Google Cloud Storage - CraftedSignal Threat Feed

GCP Storage Bucket Deletion for Impact

hello@craftedsignal.io — Mon, 29 Jan 2024 12:00:00 +0000

This threat brief focuses on the malicious deletion of Google Cloud Platform (GCP) storage buckets. Threat actors may target these buckets to disrupt business operations by removing critical data. The detection rule monitors GCP audit logs for bucket deletion events. This activity can lead to significant data loss and service disruption, impacting an organization's ability to function normally. The alert is triggered by the storage.buckets.delete event action within the GCP audit logs. Successful exploitation of this technique could result in prolonged downtime and financial losses.

Attack Chain

The attacker gains unauthorized access to the target's GCP environment, potentially through compromised credentials or a misconfigured IAM role.
The attacker enumerates existing storage buckets within the GCP project to identify targets for deletion.
The attacker uses the gcloud storage buckets delete command or the GCP console to initiate the deletion of a specific storage bucket.
GCP logs the storage.buckets.delete event in the audit logs, capturing details such as the user account, IP address, and timestamp of the deletion.
The targeted storage bucket and its contents are permanently removed from the GCP environment.
The victim organization experiences data loss and potential service disruption due to the unavailability of the deleted data.
The attacker may repeat this process to delete multiple storage buckets, exacerbating the impact and hindering recovery efforts.

Impact

Successful deletion of GCP storage buckets can lead to significant data loss and operational disruption. The impact can range from temporary service outages to permanent data loss, depending on the backup and recovery strategies in place. Industries heavily reliant on cloud storage, such as e-commerce, financial services, and healthcare, are particularly vulnerable. The cost of recovery can be substantial, including expenses related to data restoration, incident response, and reputational damage.

Recommendation

Deploy the Sigma rule GCP Storage Bucket Deletion to your SIEM to detect unauthorized bucket deletions.
Review IAM policies and enforce the principle of least privilege to limit the potential impact of compromised credentials.
Enable versioning on critical storage buckets to facilitate recovery from accidental or malicious deletions (reference: [https://cloud.google.com/storage/docs/key-terms#buckets]).
Set up alerts for any future deletion actions on storage buckets to ensure immediate awareness and response to similar threats.
Investigate any alerts generated by the Sigma rule, focusing on the user account, IP address, and timestamp associated with the deletion event.

GCP Storage Bucket Configuration Modification

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection rule identifies modifications to Google Cloud Platform (GCP) storage bucket configurations. Attackers may alter these configurations to weaken security controls, enabling unauthorized access or data exfiltration. The rule focuses on identifying successful configuration changes via audit logs. It is essential for defenders to monitor these changes because misconfigured storage buckets can lead to data breaches, compliance violations, and reputational damage. The rule leverages GCP audit logs to detect storage.buckets.update events, indicating a change in bucket configuration. The rule was initially created in 2020 and updated in April 2026.

Attack Chain

An attacker gains initial access to a GCP account, possibly through compromised credentials or a misconfigured IAM role.
The attacker enumerates existing storage buckets to identify potential targets.
The attacker attempts to modify the configuration of a target storage bucket using the storage.buckets.update API.
Specifically, the attacker may attempt to modify the bucket's access control list (ACL) to grant unauthorized access.
Alternatively, the attacker may disable versioning or logging to cover their tracks and prevent detection.
If successful, the attacker gains unauthorized access to the storage bucket's contents.
The attacker exfiltrates sensitive data from the bucket.
The attacker attempts to delete or further modify the bucket to disrupt operations or cover their tracks.

Impact

Successful exploitation can lead to unauthorized access to sensitive data stored in GCP storage buckets. This can result in data breaches, compliance violations, and reputational damage. The number of affected buckets and the severity of the impact depend on the attacker's objectives and the sensitivity of the data stored in the targeted buckets. Depending on the data stored within a compromised bucket, an organization can face regulatory fines, legal action, and loss of customer trust.

Recommendation

Deploy the Sigma rule "GCP Storage Bucket Configuration Modification" to your SIEM, ensuring you are ingesting GCP audit logs (filebeat-* or logs-gcp*) as defined in the rule [index].
Investigate any alerts generated by the Sigma rule, focusing on the user or service account responsible for the configuration change [rule].
Review the bucket's configuration for any unexpected or unauthorized changes to access controls, versioning, or logging [rule].
Implement strict IAM policies and regularly audit access controls to minimize the risk of unauthorized access [rule].
Correlate alerts with other security events to identify potential patterns of malicious behavior [rule].