# Cloud Project Compromise Assessment

**ID**: S1005

**Description**: Evaluate a cloud project for malicious or unknown activities and determine if the cloud project is compromised. This is distinct from evaluating whether a particular instance in that cloud project is compromised.

## Has an attacker gained access to the cloud project? (Initial Access) <span class="dfiqIdTag">F1013</span>

 - <span class="dfiqIdTag">Q1039</span> &nbsp;Are there any detections of exposed service account credentials?
 - <span class="dfiqIdTag">Q1040</span> &nbsp;Are there any interaction with the cloud project resources from an unknown external IP address (including Tor Exit nodes, C2 tagged addresses)?
 - <span class="dfiqIdTag">Q1041</span> &nbsp;Are there any unexpected successful API calls from an unknown external IP address (including Tor Exit nodes, C2 tagged addresses)?
## Are there any signs of an attacker trying to maintain access to the cloud project? (Persistence) <span class="dfiqIdTag">F1014</span>

 - <span class="dfiqIdTag">Q1042</span> &nbsp;Are there any APIs recently enabled?
 - <span class="dfiqIdTag">Q1043</span> &nbsp;Are there any role bindings to cluster admin for anonymous users?
 - <span class="dfiqIdTag">Q1044</span> &nbsp;Are there any unexpected resources created under the cloud project?
 - <span class="dfiqIdTag">Q1045</span> &nbsp;Are there any unknown accounts created?
 - <span class="dfiqIdTag">Q1046</span> &nbsp;Are there any unknown role bindings created?
## Are there any signs of interference with cloud project protective measures? (Defense Evasion) <span class="dfiqIdTag">F1015</span>

 - <span class="dfiqIdTag">Q1047</span> &nbsp;Are there any suspicious modifications to the cloud project firewall rules/policies?
 - <span class="dfiqIdTag">Q1048</span> &nbsp;Are there any suspicious modifications to the cloud project logging configuration?
## Are there indications of an attacker moving between resources? <span class="dfiqIdTag">F1016</span>
This may take the form of an attacker moving between cloud resources within the project or between the cloud project and on-prem systems.

 - <span class="dfiqIdTag">Q1049</span> &nbsp;Is there an unusual increase of traffic between resource in the cloud project?
## Are there any signs of data exfiltration from resources inside the cloud project? (Data Exfil) <span class="dfiqIdTag">F1017</span>

 - <span class="dfiqIdTag">Q1050</span> &nbsp;Are there any GCS buckets within the cloud project shared externally?
 - <span class="dfiqIdTag">Q1051</span> &nbsp;Are there any signs of data within the cloud project being transferred externally?
## Are there any detections of potentially suspicious activity related to the cloud project from detection tools? <span class="dfiqIdTag">F1018</span>

 - <span class="dfiqIdTag">Q1039</span> &nbsp;Are there any detections of exposed service account credentials?
