Cloud Incident Response

Stage 1 · Initial accessEverything one access key did, from where, with which client

No trail at all? aws iam get-access-key-last-used --access-key-id <AKIA...> still gives the last service, region and time. A key AWS found in public is also announced as an AWS Health event AWS_RISK_CREDENTIALS_EXPOSED and a quarantine policy on the user.

-- first and last use per source: which (IP, user agent) pairs are the owner, which are the attacker
SELECT sourceipaddress, useragent, min(eventtime) AS first_seen, max(eventtime) AS last_seen,
       count(*) AS calls, count_if(errorcode IS NOT NULL) AS errors,
       array_join(array_agg(DISTINCT eventsource), ',') AS services
FROM cloudtrail_logs
WHERE useridentity.accesskeyid = '<AKIA...>'
  AND eventtime > '<window-start ISO8601>'
GROUP BY 1, 2 ORDER BY first_seen;

-- then the full timeline for the attacker's pairs
SELECT eventtime, awsregion, eventsource, eventname, sourceipaddress, useragent, errorcode, requestparameters
FROM cloudtrail_logs
WHERE useridentity.accesskeyid = '<AKIA...>' AND sourceipaddress IN ('<attacker-ip>')
ORDER BY eventtime;

# no Athena: one region, 90 days, IP and UA pulled out of the CloudTrailEvent string
aws cloudtrail lookup-events --region <region> --start-time <window-start> \
  --lookup-attributes AttributeKey=AccessKeyId,AttributeValue=<AKIA...> --output json \
  | jq -r '.Events[].CloudTrailEvent | fromjson
           | [.eventTime, .awsRegion, .eventSource, .eventName, .sourceIPAddress, .userAgent, (.errorCode // "")] | @tsv'

Stage 2 · DiscoveryEnumeration bursts and permission probing

SELECT useridentity.arn AS principal, sourceipaddress, useragent,
       date_trunc('hour', from_iso8601_timestamp(eventtime)) AS hour,
       count(DISTINCT eventname) AS distinct_calls,
       count_if(errorcode = 'AccessDenied') AS denied,
       count_if(eventname IN ('GetCallerIdentity','ListBuckets','GetAccountAuthorizationDetails','ListSecrets',
                              'ListUsers','ListRoles','ListAccessKeys','GetAccountSummary','DescribeRegions')) AS hallmark_calls,
       array_join(array_agg(DISTINCT eventsource), ',') AS services
FROM cloudtrail_logs
WHERE eventtime > '<window-start ISO8601>' AND readonly = 'true'
GROUP BY 1, 2, 3, 4
HAVING count(DISTINCT eventname) > 40 OR count_if(errorcode = 'AccessDenied') > 20
ORDER BY denied DESC, distinct_calls DESC;

Stage 3 · Privilege escalationPolicies, boundaries and trust changed; a role handed to compute

The before/after of a policy version: aws iam get-policy-version --policy-arn <arn> --version-id v<n> for the attacker's version and the previous one. The T0 dump from the Preserve step is the authoritative “before”.

SELECT eventtime, eventsource, eventname, useridentity.arn AS actor, sourceipaddress, requestparameters, errorcode
FROM cloudtrail_logs
WHERE eventtime > '<window-start ISO8601>' AND (
      (eventsource = 'iam.amazonaws.com' AND eventname IN (
         'CreatePolicyVersion','SetDefaultPolicyVersion','AttachUserPolicy','AttachRolePolicy','AttachGroupPolicy',
         'PutUserPolicy','PutRolePolicy','PutGroupPolicy','AddUserToGroup','UpdateAssumeRolePolicy',
         'PutUserPermissionsBoundary','DeleteUserPermissionsBoundary','PutRolePermissionsBoundary','DeleteRolePermissionsBoundary',
         'CreateLoginProfile','UpdateLoginProfile'))
   OR (eventsource = 'sso.amazonaws.com' AND eventname IN (
         'CreateAccountAssignment','CreatePermissionSet','AttachManagedPolicyToPermissionSet',
         'PutInlinePolicyToPermissionSet','AttachCustomerManagedPolicyReferenceToPermissionSet'))
   -- iam:PassRole: a privileged role attached to compute at launch
   OR (eventname IN ('RunInstances','CreateFunction20150331','CreateStack','CreateAutoScalingGroup','RegisterTaskDefinition')
       AND regexp_like(requestparameters, 'iamInstanceProfile|"role"|roleArn|RoleARN')))
ORDER BY eventtime;

Stage 4 · PersistenceUsers, keys, MFA, identity providers, functions, rules, SSM, Roles Anywhere

Lambda event names carry an API-version suffix (CreateFunction20150331, UpdateFunctionCode…, AddPermission20150331v2), hence the LIKE. For every hit, the T0 dump answers whether the object existed before the incident.

SELECT eventtime, awsregion, eventsource, eventname, useridentity.arn AS actor, sourceipaddress, requestparameters
FROM cloudtrail_logs
WHERE eventtime > '<window-start ISO8601>' AND errorcode IS NULL AND (
      (eventsource = 'iam.amazonaws.com' AND eventname IN (
         'CreateUser','CreateAccessKey','CreateLoginProfile','UpdateLoginProfile','CreateRole','UpdateAssumeRolePolicy',
         'CreateSAMLProvider','UpdateSAMLProvider','CreateOpenIDConnectProvider','AddClientIDToOpenIDConnectProvider',
         'UpdateOpenIDConnectProviderThumbprint','CreateVirtualMFADevice','EnableMFADevice','DeactivateMFADevice',
         'DeleteVirtualMFADevice','UpdateAccountPasswordPolicy','DeleteAccountPasswordPolicy',
         'CreateServiceSpecificCredential','UploadSSHPublicKey','UploadSigningCertificate'))
   OR (eventsource = 'lambda.amazonaws.com' AND (eventname LIKE 'CreateFunction%' OR eventname LIKE 'UpdateFunctionCode%'
         OR eventname LIKE 'UpdateFunctionConfiguration%' OR eventname LIKE 'AddPermission%' OR eventname LIKE 'CreateEventSourceMapping%'
         OR eventname = 'CreateFunctionUrlConfig'))
   OR (eventsource = 'events.amazonaws.com' AND eventname IN ('PutRule','PutTargets'))
   OR (eventsource = 'ssm.amazonaws.com' AND eventname IN ('CreateAssociation','UpdateAssociation','SendCommand','StartSession','CreateDocument','UpdateDocument'))
   OR (eventsource = 'rolesanywhere.amazonaws.com' AND eventname IN ('CreateTrustAnchor','UpdateTrustAnchor','CreateProfile','UpdateProfile'))
   OR (eventsource = 'sso.amazonaws.com' AND eventname IN ('CreateAccountAssignment','CreatePermissionSet','CreateInstance'))
   OR (eventsource = 'ec2.amazonaws.com' AND eventname IN ('ModifyInstanceAttribute','CreateLaunchTemplateVersion') AND requestparameters LIKE '%userData%'))
ORDER BY eventtime;

