GCP Logging Bucket Deletion for Defense Evasion

This threat brief focuses on the deletion of logging buckets within Google Cloud Platform (GCP). Log buckets are central to storing and organizing log data within GCP. An attacker may intentionally delete these buckets to disrupt incident response, forensics investigations, and overall security monitoring. The deletion of a bucket results in a pending state for seven days, during which logs continue to be routed to the bucket. To completely stop log routing, associated log sinks must also be deleted or modified. This activity matters to defenders as it represents a direct attempt to blind security teams by removing valuable audit data, increasing the dwell time of malicious activity.

Attack Chain

1. The attacker gains unauthorized access to a GCP account through compromised credentials or other means.
2. The attacker enumerates existing logging buckets to identify potential targets for deletion.
3. The attacker attempts to delete a logging bucket using the google.logging.v*.ConfigServiceV*.DeleteBucket API call.
4. The GCP audit logs record the bucket deletion attempt.
5. If successful, the logging bucket enters a pending deletion state for seven days.
6. To fully eliminate logs, the attacker identifies log sinks associated with the deleted bucket.
7. The attacker deletes or modifies these log sinks to prevent further log routing to the affected bucket.
8. The attacker successfully impairs the organization's ability to detect and respond to malicious activity by removing crucial log data.

Impact

A successful logging bucket deletion can severely impact an organization's security posture. It allows attackers to operate with reduced visibility, potentially increasing the dwell time and impact of attacks. Organizations may lose critical audit data, hindering incident response and forensic investigations. The sectors most affected are those heavily reliant on GCP for their infrastructure, including technology, finance, and healthcare. The impact can range from compliance violations to the inability to detect and respond to active threats, leading to data breaches and financial losses.

Recommendation

• Deploy the Sigma rule GCP Logging Bucket Deletion to your SIEM to detect malicious bucket deletion attempts (rule provided below).
• Review IAM permissions and roles to ensure that only authorized personnel have the ability to delete log buckets, reducing the risk of unauthorized deletions.
• Implement additional logging and monitoring for any changes to log sinks and bucket configurations to detect and respond to similar activities promptly.
• Investigate any alerts generated by the GCP Logging Bucket Deletion Sigma rule, focusing on unauthorized user accounts or suspicious source IP addresses.
• Create exceptions for known maintenance periods or specific user accounts responsible for routine bucket deletions as described in the rule's false positives section.