mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
59 lines
2.2 KiB
YAML
59 lines
2.2 KiB
YAML
name: GCP Detect gcploit framework
|
|
id: a1c5a85e-a162-410c-a5d9-99ff639e5a52
|
|
version: 2
|
|
date: '2024-05-14'
|
|
author: Rod Soto, Splunk
|
|
status: experimental
|
|
type: TTP
|
|
description: The following analytic identifies the use of the GCPloit exploitation
|
|
framework within Google Cloud Platform (GCP). It detects specific GCP Pub/Sub messages
|
|
with a function timeout of 539 seconds, which is indicative of GCPloit activity.
|
|
This detection is significant as GCPloit can be used to escalate privileges and
|
|
facilitate lateral movement from compromised high-privilege accounts. If confirmed
|
|
malicious, this activity could allow attackers to gain unauthorized access, escalate
|
|
their privileges, and move laterally within the GCP environment, potentially compromising
|
|
sensitive data and critical resources.
|
|
data_source: []
|
|
search: '`google_gcp_pubsub_message` data.protoPayload.request.function.timeout=539s
|
|
| table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail
|
|
data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location
|
|
http_user_agent | `gcp_detect_gcploit_framework_filter`'
|
|
how_to_implement: You must install splunk GCP add-on. This search works with gcp:pubsub:message
|
|
logs
|
|
known_false_positives: Payload.request.function.timeout value can possibly be match
|
|
with other functions or requests however the source user and target request account
|
|
may indicate an attempt to move laterally accross acounts or projects
|
|
references:
|
|
- https://github.com/dxa4481/gcploit
|
|
- https://www.youtube.com/watch?v=Ml09R38jpok
|
|
tags:
|
|
analytic_story:
|
|
- GCP Cross Account Activity
|
|
asset_type: GCP Account
|
|
confidence: 50
|
|
impact: 50
|
|
message: tbd
|
|
mitre_attack_id:
|
|
- T1078
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- data.protoPayload.request.function.timeout
|
|
- src
|
|
- src_user
|
|
- data.resource.labels.project_id
|
|
- data.protoPayload.request.function.serviceAccountEmail
|
|
- data.protoPayload.authorizationInfo{}.permission
|
|
- data.protoPayload.request.location
|
|
- http_user_agent
|
|
risk_score: 25
|
|
security_domain: threat
|