Stage 5 · Defence evasionLogging and detection switched off, narrowed or starved

SELECT eventtime, awsregion, eventsource, eventname, useridentity.arn AS actor, sourceipaddress, requestparameters
FROM cloudtrail_logs
WHERE eventtime > '<window-start ISO8601>' AND errorcode IS NULL AND (
      (eventsource = 'cloudtrail.amazonaws.com' AND eventname IN (
         'StopLogging','DeleteTrail','UpdateTrail','PutEventSelectors','PutInsightSelectors',
         'DeleteEventDataStore','UpdateEventDataStore','StopEventDataStoreIngestion'))
   OR (eventsource = 'guardduty.amazonaws.com' AND eventname IN (
         'DeleteDetector','UpdateDetector','CreateFilter','UpdateFilter','CreateIPSet','UpdateIPSet',
         'CreateThreatIntelSet','UpdateThreatIntelSet','DeleteMembers','DisassociateFromAdministratorAccount',
         'DeletePublishingDestination','UpdateMalwareScanSettings'))
   OR (eventsource = 'config.amazonaws.com' AND eventname IN ('StopConfigurationRecorder','DeleteConfigurationRecorder','DeleteDeliveryChannel','DeleteConfigRule'))
   OR (eventsource = 'securityhub.amazonaws.com' AND eventname IN ('DisableSecurityHub','BatchDisableStandards','DisableImportFindingsForProduct'))
   OR (eventsource = 'ec2.amazonaws.com' AND eventname = 'DeleteFlowLogs')
   OR (eventsource = 'macie2.amazonaws.com' AND eventname = 'DisableMacie')
   OR (eventsource = 'detective.amazonaws.com' AND eventname = 'DeleteGraph')
   OR (eventsource = 'logs.amazonaws.com' AND eventname IN ('DeleteLogGroup','PutRetentionPolicy','DeleteSubscriptionFilter','DeleteResourcePolicy'))
   OR (eventsource = 's3.amazonaws.com'
       AND eventname IN ('PutBucketLifecycle','PutBucketPolicy','DeleteBucketPolicy','PutBucketVersioning','DeleteBucket','PutBucketAcl')
       AND json_extract_scalar(requestparameters, '$.bucketName') IN ('<trail-bucket>', '<flow-log-bucket>')))
ORDER BY eventtime;

Stage 5 · Defence evasionGuardDuty findings you haven't read, log-file integrity, Insights

aws guardduty list-findings --region <region> --detector-id <detector-id> --finding-criteria '{"Criterion":{"type":{"Eq":[
  "Stealth:IAMUser/CloudTrailLoggingDisabled","Stealth:IAMUser/PasswordPolicyChange","Policy:IAMUser/RootCredentialUsage",
  "UnauthorizedAccess:IAMUser/TorIPCaller","UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS",
  "Discovery:IAMUser/AnomalousBehavior","Persistence:IAMUser/AnomalousBehavior","Exfiltration:IAMUser/AnomalousBehavior",
  "CredentialAccess:IAMUser/AnomalousBehavior","DefenseEvasion:IAMUser/AnomalousBehavior"]}}}' \
  | jq -r '.FindingIds[]' | xargs -r aws guardduty get-findings --region <region> --detector-id <detector-id> --finding-ids \
  | jq -r '.Findings[] | [.UpdatedAt, .Type, .Severity, .Resource.AccessKeyDetails.UserName // "", .Title] | @tsv'

# were the delivered log files tampered with after the fact?
aws cloudtrail validate-logs --region <trail-home-region> --trail-arn <org-trail-arn> --start-time <window-start>

# Insights (only if PutInsightSelectors was ever applied to the trail)
aws cloudtrail lookup-events --region <region> --event-category insight --start-time <window-start> \
  --query 'Events[].[EventTime,EventName,Resources[0].ResourceName]' --output table

Stage 6 · Lateral movementRole chains and cross-account assumption

Console role switches are SwitchRole under signin.amazonaws.com. The same principal or IP in a partner's or customer's trail is the next question — ask them.

SELECT eventtime, useridentity.type AS caller_type, useridentity.arn AS caller,
       useridentity.sessioncontext.sessionissuer.arn AS caller_role,
       json_extract_scalar(requestparameters, '$.roleArn') AS target_role,
       json_extract_scalar(requestparameters, '$.roleSessionName') AS session_name,
       useridentity.accountid AS from_account, recipientaccountid AS to_account,
       sharedeventid, sourceipaddress, useragent, errorcode
FROM cloudtrail_logs
WHERE eventsource = 'sts.amazonaws.com'
  AND eventname IN ('AssumeRole','AssumeRoleWithSAML','AssumeRoleWithWebIdentity','GetFederationToken','AssumeRoot')
  AND eventtime > '<window-start ISO8601>'
  AND useridentity.invokedby IS NULL                      -- drop AWS services assuming roles on your behalf
  AND (useridentity.accountid <> recipientaccountid        -- cross-account hop
       OR useridentity.type = 'AssumedRole')               -- role assuming a role: a chain
ORDER BY eventtime;

Stage 7 · Resource abuseCompute, fleets, GPUs, model access and quota increases in every region

What is live right now: loop aws ec2 describe-instances --region $r --filters Name=instance-state-name,Values=running --query 'Reservations[].Instances[].[InstanceId,InstanceType,LaunchTime]' over describe-regions. Bedrock InvokeModel is a data event; the entitlement calls below are management events.

