GCP GCS Bucket Enumeration & Mass Download

Lacey Cochrane@NullVectorX

•updated Jun 11, 2026•5•0•10

Detects high volume Google Cloud Storage (GCS) object listing and downloads, which can indicate reconnaissance of cloud storage contents or data exfiltration. The rule aggregates operations by identity, bucket, and project ID over a one-hour period and flags activity exceeding 50 total operations.