Google Cloud Outlines 2026 Defenses Against Destructive Cyberattacks
Summary
Google Cloud’s 2026 guide recommends controls for preventing, detecting, and recovering from destructive attacks, including phishing-resistant MFA, immutable backups, IT/OT segmentation, virtualization and cloud hardening, and extensive monitoring guidance.
Key points
- Use out-of-band incident communications, defined recovery priorities, trusted response vendors, and practiced restoration exercises.
- Harden external access with phishing-resistant MFA; monitor brute-force, password-spray, AiTM and token theft, MFA fatigue, and OAuth consent abuse.
- Protect domain-controller and critical-system backups with offline or immutable storage, encryption, access controls, alerting, and tested restores.
- Segment IT and OT identities and networks; apply deny-by-default egress controls and inspect outbound traffic.
- Isolate virtualization management planes, restrict SSH, encrypt Tier 0 VMs, centralize hypervisor logs, and monitor disk detach/reattach and bulk power-off events.
- Apply least privilege and just-in-time access in cloud environments; harden Kubernetes and CI/CD with signed images, immutable backups, and centralized audit logging.
- The guide provides detection use cases across Active Directory, endpoints, cloud, virtualization, and Kubernetes, including Google SecOps rules such as “BABYWIPER File Erasure.”
Article Details
- Defense Focus
- Prepare for, detect, contain, and recover from destructive attacks across identity, backups, virtualization, cloud, OT, and CI/CD environments.
- Detection Methods
- Baseline failed sign-ins, password spraying, anomalous session origins, repeated MFA prompts, and new MFA registrations following unfamiliar sign-ins.
- Detect deletion of shadow copies, backup data, snapshots, and recovery configurations; alert on unauthorized backup access.
- Correlate virtual disk detach and reattach events with nonstandard VMs, and detect bulk VM power-offs or snapshot deletions.
- Monitor non-domain-controller replication requests, LSASS access, suspicious Kerberos requests, and changes to credential protection settings.
- Detect abnormal SMB and WMI activity, unauthorized SSH access, and security-tool or logging changes.
- Monitor Kubernetes audit logs for bulk deletions, unusual secret access, privileged workloads, and images failing signature verification; audit CI/CD configuration changes.
- Data Sources
- Identity provider sign-in and audit logs
- Windows security events and Sysmon
- Active Directory replication and domain controller logs
- Backup product and storage audit logs
- vCenter events, vpxd.log, hostd.log, and ESXi shell.log
- Firewall, DNS, proxy, and network flow logs
- Cloud identity and infrastructure audit logs
- Kubernetes control-plane audit logs, container registry events, and CI/CD pipeline logs
- Rule Types
- Named security operations detection rules
- Platforms
- Windows
- Cloud environments
- Operational technology environments
- Virtualization infrastructure
- Defensive Actions
- Use phishing-resistant MFA, privileged access workstations, and just-in-time, least-privilege administration.
- Maintain encrypted, offline or immutable backups in a separately controlled identity plane; routinely test restoration and validate DSRM credentials.
- Segment IT from OT and isolate virtualization management; restrict administrative access and apply deny-by-default egress controls.
- Encrypt critical virtual machines and backup repositories, forward hypervisor logs, and remove orphaned VMs.
- Restrict lateral movement protocols and privileged account logons; disable WDigest and restrict NTLM where feasible.
- Protect CI/CD and cluster access with MFA, restricted RBAC, image signing and provenance checks, and immutable backups.
- Establish out-of-band incident communications and practice prioritized recovery procedures.