SELECT eventtime, awsregion, eventsource, eventname, useridentity.arn AS actor, sourceipaddress,
       json_extract_scalar(requestparameters, '$.instanceType') AS instance_type, errorcode
FROM cloudtrail_logs
WHERE eventtime > '<window-start ISO8601>' AND useridentity.invokedby IS NULL AND (
      (eventsource = 'ec2.amazonaws.com' AND eventname IN ('RunInstances','CreateFleet','RequestSpotFleet','RequestSpotInstances','CreateLaunchTemplate'))
   OR (eventsource = 'sagemaker.amazonaws.com' AND eventname IN ('CreateNotebookInstance','CreateTrainingJob','CreateProcessingJob','CreateEndpoint'))
   OR (eventsource = 'ecs.amazonaws.com' AND eventname IN ('RunTask','CreateService','RegisterTaskDefinition'))
   OR (eventsource = 'eks.amazonaws.com' AND eventname IN ('CreateCluster','CreateNodegroup','CreateFargateProfile'))
   OR (eventsource = 'lightsail.amazonaws.com' AND eventname IN ('CreateInstances','CreateContainerService'))
   OR (eventsource = 'batch.amazonaws.com' AND eventname IN ('CreateComputeEnvironment','SubmitJob'))
   OR (eventsource = 'servicequotas.amazonaws.com' AND eventname = 'RequestServiceQuotaIncrease')
   OR (eventsource = 'bedrock.amazonaws.com' AND eventname IN ('PutFoundationModelEntitlement','PutUseCaseForModelAccess','CreateModelInvocationJob','InvokeModel')))
ORDER BY eventtime;

Stage 8 · Data accessStorage opened, snapshots shared, secrets read, disks exported

SELECT eventtime, awsregion, eventsource, eventname, useridentity.arn AS actor, sourceipaddress, requestparameters
FROM cloudtrail_logs
WHERE eventtime > '<window-start ISO8601>' AND errorcode IS NULL AND (
      (eventsource = 's3.amazonaws.com' AND (eventname IN ('PutBucketPolicy','PutBucketAcl','PutAccessPointPolicy','PutBucketCors')
                                             OR eventname LIKE '%PublicAccessBlock%'))
   OR (eventsource = 'ec2.amazonaws.com' AND eventname IN ('ModifySnapshotAttribute','ModifyImageAttribute','CopySnapshot','CreateSnapshot','CreateSnapshots','CreateImage'))
   OR (eventsource = 'rds.amazonaws.com' AND eventname IN ('ModifyDBSnapshotAttribute','ModifyDBClusterSnapshotAttribute','CopyDBSnapshot','CreateDBSnapshot','StartExportTask'))
   OR (eventsource = 'secretsmanager.amazonaws.com' AND eventname IN ('GetSecretValue','BatchGetSecretValue','ListSecrets','PutResourcePolicy'))
   OR (eventsource = 'ssm.amazonaws.com' AND eventname IN ('GetParameter','GetParameters','GetParametersByPath') AND requestparameters LIKE '%"withDecryption":true%')
   OR (eventsource = 'kms.amazonaws.com' AND eventname IN ('PutKeyPolicy','CreateGrant','ReplicateKey'))
   OR (eventsource = 'dynamodb.amazonaws.com' AND eventname = 'ExportTableToPointInTime')
   OR (eventsource = 'sts.amazonaws.com' AND eventname = 'GetFederationToken'))
ORDER BY eventtime;

Stage 8 · Data accessWhat was read — object-level S3 data events

-- requires S3 data events on the trail (eventCategory = Data); bytesTransferredOut is in additionaleventdata
SELECT useridentity.arn AS actor, sourceipaddress, useragent,
       json_extract_scalar(requestparameters, '$.bucketName') AS bucket,
       count(*) AS reads,
       sum(cast(json_extract_scalar(additionaleventdata, '$.bytesTransferredOut') AS bigint)) AS bytes_out,
       min(eventtime) AS first_read, max(eventtime) AS last_read
FROM cloudtrail_logs
WHERE eventsource = 's3.amazonaws.com'
  AND eventname IN ('GetObject','HeadObject','ListObjects','ListObjectsV2','CopyObject','SelectObjectContent','GetObjectTorrent')
  AND eventtime > '<window-start ISO8601>'
  AND (useridentity.accesskeyid = '<AKIA... or ASIA...>' OR sourceipaddress IN ('<attacker-ip>'))
GROUP BY 1, 2, 3, 4
ORDER BY bytes_out DESC;

Stage 8 · Data accessBytes out of a compromised instance — VPC flow logs

-- table from the VPC flow logs Athena DDL (default v2 fields); "end" is reserved, hence the quotes
SELECT dstaddr, dstport, protocol, sum(bytes) AS bytes, count(*) AS flows,
       from_unixtime(min(start)) AS first_seen, from_unixtime(max("end")) AS last_seen
FROM vpc_flow_logs
WHERE interface_id = '<eni-of-compromised-instance>' AND action = 'ACCEPT'
  AND start > to_unixtime(timestamp '<window-start, e.g. 2026-09-20 00:00:00>')
GROUP BY 1, 2, 3
ORDER BY bytes DESC
LIMIT 50;

Stage 9 · ImpactDeletion, re-encryption, lifecycle wipes, backup and key destruction

A DeleteObject whose requestparameters carries a versionId is a permanent delete of that version, not a delete marker. DeleteObjects and SSE-C writes are data events.

SELECT eventtime, awsregion, eventsource, eventname, useridentity.arn AS actor, sourceipaddress,
       json_extract_scalar(additionaleventdata, '$.SSEApplied') AS sse, requestparameters
FROM cloudtrail_logs
WHERE eventtime > '<window-start ISO8601>' AND errorcode IS NULL AND (
      (eventsource = 's3.amazonaws.com' AND eventname IN ('DeleteBucket','PutBucketLifecycle','PutBucketReplication','DeleteBucketReplication',
                                                          'PutBucketVersioning','PutBucketEncryption','PutObjectLockConfiguration'))
   OR (eventsource = 's3.amazonaws.com' AND eventname IN ('DeleteObjects','DeleteObject','PutObject','CopyObject')     -- data events
       AND (json_extract_scalar(additionaleventdata, '$.SSEApplied') = 'SSE_C' OR eventname LIKE 'Delete%'))
   OR (eventsource = 'ec2.amazonaws.com' AND eventname IN ('DeleteSnapshot','DeregisterImage','DeleteVolume','TerminateInstances'))
   OR (eventsource = 'rds.amazonaws.com' AND eventname IN ('DeleteDBSnapshot','DeleteDBClusterSnapshot','DeleteDBInstance','DeleteDBCluster'))
   OR (eventsource = 'backup.amazonaws.com' AND eventname IN ('DeleteBackupVault','DeleteRecoveryPoint','DeleteBackupPlan','DeleteBackupSelection',
                                                              'PutBackupVaultAccessPolicy','DeleteBackupVaultLockConfiguration'))
   OR (eventsource = 'kms.amazonaws.com' AND eventname IN ('ScheduleKeyDeletion','DisableKey','DeleteAlias','DeleteImportedKeyMaterial','PutKeyPolicy'))
   OR (eventsource = 'dynamodb.amazonaws.com' AND eventname IN ('DeleteTable','DeleteBackup','UpdateContinuousBackups'))
   OR (eventsource = 'glacier.amazonaws.com' AND eventname IN ('DeleteVault','DeleteArchive'))
   OR (eventsource = 'organizations.amazonaws.com' AND eventname IN ('CloseAccount','LeaveOrganization','RemoveAccountFromOrganization')))
ORDER BY eventtime;

