# Source: https://docs.datadoghq.com/security/default_rules/a6b-6c9-419.md

---
title: Google Cloud Storage Bucket enumerated
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Google Cloud Storage Bucket enumerated
---

# Google Cloud Storage Bucket enumerated
Classification:attackTactic:[TA0007-discovery](https://attack.mitre.org/tactics/TA0007)Technique:[T1619-cloud-storage-object-discovery](https://attack.mitre.org/techniques/T1619) 
## Goal{% #goal %}

Detect when a service account lists out GCS Buckets.

## Strategy{% #strategy %}

This rule lets you monitor GCS bucket admin activity audit logs to determine when a service account invokes the following method:

- `storage.buckets.list`

## Triage and response{% #triage-and-response %}

Determine whether this service account should be making list bucket calls.

- If the account was compromised, secure the account and investigate how it was compromised and if the account made other unauthorized calls.
- If the owner of the service account intended to make the `ListBuckets` API call, consider whether this API call is needed. It could cause a security issue for the application to know the name of the bucket it needs to access. If it's not needed, modify this rule's filter to stop generating signals for this specific service account.