title: GCP New Project, Billing Link, Project SSH Key or Compute Instance
id: 2f0b7c3e-6a41-4c1e-9b8a-1d2e3f4a5b07
status: experimental
description: Resource creation consistent with abuse of exposed credentials (Railway guidance lists compute instances, buckets and project-level SSH keys).
references:
    - https://blog.railway.com/p/security-disclosure-recommendation-check-for-anomalous-gcp-access
author: Defensive detection pack
date: 2026-10-22
tags:
    - attack.impact
    - attack.t1496
logsource:
    product: gcp
    service: gcp.audit
detection:
    selection:
        gcp.audit.method_name|contains:
            - CreateProject
            - UpdateProjectBillingInfo
            - setCommonInstanceMetadata
            - compute.instances.insert
            - storage.buckets.create
    condition: selection
falsepositives:
    - Normal deployments
level: low