5.30.md

5.30 - Cloud Storage buckets enumerated by unfamiliar user identities

Cloud Storage buckets enumerated by unfamiliar user identities.

Category: Data Usage
Use Cases: Audit, Detect
Data Sources: Audit Logs - Data Access

Queries or Rules

BigQuery	Log Analytics	Google SecOps
SQL	SQL	Contribute rule

Event Generation

List all buckets in a project.

Test Prerequisites

1. Install gsutil (installed as part of Google Cloud CLI)

Test Commands

gsutil ls

Sample Event

No log samples provided. Contribute log samples to this use case.