GCP Dataflow Job Creation for Potential Exfiltration

Lacey Cochrane@NullVectorX

•updated Jul 6, 2026•5•0•8

Detects the creation of Google Cloud Dataflow jobs that exhibit indicators of malicious data exfiltration pipelines, such as usage of suspicious job names (common with exfiltration tools), service account delegation, or execution via scripted user agents.