Google Cloud Storage Buckets Enumeration

calendar Oct 12, 2023 · attack.discovery  ·
Share on: linkedin copy

Detects when storage bucket is enumerated in Google Cloud.

Sigma rule (View on GitHub)

 1title: Google Cloud Storage Buckets Enumeration
 2id: e2feb918-4e77-4608-9697-990a1aaf74c3
 3status: test
 4description: Detects when storage bucket is enumerated in Google Cloud.
 5references:
 6    - https://cloud.google.com/storage/docs/json_api/v1/buckets
 7author: Austin Songer @austinsonger
 8date: 2021/08/14
 9modified: 2022/10/09
10tags:
11    - attack.discovery
12logsource:
13    product: gcp
14    service: gcp.audit
15detection:
16    selection:
17        gcp.audit.method_name:
18            - storage.buckets.list
19            - storage.buckets.listChannels
20    condition: selection
21falsepositives:
22    - Storage Buckets being enumerated may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
23    - Storage Buckets enumerated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
24level: low

References

Related rules

to-top