Detection rules › By event

GCP-storage.googleapis.com

Event	Rules
any	1
storage.buckets.delete	3
storage.buckets.insert	1
storage.buckets.list	1
storage.buckets.listChannels	1
storage.buckets.patch	1
storage.buckets.update	3
storage.hmacKeys.create	1
storage.hmacKeys.delete	1
storage.objects.create	2
storage.objects.delete	1
storage.objects.get	1
storage.setIamPermissions	7

any

1 detection rules reference this event. View event page.

Panther (1)

GCP storage hmac keys create severity high T1548

storage.buckets.delete

3 detection rules reference this event. View event page.

Sigma (1)

Google Cloud Storage Buckets Modified or Deleted severity medium

Elastic (1)

GCP Storage Bucket Deletion severity medium T1485

Panther (1)

GCP Cloud Storage Buckets Modified Or Deleted severity low T1486, T1685

storage.buckets.insert

1 detection rules reference this event. View event page.

Sigma (1)

Google Cloud Storage Buckets Modified or Deleted severity medium

storage.buckets.list

1 detection rules reference this event. View event page.

Sigma (1)

Google Cloud Storage Buckets Enumeration severity low

storage.buckets.listChannels

1 detection rules reference this event. View event page.

Sigma (1)

Google Cloud Storage Buckets Enumeration severity low

storage.buckets.patch

1 detection rules reference this event. View event page.

Sigma (1)

Google Cloud Storage Buckets Modified or Deleted severity medium

storage.buckets.update

3 detection rules reference this event. View event page.

Sigma (1)

Google Cloud Storage Buckets Modified or Deleted severity medium

Elastic (1)

GCP Storage Bucket Configuration Modification severity medium T1578, T1578.005

Panther (1)

GCP Cloud Storage Buckets Modified Or Deleted severity low T1486, T1685

storage.hmacKeys.create

1 detection rules reference this event. View event page.

Panther (1)

GCP Privileged Operation severity informational

storage.hmacKeys.delete

1 detection rules reference this event. View event page.

YARA-L (1)

GCP Multiple HMAC Keys Deleted severity high T1531

storage.objects.create

2 detection rules reference this event. View event page.

Panther (2)

GCP GCS Bulk Object Rewrite Operation severity medium T1486, T1530, T1537
GCP GCS Ransom Note Upload severity high T1486

storage.objects.delete

1 detection rules reference this event. View event page.

Panther (1)

GCP GCS Bulk Object Deletion severity medium T1485

storage.objects.get

1 detection rules reference this event. View event page.

Panther (1)

GCP GCS Object Copied to Different Bucket severity medium T1537

storage.setIamPermissions

7 detection rules reference this event. View event page.

Elastic (1)

GCP Storage Bucket Permissions Modification severity medium T1098, T1098.003, T1222

Splunk (1)

Detect New Open GCP Storage Buckets severity medium T1530

Kusto (1)

GCP Audit Logs - Storage Bucket Made Public severity high T1078, T1078.004, T1530, T1567, T1567.002

YARA-L (1)

GCP Storage Bucket Opened To Public severity high T1685

Panther (3)

GCP GCS IAM Permission Changes severity low T1530
GCP Privileged Operation severity informational
GCS Bucket Made Public severity high T1530