{
  "name": "TheCloud.Events — cloud log evidence (GCP)",
  "versions": {
    "attack": "19",
    "navigator": "5.1.0",
    "layer": "4.5"
  },
  "domain": "enterprise-attack",
  "description": "Techniques scored by how many cloud audit events in the TheCloud.Events catalog (39 GCP events) produce log evidence for them. Each technique's links open the event pages with sample logs, analyst notes, and key fields. Generated from https://thecloud.events/.",
  "sorting": 0,
  "layout": {
    "layout": "side",
    "aggregateFunction": "max",
    "showID": true,
    "showName": true,
    "showAggregateScores": false,
    "countUnscored": false
  },
  "hideDisabled": false,
  "techniques": [
    {
      "techniqueID": "T1021.004",
      "score": 5,
      "color": "",
      "comment": "5 events in the catalog produce evidence for this technique: GCP Compute.instances.setMetadata, GCP compute.projects.setCommonInstanceMetadata, GCP google.ssh-serialport.v1.connect, GCP users.importSshPublicKey, GCP users.sshPublicKeys.patch",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP Compute.instances.setMetadata",
          "url": "https://thecloud.events/events/gcp-compute-instances-setmetadata/"
        },
        {
          "label": "GCP compute.projects.setCommonInstanceMetadata",
          "url": "https://thecloud.events/events/gcp-compute-projects-setcommoninstancemetadata/"
        },
        {
          "label": "GCP google.ssh-serialport.v1.connect",
          "url": "https://thecloud.events/events/gcp-google-ssh-serialport-v1-connect/"
        },
        {
          "label": "GCP users.importSshPublicKey",
          "url": "https://thecloud.events/events/gcp-users-importsshpublickey/"
        },
        {
          "label": "GCP users.sshPublicKeys.patch",
          "url": "https://thecloud.events/events/gcp-users-sshpublickeys-patch/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1059",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: GCP google.ssh-serialport.v1.connect",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP google.ssh-serialport.v1.connect",
          "url": "https://thecloud.events/events/gcp-google-ssh-serialport-v1-connect/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1070",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: GCP google.iam.admin.v1.DeleteServiceAccountKey",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP google.iam.admin.v1.DeleteServiceAccountKey",
          "url": "https://thecloud.events/events/gcp-google-iam-admin-v1-deleteserviceaccountkey/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1078.004",
      "score": 4,
      "color": "",
      "comment": "4 events in the catalog produce evidence for this technique: GCP generateAccessToken, GCP iam.serviceAccounts.actAs, GCP iam.serviceAccounts.implicitDelegation, GCP iam.serviceAccounts.signJwt",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP generateAccessToken",
          "url": "https://thecloud.events/events/gcp-generateaccesstoken/"
        },
        {
          "label": "GCP iam.serviceAccounts.actAs",
          "url": "https://thecloud.events/events/gcp-iam-serviceaccounts-actas/"
        },
        {
          "label": "GCP iam.serviceAccounts.implicitDelegation",
          "url": "https://thecloud.events/events/gcp-iam-serviceaccountkeys-implicitdelegation/"
        },
        {
          "label": "GCP iam.serviceAccounts.signJwt",
          "url": "https://thecloud.events/events/gcp-iam-serviceaccounts-signjwt/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1098",
      "score": 6,
      "color": "",
      "comment": "6 events in the catalog produce evidence for this technique: GCP compute.disks.setIamPolicy, GCP compute.instances.setServiceAccount, GCP CreateRole, GCP EnableServiceAccount, GCP google.iam.admin.v1.SetIamPolicy, GCP iam.roles.update",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP compute.disks.setIamPolicy",
          "url": "https://thecloud.events/events/gcp-compute-disks-setiampolicy/"
        },
        {
          "label": "GCP compute.instances.setServiceAccount",
          "url": "https://thecloud.events/events/gcp-compute-instances-setserviceaccount/"
        },
        {
          "label": "GCP CreateRole",
          "url": "https://thecloud.events/events/gcp-createrole/"
        },
        {
          "label": "GCP EnableServiceAccount",
          "url": "https://thecloud.events/events/gcp-enableserviceaccount/"
        },
        {
          "label": "GCP google.iam.admin.v1.SetIamPolicy",
          "url": "https://thecloud.events/events/gcp-google-iam-admin-v1-setiampolicy-or-setiampolicy/"
        },
        {
          "label": "GCP iam.roles.update",
          "url": "https://thecloud.events/events/gcp-iam-roles-update/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1098.001",
      "score": 3,
      "color": "",
      "comment": "3 events in the catalog produce evidence for this technique: GCP google.iam.admin.v1.CreateServiceAccountKey, GCP google.iam.admin.v1.UploadServiceAccountKey, GCP storage.hmacKeys.create",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP google.iam.admin.v1.CreateServiceAccountKey",
