A GCP Cloud SQL DB instance was exported from a production account

Analytics BIOC Informational

A GCP Cloud SQL DB instance was exported from a production account

A GCP Cloud SQL DB instance was exported to a storage bucket. The DB instance was exported from a production account.

Module:: Cortex Cloud
Licensed by:: Cloud Runtime Security (CRS)
Data source:: Gcp Audit Log

ATT&CK tactics: Exfiltration (TA0010)

ATT&CK techniques: Transfer Data to Cloud Account (T1537)

Detector tags: Data Detection & Response Cloud Data Asset Exfiltration

Attacker's goals:

Exfiltrate data to an unknown bucket.

Investigative actions:

Check the legitimacy of the referenced destination bucket. Review further logs for the source Cloud DB instance. Review further actions performed by the identity.

Test period:: N/A (single event)
Deduplication:: 1 Day