Google Cloud Platform Exfiltration: A Threat Hunting Guide

**Executive Summary:** This report describes a GCP-focused data-exfiltration technique where an attacker who compromises a developer account recreates sensitive Compute Images in a project with storage permissions, uses Cloud Build to export images into Cloud Storage, and then copies those objects to an external attacker bucket; the report details relevant log events (e.g., v1.compute.images.insert, storage.objects.create/get/list, ServiceUsage.EnableService), highlights detection gaps in Cloud Storage logging, and recommends mitigations such as VPC Service Controls and organization restriction headers.