GCP VM creation with snapshot-derived disks attached by same principal

ills3c Intel&Coffee@Ills3C

•updated today•1•0•3

Detects a suspicious sequence of activities in GCP Compute Engine where a principal creates a new VM instance, attaches a disk, and creates a disk snapshot or new disk within a short window, potentially indicating data staging or exfiltration preparation.