GCP Detect gcploit framework

name: GCP Detect gcploit framework
id: a1c5a85e-a162-410c-a5d9-99ff639e5a52
version: 8
creation_date: '2020-10-08'
modification_date: '2026-05-13'
author: Rod Soto, Splunk
status: experimental
type: TTP
description: The following analytic identifies the use of the GCPloit exploitation framework within Google Cloud Platform (GCP). It detects specific GCP Pub/Sub messages with a function timeout of 539 seconds, which is indicative of GCPloit activity. This detection is significant as GCPloit can be used to escalate privileges and facilitate lateral movement from compromised high-privilege accounts. If confirmed malicious, this activity could allow attackers to gain unauthorized access, escalate their privileges, and move laterally within the GCP environment, potentially compromising sensitive data and critical resources.
data_source: []
search: |-
    `google_gcp_pubsub_message` data.protoPayload.request.function.timeout=539s
      | table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent
      | `gcp_detect_gcploit_framework_filter`
how_to_implement: You must install splunk GCP add-on. This search works with gcp:pubsub:message logs
known_false_positives: Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects
references:
    - https://github.com/dxa4481/gcploit
    - https://www.youtube.com/watch?v=Ml09R38jpok
finding:
    title: Possible use of gcploit framework from $src$ by $src_user$
    entity:
        field: src_user
        type: user
        score: 50
analytic_story:
    - GCP Cross Account Activity
asset_type: GCP Account
mitre_attack_id:
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat