GCP Logging Sink Hijack via storage.buckets.delete then SetSink/UpdateSink
Detects potential GCP logging sink bucket hijacking by monitoring for the deletion of a Google Cloud Storage bucket followed closely by an update to a logging sink configuration that points to a GCS destination. This pattern is characteristic of attackers attempting to intercept cloud log streams by recreating a target destination bucket in an environment they control.
YARA-L