Stage 1 · Initial accessUsers, service principals and managed identities signing in from new places

let window = 7d; let baseline = 30d;
let signins = union isfuzzy=true
    (SigninLogs                        | extend Principal = UserPrincipalName,  Kind = "user"),
    (AADNonInteractiveUserSignInLogs   | extend Principal = UserPrincipalName,  Kind = "user-noninteractive"),
    (AADServicePrincipalSignInLogs     | extend Principal = ServicePrincipalName, Kind = "service-principal"),
    (AADManagedIdentitySignInLogs      | extend Principal = ServicePrincipalName, Kind = "managed-identity")
  | where TimeGenerated > ago(baseline)
  | project TimeGenerated, Principal, Kind, IPAddress, ResultType, ResourceDisplayName;
let known = signins | where TimeGenerated between (ago(baseline) .. ago(window)) | distinct Principal, IPAddress;
signins
| where TimeGenerated > ago(window)
| join kind=leftanti known on Principal, IPAddress
| summarize FirstSeen = min(TimeGenerated), Calls = count(), Failures = countif(ResultType != "0"),
            Resources = make_set(ResourceDisplayName, 5) by Principal, Kind, IPAddress
| order by FirstSeen desc

Stage 2 · DiscoveryGraph and ARM enumeration — AzureHound, ROADtools and friends

Graph activity logs off? Fall back to union SigninLogs, AADNonInteractiveUserSignInLogs | where ResourceDisplayName in ("Microsoft Graph", "Windows Azure Service Management API") | where UserAgent has_any ("python", "azurehound", "roadtx", "go-http") — you see the token being obtained, not what it fetched.

MicrosoftGraphActivityLogs
| where TimeGenerated > ago(14d)
| where RequestMethod == "GET"
| where UserAgent has_any ("python-requests", "azurehound", "roadtx", "roadrecon", "AADInternals", "GraphRunner", "go-http-client")
   or RequestUri has_any ("/directoryRoles", "/roleManagement/directory/roleAssignments", "/servicePrincipals",
                          "/applications", "/users?$top=999", "/groups?$top=999", "/devices?$top=999")
| summarize Calls = count(), DistinctUris = dcount(RequestUri), Status = make_set(ResponseStatusCode, 5),
            First = min(TimeGenerated), Last = max(TimeGenerated)
    by Who = coalesce(UserId, ServicePrincipalId), AppId, IPAddress, UserAgent
| where Calls > 200 or UserAgent has_any ("azurehound", "roadtx", "roadrecon", "AADInternals", "GraphRunner")
| order by Calls desc

Stage 3 · Privilege escalationElevate access, role assignments, custom roles and PIM requests

Current state, independent of log retention: az graph query -q "authorizationresources | where type == 'microsoft.authorization/roleassignments' | extend p = properties | where todatetime(p.createdOn) > ago(30d) | project p.createdOn, p.principalId, p.principalType, p.roleDefinitionId, p.scope". Owner is 8e3af657-a8ff-443c-a75c-2fe8c4bcb635, User Access Administrator 18d7d88d-d35e-4fb5-a5c3-7773c20a72d9.

let elevate = AuditLogs
| where TimeGenerated > ago(30d)
| where LoggedByService == "Azure RBAC (Elevated Access)" or OperationName has "elevated their access"
| project TimeGenerated, Source = "Entra", Operation = OperationName,
          Who = tostring(InitiatedBy.user.userPrincipalName), IP = tostring(InitiatedBy.user.ipAddress), Detail = Result;
let rbac = AzureActivity
| where TimeGenerated > ago(30d)
| where ActivityStatusValue =~ "Success"
| where OperationNameValue in~ ("MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE", "MICROSOFT.AUTHORIZATION/ROLEDEFINITIONS/WRITE",
                               "MICROSOFT.AUTHORIZATION/ROLEELIGIBILITYSCHEDULEREQUESTS/WRITE",
                               "MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTSCHEDULEREQUESTS/WRITE")
| extend body = parse_json(tostring(parse_json(Properties).requestbody))
| extend Detail = strcat(tostring(body.Properties.PrincipalType), " ", tostring(body.Properties.PrincipalId),
                         " -> ", tostring(body.Properties.RoleDefinitionId), " @ ", tostring(body.Properties.Scope))
| project TimeGenerated, Source = "ARM", Operation = OperationNameValue, Who = Caller, IP = CallerIpAddress, Detail;
elevate | union rbac | order by TimeGenerated desc

Stage 4 · PersistenceCredentials, federated credentials, owners, roles, CA policy; extensions, run commands, runbooks, functions, subscriptions

MICROSOFT.SUBSCRIPTION/ALIASES/WRITE is logged at tenant scope and only lands in a workspace if the tenant-level Activity Log is exported; the list of subscriptions in Resource Graph (resourcecontainers | where type == 'microsoft.resources/subscriptions') is the reliable check.

let entra = AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName in ("Add service principal credentials", "Update application – Certificates and secrets management",
                          "Add owner to application", "Add owner to service principal", "Add app role assignment to service principal",
                          "Consent to application", "Add member to role", "Add eligible member to role",
                          "Update conditional access policy", "Delete conditional access policy", "Add user",
                          "User registered security info", "Add partner to company")
   or (OperationName == "Update application" and tostring(TargetResources[0].modifiedProperties) has "FederatedIdentityCredentials")
| project TimeGenerated, Source = "Entra", Operation = OperationName,
          Who = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName)),
          IP = tostring(InitiatedBy.user.ipAddress), Target = tostring(TargetResources[0].displayName), Detail = Result;
let arm = AzureActivity
| where TimeGenerated > ago(30d)
| where ActivityStatusValue =~ "Success"
| where OperationNameValue in~ ("MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE", "MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION",
        "MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMANDS/WRITE", "MICROSOFT.COMPUTE/VIRTUALMACHINESCALESETS/EXTENSIONS/WRITE",
        "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/WRITE", "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/RUNBOOKS/DRAFT/CONTENT/WRITE",
        "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/JOBSCHEDULES/WRITE", "MICROSOFT.AUTOMATION/AUTOMATIONACCOUNTS/WEBHOOKS/WRITE",
        "MICROSOFT.LOGIC/WORKFLOWS/WRITE", "MICROSOFT.WEB/SITES/WRITE", "MICROSOFT.WEB/SITES/CONFIG/WRITE",
        "MICROSOFT.MANAGEDIDENTITY/USERASSIGNEDIDENTITIES/WRITE",
        "MICROSOFT.MANAGEDIDENTITY/USERASSIGNEDIDENTITIES/FEDERATEDIDENTITYCREDENTIALS/WRITE",
        "MICROSOFT.KEYVAULT/VAULTS/ACCESSPOLICIES/WRITE", "MICROSOFT.SUBSCRIPTION/ALIASES/WRITE")
| project TimeGenerated, Source = "ARM", Operation = OperationNameValue, Who = Caller, IP = CallerIpAddress, Target = ResourceId, Detail = ActivityStatusValue;
entra | union arm | order by TimeGenerated desc

