New attack technique: Overwrite a Cloud Function with Malicious Code (gcp.persistence.overwrite-cloud-function)

[Minosity-VR]

What does this PR do?

Adds a new GCP attack technique gcp.persistence.overwrite-cloud-function that replaces the source code of a Cloud Functions v2 function with code that exfiltrates runtime environment variables, simulating a supply-chain or insider attack.

Motivation

GCP parity effort with existing AWS techniques (analogous to aws.persistence.lambda-overwrite-code).

Checklist

• The attack technique emulates a single attack step, not a full attack chain
• We have factual evidence & references that the attack technique was used by real malware, pentesters, or attackers
• The attack technique makes no assumption about the state of the environment prior to warming it up

Test results

• Technique detonates successfully
• Detection log identified (google.cloud.functions.v2.CloudFunctionsService.UpdateFunction)