GCP Audit Alerts for Google Cloud Storage Bucket Enumeration via Listing APIs

title: GCP Audit Alerts for Google Cloud Storage Bucket Enumeration via Listing APIs
id: 10780ab0-5aae-40d7-8873-47b2f3fbe2bd
status: test
description: This rule identifies attempts to enumerate Google Cloud Storage buckets by matching Cloud Audit log events for bucket listing methods. Attackers commonly enumerate accessible buckets to discover targets before attempting access, misconfiguration exploitation, or data discovery. It relies on GCP audit telemetry capturing the API method name for storage bucket listing calls.
references:
  - https://cloud.google.com/storage/docs/json_api/v1/buckets
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_bucket_enumeration.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-14
modified: 2022-10-09
tags:
  - attack.discovery
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name:
      - storage.buckets.list
      - storage.buckets.listChannels
  condition: selection
falsepositives:
  - Storage Buckets being enumerated may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Storage Buckets enumerated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
  - id: e2feb918-4e77-4608-9697-990a1aaf74c3
    type: derived