Stage 5 · Defence evasionDiagnostic settings, workspaces, Defender plans, Sentinel connectors, policy and locks removed

AzureActivity
| where TimeGenerated > ago(30d)
| where ActivityStatusValue =~ "Success"
| where OperationNameValue in~ ("MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/DELETE", "MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE",
        "MICROSOFT.OPERATIONALINSIGHTS/WORKSPACES/DELETE", "MICROSOFT.OPERATIONALINSIGHTS/WORKSPACES/DATAEXPORTS/DELETE",
        "MICROSOFT.OPERATIONALINSIGHTS/WORKSPACES/TABLES/WRITE",
        "MICROSOFT.SECURITY/PRICINGS/WRITE", "MICROSOFT.SECURITY/SETTINGS/WRITE", "MICROSOFT.SECURITY/AUTOMATIONS/DELETE",
        "MICROSOFT.SECURITYINSIGHTS/DATACONNECTORS/DELETE", "MICROSOFT.SECURITYINSIGHTS/ALERTRULES/DELETE",
        "MICROSOFT.AUTHORIZATION/POLICYASSIGNMENTS/DELETE", "MICROSOFT.AUTHORIZATION/POLICYEXEMPTIONS/WRITE",
        "MICROSOFT.AUTHORIZATION/LOCKS/DELETE", "MICROSOFT.NETWORK/NETWORKWATCHERS/FLOWLOGS/DELETE",
        "MICROSOFT.EVENTHUB/NAMESPACES/EVENTHUBS/DELETE")
| project TimeGenerated, OperationNameValue, Caller, CallerIpAddress, ResourceId, SubscriptionId
| order by TimeGenerated desc

Stage 5 · Defence evasionDefender for Cloud alerts nobody read

SecurityAlert
| where TimeGenerated > ago(14d)
| where ProductName in ("Azure Security Center", "Microsoft Defender for Cloud", "Azure Active Directory Identity Protection", "Microsoft Defender for Identity")
| project TimeGenerated, AlertName, AlertSeverity, CompromisedEntity, Tactics, Description
| order by TimeGenerated desc

Stage 6 · Lateral movementA principal reaching subscriptions it never touched; Lighthouse, management groups, tenant moves

Delegations in force now: az managedservices assignment list --include-definition for Lighthouse, Get-MgTenantRelationshipDelegatedAdminRelationship for GDAP partners.

let baseline = AzureActivity | where TimeGenerated between (ago(30d) .. ago(7d)) | distinct Caller, SubscriptionId;
AzureActivity
| where TimeGenerated > ago(7d)
| join kind=leftanti baseline on Caller, SubscriptionId
| summarize First = min(TimeGenerated), Ops = count(), Operations = make_set(OperationNameValue, 8),
            IPs = make_set(CallerIpAddress, 5) by Caller, SubscriptionId
| union (
    AzureActivity
    | where TimeGenerated > ago(7d)
    | where OperationNameValue in~ ("MICROSOFT.MANAGEDSERVICES/REGISTRATIONASSIGNMENTS/WRITE",
                                   "MICROSOFT.MANAGEDSERVICES/REGISTRATIONDEFINITIONS/WRITE",
                                   "MICROSOFT.MANAGEMENT/MANAGEMENTGROUPS/SUBSCRIPTIONS/WRITE",
                                   "MICROSOFT.SUBSCRIPTION/ACCEPTCHANGETENANT/ACTION")
    | project First = TimeGenerated, Caller, SubscriptionId, Ops = 1,
              Operations = pack_array(OperationNameValue), IPs = pack_array(CallerIpAddress))
| order by First desc

Stage 7 · Resource abuseVMs, scale sets, AKS, ML compute, Batch, Azure OpenAI deployments, quota tickets

AzureActivity
| where TimeGenerated > ago(14d)
| where ActivityStatusValue =~ "Success"
| where OperationNameValue in~ ("MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE", "MICROSOFT.COMPUTE/VIRTUALMACHINESCALESETS/WRITE",
        "MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/WRITE", "MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/AGENTPOOLS/WRITE",
        "MICROSOFT.MACHINELEARNINGSERVICES/WORKSPACES/COMPUTES/WRITE", "MICROSOFT.BATCH/BATCHACCOUNTS/POOLS/WRITE",
        "MICROSOFT.CONTAINERINSTANCE/CONTAINERGROUPS/WRITE", "MICROSOFT.COGNITIVESERVICES/ACCOUNTS/WRITE",
        "MICROSOFT.COGNITIVESERVICES/ACCOUNTS/DEPLOYMENTS/WRITE", "MICROSOFT.SUPPORT/SUPPORTTICKETS/WRITE",
        "MICROSOFT.QUOTA/QUOTAS/WRITE", "MICROSOFT.SUBSCRIPTION/ALIASES/WRITE")
| summarize Writes = count(), First = min(TimeGenerated), Last = max(TimeGenerated),
            Resources = make_set(ResourceId, 10) by Caller, CallerIpAddress, OperationNameValue, SubscriptionId
| order by Writes desc

Stage 7 · Resource abuseWhat is running now — GPU and HPC SKUs and anything created this week

az graph query --first 1000 -o table -q "
  resources
  | where type in~ ('microsoft.compute/virtualmachines', 'microsoft.compute/virtualmachinescalesets',
                    'microsoft.machinelearningservices/workspaces/computes', 'microsoft.cognitiveservices/accounts')
  | extend size = tostring(coalesce(properties.hardwareProfile.vmSize, sku.name)),
           created = todatetime(properties.timeCreated)
  | where size matches regex '^Standard_(N|H)' or created > ago(7d)
  | project created, name, type, location, size, subscriptionId, resourceGroup
  | order by created desc"

Stage 8 · Data accessStorage keys and SAS listed, vault and firewall opened, disks exported, commands run

