GCP

This page contains the Stratus attack techniques for GCP, grouped by MITRE ATT&CK Tactic. Note that some Stratus attack techniques may correspond to more than a single ATT&CK Tactic.

Persistence

• Backdoor a GCP Service Account through its IAM Policy

• Create an Admin GCP Service Account

• Create a GCP Service Account Key

• Invite an External User to a GCP Project

Privilege Escalation

• Create an Admin GCP Service Account

• Create a GCP Service Account Key

• Impersonate GCP Service Accounts

Credential Access

• Retrieve a High Number of Secret Manager secrets

Exfiltration

• Exfiltrate Compute Disk by sharing it

• Exfiltrate Compute Image by sharing it

• Exfiltrate Compute Disk by sharing a snapshot