GCP BigQuery Data Exfiltration and Bulk Access

Lacey Cochrane@NullVectorX

•updated Jul 6, 2026•4•0•13

Detects potentially unauthorized data exfiltration or bulk extraction activities within Google Cloud BigQuery. The rule monitors for large-scale data queries (SELECT * or queries without filters), data exports to external Google Cloud Storage buckets, and queries executed by automated scripts or tools, which are common indicators of staged data theft following cloud environment compromise.