AzureActivity
| where TimeGenerated > ago(14d)
| where ActivityStatusValue =~ "Success"
| where OperationNameValue in~ ("MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTKEYS/ACTION", "MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTACCOUNTSAS/ACTION",
        "MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTSERVICESAS/ACTION", "MICROSOFT.STORAGE/STORAGEACCOUNTS/REGENERATEKEY/ACTION",
        "MICROSOFT.STORAGE/STORAGEACCOUNTS/WRITE", "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/WRITE",
        "MICROSOFT.COMPUTE/SNAPSHOTS/BEGINGETACCESS/ACTION", "MICROSOFT.COMPUTE/DISKS/BEGINGETACCESS/ACTION",
        "MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION", "MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMANDS/WRITE",
        "MICROSOFT.DOCUMENTDB/DATABASEACCOUNTS/LISTKEYS/ACTION", "MICROSOFT.DOCUMENTDB/DATABASEACCOUNTS/LISTCONNECTIONSTRINGS/ACTION",
        "MICROSOFT.SQL/SERVERS/FIREWALLRULES/WRITE", "MICROSOFT.SQL/SERVERS/DATABASES/EXPORT/ACTION",
        "MICROSOFT.KEYVAULT/VAULTS/WRITE", "MICROSOFT.KEYVAULT/VAULTS/ACCESSPOLICIES/WRITE",
        "MICROSOFT.WEB/SITES/CONFIG/LIST/ACTION", "MICROSOFT.WEB/SITES/PUBLISHXML/ACTION")
| project TimeGenerated, OperationNameValue, Caller, CallerIpAddress, ResourceId
| order by TimeGenerated desc

Stage 8 · Data accessWhat was read — Key Vault and blob data-plane logs

let kv = AZKVAuditLogs
| where TimeGenerated > ago(14d)
| where OperationName in ("SecretGet", "SecretList", "SecretBackup", "KeyDecrypt", "KeyUnwrap", "KeySign", "KeyBackup", "CertificateGet",
                          "VaultAccessPolicyChangedEventGridNotification")
| extend Source = "KeyVault",
         Who = tostring(coalesce(Identity.claim["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"], Identity.claim.appid, Identity.claim.oid))
| summarize Calls = count(), Ops = make_set(OperationName, 10), Objects = dcount(Id), First = min(TimeGenerated), Last = max(TimeGenerated)
    by Source, Who, CallerIpAddress;
let blob = StorageBlobLogs
| where TimeGenerated > ago(14d)
| where OperationName in ("GetBlob", "ListBlobs", "CopyBlob", "GetBlobProperties", "ListContainers")
| extend Source = "Blob", Who = strcat(AuthenticationType, ":", coalesce(RequesterObjectId, RequesterAppId, AuthenticationHash))
| summarize Calls = count(), Ops = make_set(OperationName, 10), Objects = dcount(ObjectKey), First = min(TimeGenerated), Last = max(TimeGenerated)
    by Source, Who, CallerIpAddress;
kv | union blob | order by Calls desc

Stage 8 · Data accessBytes out of a compromised VM — VNet flow logs

NTANetAnalytics
| where TimeGenerated > ago(7d)
| where SubType == "FlowLog"
| where SrcIp == "<vm-private-ip>"
| where FlowType in ("ExternalPublic", "MaliciousFlow", "AzurePublic")
| summarize Bytes = sum(BytesSrcToDest + BytesDestToSrc), Flows = count(), First = min(TimeGenerated), Last = max(TimeGenerated)
    by DestIp, DestPublicIps, DestPort, L4Protocol, FlowType
| order by Bytes desc
| take 50

Stage 9 · ImpactBackups, snapshots, vaults, keys and locks deleted; soft delete switched off; mass blob deletes

let arm = AzureActivity
| where TimeGenerated > ago(14d)
| where ActivityStatusValue =~ "Success"
| where OperationNameValue in~ ("MICROSOFT.RECOVERYSERVICES/VAULTS/DELETE", "MICROSOFT.RECOVERYSERVICES/VAULTS/BACKUPCONFIG/WRITE",
        "MICROSOFT.RECOVERYSERVICES/VAULTS/BACKUPFABRICS/PROTECTIONCONTAINERS/PROTECTEDITEMS/DELETE",
        "MICROSOFT.RECOVERYSERVICES/VAULTS/BACKUPFABRICS/PROTECTIONCONTAINERS/PROTECTEDITEMS/RECOVERYPOINTS/DELETE",
        "MICROSOFT.DATAPROTECTION/BACKUPVAULTS/DELETE", "MICROSOFT.DATAPROTECTION/BACKUPVAULTS/BACKUPINSTANCES/DELETE",
        "MICROSOFT.DATAPROTECTION/RESOURCEGUARDS/DELETE",
        "MICROSOFT.COMPUTE/SNAPSHOTS/DELETE", "MICROSOFT.COMPUTE/DISKS/DELETE", "MICROSOFT.COMPUTE/VIRTUALMACHINES/DELETE",
        "MICROSOFT.COMPUTE/RESTOREPOINTCOLLECTIONS/DELETE",
        "MICROSOFT.STORAGE/STORAGEACCOUNTS/DELETE", "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/DELETE",
        "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/WRITE", "MICROSOFT.STORAGE/STORAGEACCOUNTS/MANAGEMENTPOLICIES/WRITE",
        "MICROSOFT.STORAGE/STORAGEACCOUNTS/ENCRYPTIONSCOPES/WRITE",
        "MICROSOFT.KEYVAULT/VAULTS/DELETE", "MICROSOFT.KEYVAULT/MANAGEDHSMS/DELETE", "MICROSOFT.KEYVAULT/LOCATIONS/DELETEDVAULTS/PURGE/ACTION",
        "MICROSOFT.SQL/SERVERS/DATABASES/DELETE", "MICROSOFT.SQL/SERVERS/DELETE", "MICROSOFT.DBFORPOSTGRESQL/FLEXIBLESERVERS/DELETE",
        "MICROSOFT.AUTHORIZATION/LOCKS/DELETE", "MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE",
        "MICROSOFT.RESOURCES/DEPLOYMENTSTACKS/DELETE")
| project TimeGenerated, Source = "ARM", Op = OperationNameValue, Who = Caller, IP = CallerIpAddress, Target = ResourceId;
let blob = StorageBlobLogs
| where TimeGenerated > ago(14d)
| where OperationName in ("DeleteBlob", "DeleteContainer", "SetBlobTier", "PutBlob", "CopyBlob")
| summarize Count = count(), First = min(TimeGenerated)
    by bin(TimeGenerated, 1h), OperationName, AuthenticationType, Who = coalesce(RequesterObjectId, RequesterAppId, AuthenticationHash),
       IP = CallerIpAddress, AccountName
| where Count > 500
| project TimeGenerated = First, Source = "Blob", Op = strcat(OperationName, " x", Count), Who, IP, Target = AccountName;
arm | union blob | order by TimeGenerated desc

Stage 1 · Initial accessEverything one principal did, from where, with which client and which key

