SecretManagerService.DestroySecretVersion
GCP
SecretManagerService.DestroySecretVersion
Event
Permanently destroys a specific version of a secret in GCP Secret Manager, making its data irrecoverable.
Security Context
- Impairing defenses allows adversaries to operate freely by removing security controls that would otherwise detect or block their activity.
- Destructive deletion of cloud resources can cause significant operational disruption, data loss, and extended recovery times.
Log Source
Cloud Audit Logs
Sample Event
Adversarial. Draco — instead of deleting the entire bowtruckle-prod-db-master-pass secret (which would generate a “secret deleted” alert), surgically destroys a specific version (versions/2). Version 2 was the version that was active when Draco first accessed it via AccessSecretVersion — destroying it removes the link between the in-flight credential rotation and Draco’s read. The secret itself still exists with versions 1 and 3 intact; defenders looking at “secret count” don’t see a change. This is the lower-noise, more targeted anti-forensics variant.
{ "protoPayload": { "@type": "type.googleapis.com/google.cloud.audit.AuditLog", "authenticationInfo": { "principalEmail": "draco@fantasticlogs.cloud" }, "requestMetadata": { "callerIp": "203.0.113.66", "callerSuppliedUserAgent": "google-cloud-sdk gcloud/465.0.0 command/gcloud.secrets.versions.destroy invocation-id/90000000000000000000010000000011 environment/None environment-version/None client-os/LINUX client-os-ver/(5,15,0) client-pltf-arch/x86_64 interactive/False from-script/False python/3.11.6 term/xterm-256color (Linux 5.15.0-1052-aws),gzip(gfe)", "requestAttributes": { "time": "2026-04-15T17:36:42.221987654Z", "auth": {} }, "destinationAttributes": {} }, "serviceName": "secretmanager.googleapis.com", "methodName": "google.cloud.secretmanager.v1.SecretManagerService.DestroySecretVersion", "authorizationInfo": [ { "resource": "projects/555123456789/secrets/bowtruckle-prod-db-master-pass/versions/2", "permission": "secretmanager.versions.destroy", "granted": true, "resourceAttributes": { "service": "secretmanager.googleapis.com", "name": "projects/555123456789/secrets/bowtruckle-prod-db-master-pass/versions/2", "type": "secretmanager.googleapis.com/SecretVersion" } } ], "resourceName": "projects/555123456789/secrets/bowtruckle-prod-db-master-pass/versions/2", "request": { "@type": "type.googleapis.com/google.cloud.secretmanager.v1.DestroySecretVersionRequest", "name": "projects/fantasticlogs-prod/secrets/bowtruckle-prod-db-master-pass/versions/2", "etag": "BwSAMPLEetag10010=" }, "response": { "@type": "type.googleapis.com/google.cloud.secretmanager.v1.SecretVersion", "name": "projects/555123456789/secrets/bowtruckle-prod-db-master-pass/versions/2", "state": "DESTROYED", "createTime": "2026-03-12T09:14:32.123456789Z", "destroyTime": "2026-04-15T17:36:42.187654321Z", "etag": "BwSAMPLEetag10011=" } }, "insertId": "evt010000000011", "resource": { "type": "audited_resource", "labels": { "project_id": "fantasticlogs-prod", "method": "google.cloud.secretmanager.v1.SecretManagerService.DestroySecretVersion", "service": "secretmanager.googleapis.com" } }, "timestamp": "2026-04-15T17:36:42.123456789Z", "severity": "NOTICE", "logName": "projects/fantasticlogs-prod/logs/cloudaudit.googleapis.com%2Factivity", "receiveTimestamp": "2026-04-15T17:36:42.567890123Z"}MITRE ATT&CK Mapping
Tactics: Impact Defense Impairment
Techniques:
- T1485 — Data Destruction — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and r...
- T1685 — Disable or Modify Tools — Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping spec...