Cloud Build

any: cloudbuild.googleapis.com (any method)

#
ServiceName
cloudbuild.googleapis.com

Description

Catch-all entry for cloudbuild.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.

google.devtools.cloudbuild.CloudBuild.ApproveBuild: ApproveBuild

#
ServiceName
cloudbuild.googleapis.com

google.devtools.cloudbuild.CloudBuild.CancelBuild: CancelBuild

#
ServiceName
cloudbuild.googleapis.com

google.devtools.cloudbuild.CloudBuild.CreateBuild: CreateBuild

#
ServiceName
cloudbuild.googleapis.com

Example Audit Log Entry #

{
  "insertId": "tywk1qdck1x",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "operation": {
    "first": true,
    "id": "operations/build/example-project-id/ZDMwMTg4MDctOGMxYy00N2Y3LTgyNWMtYTVmY2M5NjM3ODBm",
    "producer": "cloudbuild.googleapis.com"
  },
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudbuild.builds.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id",
        "resourceAttributes": {
          "name": "projects//locations/global/builds",
          "service": "cloudbuild.googleapis.com",
          "type": "cloudbuild.googleapis.com/Build"
        }
      }
    ],
    "methodName": "google.devtools.cloudbuild.v1.CloudBuild.CreateBuild",
    "request": {
      "@type": "type.googleapis.com/google.devtools.cloudbuild.v1.CreateBuildRequest",
      "build": {},
      "parent": "projects/example-project-id/locations/global"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.builds.submit invocation-id/1fec36ef8af0493f94d1926f9be985a8 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:29:53.696583Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "global"
      ]
    },
    "resourceName": "projects/example-project-id/builds",
    "serviceName": "cloudbuild.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:29:53.768565347Z",
  "resource": {
    "labels": {
      "build_id": "d3018807-8c1c-47f7-825c-a5fcc963780f",
      "build_trigger_id": "",
      "project_id": "example-project-id"
    },
    "type": "build"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:29:48.557352Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
protoPayload.authorizationInfo (panther rule field)is_not_null1 rulepanther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

  • GCP CloudBuild Potential Privilege Escalation source high: Detects privilege escalation attacks designed to gain access to the Cloud Build Service Account. A user with permissions to start a new build with Cloud Build can gain access to the Cloud Build Service Account and abuse it for more access to the environment.T1548

google.devtools.cloudbuild.CloudBuild.CreateBuildTrigger: CreateBuildTrigger

#
ServiceName
cloudbuild.googleapis.com

google.devtools.cloudbuild.CloudBuild.CreateWorkerPool: CreateWorkerPool

#
ServiceName
cloudbuild.googleapis.com

google.devtools.cloudbuild.CloudBuild.DeleteBuildTrigger: DeleteBuildTrigger

#
ServiceName
cloudbuild.googleapis.com

google.devtools.cloudbuild.CloudBuild.DeleteWorkerPool: DeleteWorkerPool

#
ServiceName
cloudbuild.googleapis.com

google.devtools.cloudbuild.CloudBuild.GetBuild: GetBuild

#
ServiceName
cloudbuild.googleapis.com

Data Access audit logs are disabled by default.

google.devtools.cloudbuild.CloudBuild.GetBuildTrigger: GetBuildTrigger

#
ServiceName
cloudbuild.googleapis.com

Data Access audit logs are disabled by default.

google.devtools.cloudbuild.CloudBuild.GetDefaultServiceAccount: GetDefaultServiceAccount

#
ServiceName
cloudbuild.googleapis.com

Data Access audit logs are disabled by default.

google.devtools.cloudbuild.CloudBuild.GetWorkerPool: GetWorkerPool

#
ServiceName
cloudbuild.googleapis.com

Data Access audit logs are disabled by default.

google.devtools.cloudbuild.CloudBuild.ListBuildTriggers: ListBuildTriggers

#
ServiceName
cloudbuild.googleapis.com

Data Access audit logs are disabled by default.

google.devtools.cloudbuild.CloudBuild.ListBuilds: ListBuilds

#
ServiceName
cloudbuild.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "b527drdogi4",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudbuild.builds.list",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.devtools.cloudbuild.v1.CloudBuild.ListBuilds",
    "request": {
      "@type": "type.googleapis.com/google.devtools.cloudbuild.v1.ListBuildsRequest",
      "parent": "projects/example-project-id/locations/global"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.builds.list invocation-id/a04c798afc944ad698470171b30bbcef environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:18:07.600870Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "global"
      ]
    },
    "resourceName": "projects/example-project-id/builds",
    "serviceName": "cloudbuild.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:18:08.576503263Z",
  "resource": {
    "labels": {
      "build_id": "",
      "build_trigger_id": "",
      "project_id": "example-project-id"
    },
    "type": "build"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:18:07.435153Z"
}

google.devtools.cloudbuild.CloudBuild.ListWorkerPools: ListWorkerPools

#
ServiceName
cloudbuild.googleapis.com

Data Access audit logs are disabled by default.

google.devtools.cloudbuild.CloudBuild.ReceiveTriggerWebhook: ReceiveTriggerWebhook

#
ServiceName
cloudbuild.googleapis.com

google.devtools.cloudbuild.CloudBuild.RetryBuild: RetryBuild

#
ServiceName
cloudbuild.googleapis.com

google.devtools.cloudbuild.CloudBuild.RunBuildTrigger: RunBuildTrigger

#
ServiceName
cloudbuild.googleapis.com

google.devtools.cloudbuild.CloudBuild.UpdateBuildTrigger: UpdateBuildTrigger

#
ServiceName
cloudbuild.googleapis.com

google.devtools.cloudbuild.CloudBuild.UpdateWorkerPool: UpdateWorkerPool

#
ServiceName
cloudbuild.googleapis.com