Keys and their state: gcloud iam service-accounts keys list --iam-account=<sa-email> --format='table(name.basename(),validAfterTime,disabled,keyType)'. If the organisation policy iam.serviceAccountKeyExposureResponse is DISABLE_KEY (the default since June 2024), Google disables a key it finds in a public repository and writes an audit-log event and an email to the project owners and security contacts; under WAIT_FOR_ABUSE it only notifies.

gcloud logging read \
  'logName:"cloudaudit.googleapis.com" AND protoPayload.authenticationInfo.principalEmail="<principal-email>"' \
  --project=<project-id> --freshness=14d --order=asc \
  --format='table(timestamp,protoPayload.serviceName,protoPayload.methodName,protoPayload.requestMetadata.callerIp,protoPayload.requestMetadata.callerSuppliedUserAgent,protoPayload.authenticationInfo.serviceAccountKeyName,protoPayload.status.code)'

Stage 2 · DiscoveryEnumeration and permission probing — only visible with Data Access logs on

SCC findings for the window: gcloud scc findings list <org-id> --source=- --filter='category="Discovery: Service Account Self-Investigation" AND state="ACTIVE"' (Premium or Enterprise tier).

gcloud logging read \
  'logName:"cloudaudit.googleapis.com%2Fdata_access" AND
   protoPayload.methodName:("GetIamPolicy" OR "TestIamPermissions" OR "ListServiceAccounts" OR "ListServiceAccountKeys" OR
                            "SearchAllIamPolicies" OR "SearchAllResources" OR "ListProjects" OR "storage.buckets.list" OR
                            "ListSecrets" OR "ListCryptoKeys" OR "compute.instances.list" OR "compute.projects.get")' \
  --project=<project-id> --freshness=7d \
  --format='table(timestamp,protoPayload.authenticationInfo.principalEmail,protoPayload.methodName,protoPayload.requestMetadata.callerIp,protoPayload.requestMetadata.callerSuppliedUserAgent)'

Stage 3 · Privilege escalationIAM bindings added, with the member and the role

Organisation- and folder-level bindings are logged at that resource: rerun with --organization=<org-id> or --folder=<id>. The before/after policy, independent of log retention: gcloud asset get-history --project=<project-id> --asset-names=//cloudresourcemanager.googleapis.com/projects/<project-id> --content-type=iam-policy --start-time=<window-start>.

gcloud logging read \
  'logName:"cloudaudit.googleapis.com%2Factivity" AND protoPayload.methodName:"SetIamPolicy" AND
   protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD"' \
  --project=<project-id> --freshness=14d \
  --format='table(timestamp,protoPayload.authenticationInfo.principalEmail,protoPayload.resourceName,protoPayload.serviceData.policyDelta.bindingDeltas[].role,protoPayload.serviceData.policyDelta.bindingDeltas[].member)'

Stage 4 · PersistenceService accounts and keys, SSH keys in metadata, OS Login off, scheduled code, identity pools, new projects

Metadata hits: read the full entry (--format=json) for the keys ssh-keys, enable-oslogin and startup-script. Identity pools in force: gcloud iam workload-identity-pools providers list --workload-identity-pool=<pool> --location=global --format='table(name,issuerUri,attributeCondition)' — an empty attribute condition trusts every identity the issuer vouches for.

gcloud logging read \
  'logName:"cloudaudit.googleapis.com%2Factivity" AND
   protoPayload.methodName:("CreateServiceAccount" OR "CreateServiceAccountKey" OR "UploadServiceAccountKey" OR "EnableServiceAccount" OR
                            "setMetadata" OR "setCommonInstanceMetadata" OR "ImportSshPublicKey" OR
                            "CreateWorkloadIdentityPool" OR "CreateWorkloadIdentityPoolProvider" OR "UpdateWorkloadIdentityPoolProvider" OR
                            "CloudScheduler.CreateJob" OR "CloudScheduler.UpdateJob" OR "FunctionService.CreateFunction" OR "FunctionService.UpdateFunction" OR
                            "CloudFunctionsService.CreateFunction" OR "CloudFunctionsService.UpdateFunction" OR
                            "Services.CreateService" OR "Services.ReplaceService" OR "Eventarc.CreateTrigger" OR
                            "CreateProject" OR "UpdateProjectBillingInfo")' \
  --project=<project-id> --freshness=30d \
  --format='table(timestamp,protoPayload.authenticationInfo.principalEmail,protoPayload.methodName,protoPayload.resourceName,protoPayload.requestMetadata.callerIp)'
# projects attached to the billing account, including ones in no folder you watch
gcloud logging read 'protoPayload.methodName:"UpdateProjectBillingInfo"' --billing-account=<billing-account-id> --freshness=30d \
  --format='table(timestamp,protoPayload.authenticationInfo.principalEmail,protoPayload.resourceName)'

Stage 5 · Defence evasionSinks, exclusions, log buckets, Data Access config, organisation policy, SCC mutes, flow logs

Aggregated sinks and organisation policies are logged at the organisation: rerun with --organization=<org-id>. What is in force now: gcloud logging sinks list --organization=<org-id>, gcloud logging sinks list --project=<project-id> and gcloud logging buckets describe _Default --location=global --project=<project-id> for retention.

gcloud logging read \
  'logName:"cloudaudit.googleapis.com%2Factivity" AND (
     (protoPayload.serviceName="logging.googleapis.com" AND
      protoPayload.methodName:("DeleteSink" OR "UpdateSink" OR "CreateExclusion" OR "UpdateExclusion" OR "DeleteBucket" OR "UpdateBucket" OR "UpdateCmekSettings" OR "DeleteLog"))
     OR protoPayload.serviceData.policyDelta.auditConfigDeltas:*
     OR protoPayload.serviceName="orgpolicy.googleapis.com"
     OR (protoPayload.serviceName="securitycenter.googleapis.com" AND protoPayload.methodName:("MuteConfig" OR "DeleteNotificationConfig" OR "BulkMuteFindings"))
     OR protoPayload.methodName:"compute.subnetworks.patch")' \
  --project=<project-id> --freshness=30d \
  --format='table(timestamp,protoPayload.authenticationInfo.principalEmail,protoPayload.serviceName,protoPayload.methodName,protoPayload.resourceName)'

Stage 6 · Lateral movementImpersonation and delegation chains — who minted tokens for which service account

Where the compromised principal holds anything, across the organisation and independent of logs: gcloud asset search-all-iam-policies --scope=organizations/<org-id> --query='policy:<principal-email>'. Then rerun the stage 1 query in every project it names.

gcloud logging read \
  'logName:"cloudaudit.googleapis.com%2Fdata_access" AND protoPayload.serviceName="iamcredentials.googleapis.com" AND
   protoPayload.methodName:("GenerateAccessToken" OR "GenerateIdToken" OR "SignBlob" OR "SignJwt")' \
  --project=<project-id> --freshness=14d \
  --format='table(timestamp,protoPayload.authenticationInfo.principalEmail,protoPayload.methodName,protoPayload.request.name,protoPayload.requestMetadata.callerIp,protoPayload.authenticationInfo.serviceAccountDelegationInfo[].firstPartyPrincipal.principalEmail)'

