Analytics BIOC
Informational
✕
GCP Storage Bucket Permissions Modification
A GCP storage bucket's IAM permissions were modified. An attacker might use this technique to expose sensitive data or cause data loss.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- Gcp Audit Log
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: File and Directory Permissions Modification (T1222)
Detector tags: Cloud Data Asset Disaster Recovery Risks Cloud Data Asset Configuration Data Detection & Response
Attacker's goals:
Exfiltrate information.
Investigative actions:
Check which data exists in the modified bucket and its classification. Look for events that involve actions for the bucket data.
- Test period:
- N/A (single event)
- Deduplication:
- 3 Hours