An Adventure in Google Cloud threat detection

This post presents practical Google Cloud threat detection techniques aligned to attacker TTPs, including detections for service account key creation (persistence), anomalous GPU-based VM creation for cryptomining, misuse of default service accounts from outside GCP, Cloud SQL export exfiltration to external buckets, SSH key injection via project metadata, and creation of privileged service accounts. It provides example commands (gcloud/Stratus Red Team), representative audit log snippets, and precise log query patterns with enrichment guidance (e.g., IP intelligence, exclusions) to improve detection fidelity and reduce false positives.