          "url": "https://thecloud.events/events/gcp-google-iam-admin-v1-createserviceaccountkey/"
        },
        {
          "label": "GCP google.iam.admin.v1.UploadServiceAccountKey",
          "url": "https://thecloud.events/events/gcp-google-iam-admin-v1-uploadserviceaccountkey/"
        },
        {
          "label": "GCP storage.hmacKeys.create",
          "url": "https://thecloud.events/events/gcp-storage-hmackeys-create/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1098.003",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: GCP add-iam-policy-binding, GCP storage.setIamPermissions",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP add-iam-policy-binding",
          "url": "https://thecloud.events/events/gcp-add-iam-policy-binding/"
        },
        {
          "label": "GCP storage.setIamPermissions",
          "url": "https://thecloud.events/events/gcp-storage-setiampermissions/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1098.004",
      "score": 4,
      "color": "",
      "comment": "4 events in the catalog produce evidence for this technique: GCP Compute.instances.setMetadata, GCP compute.projects.setCommonInstanceMetadata, GCP users.importSshPublicKey, GCP users.sshPublicKeys.patch",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP Compute.instances.setMetadata",
          "url": "https://thecloud.events/events/gcp-compute-instances-setmetadata/"
        },
        {
          "label": "GCP compute.projects.setCommonInstanceMetadata",
          "url": "https://thecloud.events/events/gcp-compute-projects-setcommoninstancemetadata/"
        },
        {
          "label": "GCP users.importSshPublicKey",
          "url": "https://thecloud.events/events/gcp-users-importsshpublickey/"
        },
        {
          "label": "GCP users.sshPublicKeys.patch",
          "url": "https://thecloud.events/events/gcp-users-sshpublickeys-patch/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1133",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: GCP compute.instances.addAccessConfig",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP compute.instances.addAccessConfig",
          "url": "https://thecloud.events/events/gcp-compute-instances-addaccessconfig/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1213.006",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: GCP bigquery.jobs.insert, GCP cloudsql.instances.export",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP bigquery.jobs.insert",
          "url": "https://thecloud.events/events/gcp-bigquery-jobs-insert/"
        },
        {
          "label": "GCP cloudsql.instances.export",
          "url": "https://thecloud.events/events/gcp-cloudsql-instances-export/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1485",
      "score": 4,
      "color": "",
      "comment": "4 events in the catalog produce evidence for this technique: GCP secretmanager.secrets.delete, GCP SecretManagerService.DestroySecretVersion, GCP storage.buckets.delete, GCP storage.objects.delete",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP secretmanager.secrets.delete",
          "url": "https://thecloud.events/events/gcp-secretmanager-secrets-delete/"
        },
        {
          "label": "GCP SecretManagerService.DestroySecretVersion",
          "url": "https://thecloud.events/events/gcp-secretmanagerservice-destroysecretversion/"
        },
        {
          "label": "GCP storage.buckets.delete",
          "url": "https://thecloud.events/events/gcp-storage-buckets-delete/"
        },
        {
          "label": "GCP storage.objects.delete",
          "url": "https://thecloud.events/events/gcp-storage-objects-delete/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1528",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: GCP generateAccessToken, GCP iam.serviceAccounts.signJwt",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP generateAccessToken",
          "url": "https://thecloud.events/events/gcp-generateaccesstoken/"
        },
        {
          "label": "GCP iam.serviceAccounts.signJwt",
          "url": "https://thecloud.events/events/gcp-iam-serviceaccounts-signjwt/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1530",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: GCP storage.setIamPermissions",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP storage.setIamPermissions",
          "url": "https://thecloud.events/events/gcp-storage-setiampermissions/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1531",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: GCP google.iam.admin.v1.DeleteServiceAccount",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP google.iam.admin.v1.DeleteServiceAccount",
          "url": "https://thecloud.events/events/gcp-google-iam-admin-v1-deleteserviceaccount/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1537",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: GCP bigquery.jobs.insert, GCP cloudsql.instances.export",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP bigquery.jobs.insert",