MITRE ATT&CK
T1003.002 · Security Account ManagerThe guidance recommends monitoring Sysmon Event ID 10 for non-system processes opening LSASS handles with specified access rights.T1003.006 · DCSyncThe guidance recommends detecting directory replication requests from non-domain-controller sources, including Event ID 4662 with replication GUIDs.T1021.002 · SMB/Windows Admin SharesThe guidance recommends detecting abnormal SMB connection volumes and restricting administrative shares used for lateral movement.T1047 · Windows Management InstrumentationThe guidance recommends detecting WMI invoked through command line or PowerShell to execute on remote systems.T1110.003 · Password SprayingThe guidance recommends detecting failed authentication across many accounts from similar sources as potential password spraying.T1187 · Forced AuthenticationThe guidance recommends monitoring unexpected NTLM authentication over SMB or WebDAV and specific coercion-related RPC calls.T1195.002 · Compromise Software Supply ChainThe guidance recommends auditing unauthorized CI/CD pipeline changes that could introduce malicious workflows or poisoned deployments.T1485 · Data DestructionThe guidance recommends detecting bulk Kubernetes API deletions of resources including deployments, persistent volume claims, and namespaces.T1490 · Inhibit System RecoveryThe guidance recommends detecting shadow-copy and snapshot deletion and changes to recovery-critical backups.T1529 · System Shutdown/RebootThe guidance recommends correlating bulk VM power-offs with vCenter power-off events.T1552.007 · Container APIThe guidance recommends monitoring unusual Kubernetes secrets API access and bulk secret enumeration.T1557 · Adversary-in-the-MiddleThe article recommends correlating successful sign-ins with anomalous IPs or ASNs to identify potential adversary-in-the-middle session theft.T1558.003 · KerberoastingThe guidance recommends looking for downgraded RC4 Kerberos service ticket requests associated with potential Kerberoasting.T1562.001 · Disable or Modify ToolsThe article recommends detecting attempts to stop security tools or disable ESXi execution and secure-boot enforcement.T1621 · Multi-Factor Authentication Request GenerationThe guidance recommends alerting on more than five MFA pushes in ten minutes without successful authentication.
Malware
Vendors
GoogleGoogle Security OperationsMicrosoftAdditionally, MFA should be leveraged for accessing not only on-premises external-facing managed infrastructure, but also for cloud-based resources (e.g., software-as-a-service [SaaS] such as Microsoft 365 [M365]).VMware(‘Monitor for processes accessing .vmdk, .vmx, .vmsd, or .vmsn files outside of normal VMware service processes (hostd, vpxd, fdm).’)
Products
ESXiHarden virtualization management (vCenter/ESXi/Hyper-V): isolate management plane, restrict SSH, enable VM encryption, forward hypervisor logs, and detect VM disk detach/reattach and bulk VM power-off/snapshot deletionGoogle Security OperationsGoogle Security Operations (SecOps) customers have access to these broad category rules and more under the Mandiant Intel Emerging Threats, Mandiant Frontline Threats, Mandiant Hunting Rules, CDIR SCC Enhanced DataKubernetescyberattacks by hardening identity, backups, virtualization, cloud, OT/IT segmentation, and CI/CD/Kubernetes pipelines while listing detection opportunities and recommended controls.Mandiant Attack Surface ManagementLeveraging Mandiant Attack Surface Management or a third-party vulnerability scanning technology to identify assets and associated vulnerabilities.Microsoft Active DirectoryHarden endpoints and Active Directory: restrict privileged account usage to PAWs, enforce Protected Users, rotate service account secrets, disable risky auth (WDigest/NTLMv1), enable tamper protection, and monitorMicrosoft Defender for EndpointTamper protection either in Windows (via Microsoft Defender for Endpoint) or integrated within third-party AV/EDR platforms can help protect security tools from being modified or stopped by a threat actor.Microsoft Hyper-VHarden virtualization management (vCenter/ESXi/Hyper-V): isolate management plane, restrict SSH, enable VM encryption, forward hypervisor logs, and detect VM disk detach/reattach and bulk VM power-off/snapshot deletionVMware vCenter ServerHarden virtualization management (vCenter/ESXi/Hyper-V): isolate management plane, restrict SSH, enable VM encryption, forward hypervisor logs, and detect VM disk detach/reattach and bulk VM power-off/snapshot deletion
Tools
CertifyAny account that is authenticated to Active Directory can query LDAP directly, with the built-in Windows command certutil.exe, or with specialized tools such as PSPKIAudit, Certipy, and Certify.certipyAny account that is authenticated to Active Directory can query LDAP directly, with the built-in Windows command certutil.exe, or with specialized tools such as PSPKIAudit, Certipy, and Certify.EvilProxyTCP/5985/5986) and suspicious egress to newly registered domains or known reverse-proxy names (e.g., EvilProxy, Tycoon referenced as detection examples).PsExecAdditionally, if PsExec is used in an environment, disabling the admin (ADMIN$) share can restrict the capability for this tool to be used to remotely interface with endpoints.PSPKIAuditAny account that is authenticated to Active Directory can query LDAP directly, with the built-in Windows command certutil.exe, or with specialized tools such as PSPKIAudit, Certipy, and Certify.Tycoon 2FADetect logins from newly registered domains or known reverse-proxy infrastructure (EvilProxy, Tycoon 2FA).