https://www.gcpforensics.com/en/blog Latest from Blog en Sun, 27 Sep 2026 20:44:33 GMT https://www.gcpforensics.com/en/blog/data-access-logs-limitations https://www.gcpforensics.com/en/blog/data-access-logs-limitations Why GCP Data Access audit logs are the usual dead end: off by default, 30-day retention, what goes unseen without them, and what to enable before an incident. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT https://www.gcpforensics.com/en/blog/fictional-gcp-compromise-walkthrough https://www.gcpforensics.com/en/blog/fictional-gcp-compromise-walkthrough A fictional Google Cloud incident investigated end to end: leaked CI key, Owner for a Gmail account, startup-script backdoor, public bucket, deleted log sink. Florian Amette Thu, 24 Sep 2026 00:00:00 GMT https://www.gcpforensics.com/en/blog/vpc-flow-logs-exfiltration https://www.gcpforensics.com/en/blog/vpc-flow-logs-exfiltration Use Google Cloud VPC Flow Logs in an investigation: record fields, sampling caveats, egress per external IP, and matching audit-log attacker IPs to VM traffic. Florian Amette Tue, 22 Sep 2026 00:00:00 GMT https://www.gcpforensics.com/en/blog/defense-evasion-log-sinks https://www.gcpforensics.com/en/blog/defense-evasion-log-sinks How attackers blind Google Cloud defenders: deleted or redirected log sinks, exclusions, log buckets, Data Access logging removed, SCC alerts. What remains. Florian Amette Sat, 19 Sep 2026 00:00:00 GMT https://www.gcpforensics.com/en/blog/gcs-bigquery-exfiltration https://www.gcpforensics.com/en/blog/gcs-bigquery-exfiltration Prove or rule out data theft from Cloud Storage and BigQuery: bulk storage.objects.get, public buckets, HMAC keys, cross-project copies, shared disk images. Florian Amette Thu, 17 Sep 2026 00:00:00 GMT https://www.gcpforensics.com/en/blog/compute-engine-abuse-startup-scripts-mining https://www.gcpforensics.com/en/blog/compute-engine-abuse-startup-scripts-mining Detect Compute Engine abuse in Google Cloud audit logs: startup-script backdoors, SSH keys in metadata, OS Login removed, GPU VMs, VM bursts and unused regions. Florian Amette Tue, 15 Sep 2026 00:00:00 GMT https://www.gcpforensics.com/en/blog/service-account-impersonation https://www.gcpforensics.com/en/blog/service-account-impersonation Trace service account impersonation in Google Cloud audit logs: GenerateAccessToken, SignBlob, serviceAccountDelegationInfo, actAs and Token Creator grants. Florian Amette Sat, 12 Sep 2026 00:00:00 GMT https://www.gcpforensics.com/en/blog/iam-policy-abuse-setiampolicy https://www.gcpforensics.com/en/blog/iam-policy-abuse-setiampolicy Read SetIamPolicy audit entries like an investigator: bindingDeltas, Owner granted to Gmail accounts, unknown domains, allUsers, Token Creator, org policies. Florian Amette Thu, 10 Sep 2026 00:00:00 GMT https://www.gcpforensics.com/en/blog/leaked-service-account-key https://www.gcpforensics.com/en/blog/leaked-service-account-key A service account key leaked in a repo or CI log? Find its key ID, every IP that used it and what it did via serviceAccountKeyName, then contain it in order. Florian Amette Tue, 08 Sep 2026 00:00:00 GMT https://www.gcpforensics.com/en/blog/analyze-gcp-audit-logs https://www.gcpforensics.com/en/blog/analyze-gcp-audit-logs Analyze Google Cloud audit logs and VPC Flow Logs step by step: export as JSON, drop the files, read the verdict, findings, timeline and remediation checklist. Florian Amette Sat, 05 Sep 2026 00:00:00 GMT https://www.gcpforensics.com/en/blog/cloud-audit-logs-explained https://www.gcpforensics.com/en/blog/cloud-audit-logs-explained Admin Activity, Data Access, System Event and Policy Denied audit logs: what each records, retention, the fields that matter, and four ways to export them. Florian Amette Thu, 03 Sep 2026 00:00:00 GMT https://www.gcpforensics.com/en/blog/google-cloud-incident-response https://www.gcpforensics.com/en/blog/google-cloud-incident-response Your Google Cloud project may be compromised. The order of operations: contain the identity, preserve the audit logs, scope with methodNames, then eradicate. Florian Amette Tue, 01 Sep 2026 00:00:00 GMT