GCP

This page contains the Stratus attack techniques for GCP, grouped by MITRE ATT&CK Tactic. Note that some Stratus attack techniques may correspond to more than a single ATT&CK Tactic.

Initial Access

• Steal and Use the GCE Default Service Account Token from Outside Google Cloud

Persistence

• Register SSH public key to instance metadata

• Backdoor a GCP Service Account through its IAM Policy

• Create an Admin GCP Service Account

• Create a GCP Service Account Key

• Invite an External User to a GCP Project

Privilege Escalation

• Create an Admin GCP Service Account

• Create a GCP Service Account Key

• Impersonate GCP Service Accounts

Defense Evasion

• Delete a Cloud DNS Logging Policy

• Disable Data Access Audit Logs for a GCP Service

• Attempt to Remove a GCP Project from its Organization

• Disable VPC Flow Logs on a Subnet

• Delete a GCP Log Sink

• Disable a GCP Log Sink

• Reduce Log Retention Period on a Cloud Logging Sink Bucket

Credential Access

• Retrieve a High Number of Secret Manager secrets

• Steal and Use the GCE Default Service Account Token from Outside Google Cloud

Discovery

• Read GCE Instance Metadata via the Compute API

• Enumerate Permissions of a GCP Service Account

Lateral Movement

• Register SSH public key to instance metadata

Exfiltration

• Exfiltrate Compute Disk by sharing it

• Exfiltrate Compute Image by sharing it

• Exfiltrate Compute Disk by sharing a snapshot

Impact

• Create a GCE GPU Virtual Machine

• Create GCE Instances in Multiple Zones

• GCS Ransomware through client-side encryption

• GCS Ransomware through individual file deletion