GCP Audit: Detects Google Cloud Storage Bucket Enumeration via List APIs

title: "GCP Audit: Detects Google Cloud Storage Bucket Enumeration via List APIs"
id: 10780ab0-5aae-40d7-8873-47b2f3fbe2bd
status: test
description: This rule flags audit log events where a principal enumerates Google Cloud Storage buckets by calling the bucket listing methods storage.buckets.list or storage.buckets.listChannels. Enumeration helps attackers discover resource names, access patterns, and potential targets before attempting access or exploitation. The detection relies on GCP audit telemetry for method_name values in gcp.audit logs.
references:
  - https://cloud.google.com/storage/docs/json_api/v1/buckets
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_bucket_enumeration.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-14
modified: 2022-10-09
tags:
  - attack.discovery
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name:
      - storage.buckets.list
      - storage.buckets.listChannels
  condition: selection
falsepositives:
  - Storage Buckets being enumerated may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Storage Buckets enumerated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
  - id: e2feb918-4e77-4608-9697-990a1aaf74c3
    type: derived