cloud Service Discovery, T1580 Cloud Infra Discovery, T1654 Log Enumeration, T1666 Modify Resource Hierarchy | Admin Activity Logs |
| Workloads & Runtime | T1496.001 Compute Hijacking, T1552.005 Cloud Instance Metadata API, T1578.001 Create Snapshot, T1648 Serverless Execution (Cloud Functions), T1204.003 Malicious Image | Logging Agent (host VM logs) |
| Network & Connectivity | T1190 Exploit Public-Facing App, T1048 Exfil Alt Protocol, T1071 App Layer Protocol (network/endpoint technique - outside Cloud matrix), T1498 Network DoS, T1046 Network Service Discovery | VPC Flow Logs (sampled) |
| Data Services & Storage | T1530 Data from Cloud Storage, T1619 Storage Object Discovery, T1537 Transfer Data to Cloud Account, T1485 Data Destruction, T1213.006 Databases (BigQuery export) | GCS Data Access logs (OFF) |
| DevSecOps & Pipelines | T1195 Supply Chain Compromise, T1677 Poisoned Pipeline Execution, T1552.001 Credentials In Files, T1213.003 Code Repositories, T1098.001 Additional Cloud Credentials | Cloud Build logs |
| SaaS & Collaboration Platforms | T1114 Email Collection, T1213.003 Code Repositories, T1567 Exfil Over Web Service (Drive), T1098.002 Delegate Perms, T1671 Cloud App Integration | Admin audit log (6 mo) |
| AI/ML Services | T1496.004 Cloud Service Hijacking, T1657 Financial Theft, T1530 Data from Cloud Storage, T1567 Exfil Over Web Service; MITRE ATLAS AML.T0019, OWASP LLM06 Data Poisoning | Vertex AI Cloud Audit (Admin Activity) |
Incident response plan
- Get read-only access (Viewer + Security Reviewer); identify projects/folders/org in scope.
- Check logging posture: which Data Access logs are enabled, where sinks route, is an aggregated sink present.
- Preserve now: export Admin Activity and any enabled Data Access logs; snapshot disks; copy SCC findings.
- Scope identity: review IAM policy changes, service-account keys, WIF/impersonation chains via Policy Analyzer.
- Contain: gcloud iam service-accounts keys delete, disable the SA, revoke sessions, remove IAM bindings, rotate secrets.
- Recover and harden: enable Data Access logs in auditConfigs, add an aggregated sink, enforce Binary Authorization.
Historical incidents & TTPs
Publicly-reported incidents and techniques. Attribution reflects vendor/government assessments; some entries are disclosed vulnerabilities or SaaS/OAuth cases rather than platform-native breaches.
Public GCP-platform breach reporting is thinner than AWS/Azure. Several entries below are documented technique classes or SaaS/OAuth incidents rather than GCP-native breaches - labelled accordingly.
Cryptomining of compromised projects2021-2026
Google Threat Horizons repeatedly documents compromised GCP instances (weak/leaked credentials, exposed software) repurposed for cryptomining within minutes - fastest seen ~22 seconds. Aggregate telemetry, not one breach.
T1078.004T1595T1190T1496T1610Service-account key abuse & IAM privescongoing
Leaked user-managed SA JSON keys allow direct auth with no MFA; chained IAM misconfigs (actAs, impersonation) escalate up to org level. Documented technique class, not a single breach.
T1552.001T1078.004T1098.001T1548T1550.001UNC6040 vishing - Google's Salesforce2025
Vishing tricked staff into authorizing a malicious Salesforce connected app to bulk-export CRM data; a Google corporate Salesforce instance was affected. A SaaS OAuth breach, not a GCP-platform compromise.
T1566.004T1550.001T1567T1657Workspace OAuth / consent phishing2020-2026
Attackers register a malicious Workspace OAuth app and phish users into clicking Allow; the granted token gives persistent, MFA-surviving Gmail/Drive access until revoked.
T1566T1528T1550.001T1114