GCP Audit Alerts for Google Cloud Storage Bucket Enumeration via Listing APIs
Triggers on GCP audit events indicating Storage bucket listing (storage.buckets.list or listChannels).
FreeReviewedSigma · Low · v5
- Product
- gcp
- Service
- gcp.audit
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-08-14
- Updated
- 2026-07-31
What it detects
This rule identifies attempts to enumerate Google Cloud Storage buckets by matching Cloud Audit log events for bucket listing methods. Attackers commonly enumerate accessible buckets to discover targets before attempting access, misconfiguration exploitation, or data discovery. It relies on GCP audit telemetry capturing the API method name for storage bucket listing calls.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
gcp-audit-detects-google-cloud-storage-bucket-enumeration-via-list-apis-e2feb918
title: GCP Audit Alerts for Google Cloud Storage Bucket Enumeration via Listing APIs
id: 10780ab0-5aae-40d7-8873-47b2f3fbe2bd
status: test
description: This rule identifies attempts to enumerate Google Cloud Storage buckets by matching Cloud Audit log events for bucket listing methods. Attackers commonly enumerate accessible buckets to discover targets before attempting access, misconfiguration exploitation, or data discovery. It relies on GCP audit telemetry capturing the API method name for storage bucket listing calls.
references:
- https://cloud.google.com/storage/docs/json_api/v1/buckets
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_bucket_enumeration.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-14
modified: 2022-10-09
tags:
- attack.discovery
logsource:
product: gcp
service: gcp.audit
detection:
selection:
gcp.audit.method_name:
- storage.buckets.list
- storage.buckets.listChannels
condition: selection
falsepositives:
- Storage Buckets being enumerated may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
- Storage Buckets enumerated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
- id: e2feb918-4e77-4608-9697-990a1aaf74c3
type: derived