srl
GCP Cloud Red Teaming — Operator Notes
Practical field reference for assessing Google Cloud Platform environments from an attacker’s seat. Covers initial access, identity validation, enumeration, privilege escalation, lateral movement, persistence, impact, detection/evasion, and tooling. The MCRTA “mcrta-exam” chain (§11) is the worked example.
Authorized engagements only. Cloud Audit Logs record every Admin Activity call; assume detection. Plan the OPSEC story before the action.
2025–2026 update: The GCP attack surface has shifted. Almost every escalation path still routes through service-account impersonation (actAs, getAccessToken, signJwt), but the entry points have multiplied: Eventarc pipeline token exfiltration, Workload Identity Federation (WIF) provider abuse, Cluster Director startupScript replacement, and cross-tenant BigQuery repository takeover (CVE-2026-14934). Keyless persistence via IAM impersonation role grants and Cloud Scheduler OIDC beacons now rivals key creation. GCP-Hound brings GCP into BloodHound’s OpenGraph. Log sink redirection (UpdateSink) and audit log disablement are documented defense-evasion phases, catalogued under MITRE T1562.008.