Anomalous number of Google Cloud Storage Objects Accessed

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detect when a Google Cloud identity accesses a number of Google Cloud Storage objects that they do not usually access.

Strategy

Monitor Google Cloud Audit logs to identify when a Google Cloud identity makes an anomalous number of storage.objects.get calls to a unique number of Google Cloud Storage buckets (bucket_name).

Triage and response

  1. Determine if the user: {{@usr.id}} should be accessing the storage buckets.
    • Here is a list of buckets that were accessed (up to 10): {{bucket_name}}
  2. If the action is legitimate, consider including the user in a suppression list. See this article on Best practices for creating detection rules with Datadog Cloud SIEM for more information.
  3. Otherwise, use the Cloud SIEM - User Investigation dashboard to see if the User: {{@usr.id}} has taken other actions.
  4. If the results of the triage indicate that an attacker has taken the action, begin your company’s incident response process and investigate.