Suspicious Google Cloud Re-identifies Sensitive Information (via gcp.audit)

title: Suspicious Google Cloud Re-identifies Sensitive Information (via gcp.audit)
id: 260e5640-58a3-526b-af22-4a48879f4650
status: stable
description: This rule detects when sensitive information is re-identified in google Cloud.
references:
    - https://attack.mitre.org/techniques/T1565/
    - https://cloud.google.com/dlp/docs/reference/rest/v2/projects.content/reidentify
author: Huntrule Team
date: 2026-01-29
tags:
    - attack.impact
    - attack.t1565
logsource:
    product: gcp
    service: gcp.audit
detection:
    selection:
        gcp.audit.method_name: projects.content.reidentify
    condition: selection
falsepositives:
    - Unknown
level: medium