Stage 7 · Resource abuseCompute, GKE, Dataproc, Vertex AI, Cloud Run jobs, Batch and quota requests in every project

What is running now, with accelerators, per project: gcloud compute instances list --project=<project-id> --filter='guestAccelerators:* OR creationTimestamp>-P7D' --format='table(name,zone.basename(),machineType.basename(),guestAccelerators[].acceleratorType.basename(),creationTimestamp)'. The billing export to BigQuery, by SKU and region for the window, is the figure for the billing case.

for p in $(gcloud projects list --format='value(projectId)'); do
  gcloud logging read \
    'logName:"cloudaudit.googleapis.com%2Factivity" AND
     protoPayload.methodName:("compute.instances.insert" OR "compute.instances.bulkInsert" OR "instanceGroupManagers.insert" OR "instanceGroupManagers.resize" OR
                              "ClusterManager.CreateCluster" OR "ClusterManager.CreateNodePool" OR "ClusterController.CreateCluster" OR
                              "JobService.CreateCustomJob" OR "Jobs.CreateJob" OR "Jobs.RunJob" OR "BatchService.CreateJob" OR "CreateQuotaPreference")' \
    --project="$p" --freshness=7d \
    --format='table(timestamp,protoPayload.authenticationInfo.principalEmail,protoPayload.methodName,protoPayload.resourceName,protoPayload.request.machineType)' \
    | sed "s/^/$p  /"
done

Stage 8 · Data accessBuckets made public, snapshots and images shared, exports, secret and SQL exposure

gcloud logging read \
  'logName:"cloudaudit.googleapis.com%2Factivity" AND (
     (protoPayload.methodName="storage.setIamPermissions" AND
      protoPayload.serviceData.policyDelta.bindingDeltas.member:("allUsers" OR "allAuthenticatedUsers"))
     OR protoPayload.methodName:("compute.snapshots.setIamPolicy" OR "compute.images.setIamPolicy" OR "compute.disks.createSnapshot" OR
                                 "compute.snapshots.insert" OR "compute.images.insert" OR "storage.buckets.update" OR
                                 "instances.export" OR "backupRuns.insert" OR "SecretManagerService.SetIamPolicy" OR "SecretManagerService.AddSecretVersion"))' \
  --project=<project-id> --freshness=14d \
  --format='table(timestamp,protoPayload.authenticationInfo.principalEmail,protoPayload.methodName,protoPayload.resourceName,protoPayload.requestMetadata.callerIp)'

Stage 8 · Data accessWhat was read — Cloud Storage, Secret Manager and BigQuery data access

gcloud logging read \
  'logName:"cloudaudit.googleapis.com%2Fdata_access" AND protoPayload.authenticationInfo.principalEmail="<principal-email>" AND
   (protoPayload.methodName:("storage.objects.get" OR "storage.objects.list" OR "AccessSecretVersion" OR "Decrypt"))' \
  --project=<project-id> --freshness=14d \
  --format='table(timestamp,protoPayload.serviceName,protoPayload.methodName,protoPayload.resourceName,protoPayload.requestMetadata.callerIp,protoPayload.requestMetadata.callerSuppliedUserAgent)'
# BigQuery reads are logged by default
gcloud logging read \
  'protoPayload.serviceName="bigquery.googleapis.com" AND protoPayload.metadata.tableDataRead:* AND protoPayload.authenticationInfo.principalEmail="<principal-email>"' \
  --project=<project-id> --freshness=14d \
  --format='table(timestamp,protoPayload.resourceName,protoPayload.metadata.tableDataRead.reason,protoPayload.requestMetadata.callerIp)'

Stage 8 · Data accessBytes out of a compromised VM — VPC Flow Logs

gcloud logging read \
  'logName:"logs/compute.googleapis.com%2Fvpc_flows" AND jsonPayload.connection.src_ip="<vm-internal-ip>"' \
  --project=<project-id> --freshness=7d --limit=5000 --format=json \
  | jq -r '.[] | .jsonPayload | [.connection.dest_ip, .connection.dest_port, .connection.protocol,
           (.bytes_sent | tonumber), (.dest_location.country // ""), (.dest_instance.vm_name // "")] | @tsv' \
  | awk -F'\t' '{ b[$1"\t"$2"\t"$3"\t"$5"\t"$6] += $4 } END { for (k in b) print b[k] "\t" k }' \
  | sort -rn | head -50

Stage 9 · ImpactBuckets, snapshots, backups, databases, keys, secrets and projects deleted; billing detached; soft delete removed

Soft-deleted objects (7-day default since 2024, 0–90 configurable): gcloud storage ls --soft-deleted gs://<bucket>/** and gcloud storage restore gs://<bucket>/<object>#<generation>. Key versions in DESTROY_SCHEDULED: gcloud kms keys versions restore before the window ends.

gcloud logging read \
  'logName:"cloudaudit.googleapis.com%2Factivity" AND
   protoPayload.methodName:("storage.buckets.delete" OR "storage.buckets.update" OR "compute.snapshots.delete" OR "compute.disks.delete" OR
                            "compute.instances.delete" OR "compute.images.delete" OR "instances.delete" OR "backupRuns.delete" OR
                            "DeleteBackupVault" OR "DeleteBackup" OR "DeleteBackupPlan" OR
                            "DestroyCryptoKeyVersion" OR "DisableCryptoKeyVersion" OR "UpdateCryptoKeyPrimaryVersion" OR
                            "DeleteSecret" OR "DestroySecretVersion" OR "DeleteProject" OR "UpdateProjectBillingInfo" OR
                            "DeleteDataset" OR "ClusterManager.DeleteCluster" OR "OrgPolicy.DeletePolicy")' \
  --project=<project-id> --freshness=14d \
  --format='table(timestamp,protoPayload.authenticationInfo.principalEmail,protoPayload.methodName,protoPayload.resourceName,protoPayload.requestMetadata.callerIp)'
# object deletes and overwrites per hour and principal (Data Access, DATA_WRITE; off by default)
gcloud logging read 'logName:"cloudaudit.googleapis.com%2Fdata_access" AND protoPayload.methodName:("storage.objects.delete" OR "storage.objects.create")' \
  --project=<project-id> --freshness=14d --format='value(timestamp,protoPayload.authenticationInfo.principalEmail)' \
  | awk -F'\t' '{ print substr($1, 1, 13), $2 }' | sort | uniq -c | sort -rn | head