GCP API Command Execution Detected

Darshan Thummar@Mighty

•updated Jun 11, 2026•1•0•6

This rule detects HTTP POST requests to the Google Cloud Platform (GCP) Compute Engine API (compute.googleapis.com). It specifically looks for a high volume of these requests (20 within 10 seconds from the same source IP), which could indicate automated activity or potential command execution attempts within GCP. The rule is designed to identify suspicious interactions with the GCP API that might be related to execution tactics.