          "url": "https://thecloud.events/events/gcp-bigquery-jobs-insert/"
        },
        {
          "label": "GCP cloudsql.instances.export",
          "url": "https://thecloud.events/events/gcp-cloudsql-instances-export/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1548",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: GCP google.iam.admin.v1.SetIamPolicy",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP google.iam.admin.v1.SetIamPolicy",
          "url": "https://thecloud.events/events/gcp-google-iam-admin-v1-setiampolicy-or-setiampolicy/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1548.005",
      "score": 4,
      "color": "",
      "comment": "4 events in the catalog produce evidence for this technique: GCP generateAccessToken, GCP iam.serviceAccounts.actAs, GCP iam.serviceAccounts.implicitDelegation, GCP iam.serviceAccounts.signJwt",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP generateAccessToken",
          "url": "https://thecloud.events/events/gcp-generateaccesstoken/"
        },
        {
          "label": "GCP iam.serviceAccounts.actAs",
          "url": "https://thecloud.events/events/gcp-iam-serviceaccounts-actas/"
        },
        {
          "label": "GCP iam.serviceAccounts.implicitDelegation",
          "url": "https://thecloud.events/events/gcp-iam-serviceaccountkeys-implicitdelegation/"
        },
        {
          "label": "GCP iam.serviceAccounts.signJwt",
          "url": "https://thecloud.events/events/gcp-iam-serviceaccounts-signjwt/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1555.006",
      "score": 1,
      "color": "",
      "comment": "1 event in the catalog produce evidence for this technique: GCP SecretManagerService.AccessSecretVersion",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP SecretManagerService.AccessSecretVersion",
          "url": "https://thecloud.events/events/gcp-secretmanagerservice-accesssecretversion/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1685",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: GCP google.cloud.securitycenter.v1.SecurityCenter.SetMute, GCP Securitycenter.settings.update",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP google.cloud.securitycenter.v1.SecurityCenter.SetMute",
          "url": "https://thecloud.events/events/gcp-google-cloud-securitycenter-v1-securitycenter-setmute/"
        },
        {
          "label": "GCP Securitycenter.settings.update",
          "url": "https://thecloud.events/events/gcp-securitycenter-settings-update/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1685.002",
      "score": 5,
      "color": "",
      "comment": "5 events in the catalog produce evidence for this technique: GCP google.logging.v2.ConfigServiceV2.UpdateExclusion, GCP google.logging.v2.LoggingServiceV2.DeleteLog, GCP logging.projects.exclusions.create, GCP logging.sinks.delete, GCP logging.sinks.update",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP google.logging.v2.ConfigServiceV2.UpdateExclusion",
          "url": "https://thecloud.events/events/gcp-google-logging-v2-configservicev2-updateexclusion/"
        },
        {
          "label": "GCP google.logging.v2.LoggingServiceV2.DeleteLog",
          "url": "https://thecloud.events/events/gcp-google-logging-v2-loggingservicev2-deletelog/"
        },
        {
          "label": "GCP logging.projects.exclusions.create",
          "url": "https://thecloud.events/events/gcp-logging-projects-exclusions-create/"
        },
        {
          "label": "GCP logging.sinks.delete",
          "url": "https://thecloud.events/events/gcp-logging-sinks-delete/"
        },
        {
          "label": "GCP logging.sinks.update",
          "url": "https://thecloud.events/events/gcp-logging-sinks-update/"
        }
      ],
      "showSubtechniques": false
    },
    {
      "techniqueID": "T1686.001",
      "score": 2,
      "color": "",
      "comment": "2 events in the catalog produce evidence for this technique: GCP compute.firewalls.delete, GCP compute.firewalls.patch",
      "enabled": true,
      "metadata": [],
      "links": [
        {
          "label": "GCP compute.firewalls.delete",
          "url": "https://thecloud.events/events/gcp-compute-firewalls-delete/"
        },
        {
          "label": "GCP compute.firewalls.patch",
          "url": "https://thecloud.events/events/gcp-compute-firewalls-patch/"
        }
      ],
      "showSubtechniques": false
    }
  ],
  "gradient": {
    "colors": [
      "#ffffff",
      "#5c6b73"
    ],
    "minValue": 0,
    "maxValue": 6
  },
  "legendItems": [
    {
      "label": "More catalog events produce evidence for this technique",
      "color": "#5c6b73"
    }
  ],
  "metadata": [
    {
      "name": "source",
      "value": "https://thecloud.events"
    },
    {
      "name": "scope",
      "value": "GCP"
    }
  ],
  "links": [
    {
      "label": "TheCloud.Events",
      "url": "https://thecloud.events/"
    }
  ],
  "showTacticRowBackground": false,
  "tacticRowBackground": "#dddddd",
  "selectTechniquesAcrossTactics": true,
  "selectSubtechniquesWithParent": false
}