An attacker with GCP cloud administrative access uses the Google gcloud and gsutil utilities to create a backup of a sensitive database for download. How would this attack be identified?

Threat Intelligence identifies known malicious IPs, domains, or TTPs externally; it would not flag legitimate GCP admin tool usage from an authorized account.

Network Monitoring detects anomalous traffic patterns, but gcloud/gsutil traffic uses standard HTTPS to GCP endpoints and would not stand out from normal API usage.

Google Cloud Audit Logs (Cloud Audit Logs - Admin Activity and Data Access logs) capture every API call made by gcloud and gsutil, including storage bucket creation, database export operations, and object downloads. Because the attacker is using legitimate administrative credentials, the activity bypasses network anomaly detection but leaves a detailed, timestamped trail in the audit log. Reviewing Cloud Audit Logs for unusual export or copy operations against sensitive datasets would expose this insider or compromised-credential attack.

Packet Capture would only show encrypted HTTPS traffic to GCP APIs; decrypting and parsing this traffic at scale is impractical and would not reliably identify the specific data exfiltration action.