GCP Storage Bucket Permissions Modification

 1[metadata]
 2creation_date = "2020/09/21"
 3integration = ["gcp"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies when the Identity and Access Management (IAM) permissions are modified for a Google Cloud Platform (GCP)
11storage bucket. An adversary may modify the permissions on a storage bucket to weaken their target's security controls
12or an administrator may inadvertently modify the permissions, which could lead to data exposure or loss.
13"""
14false_positives = [
15    """
16    Storage bucket permissions may be modified by system administrators. Verify that the configuration change was
17    expected. Exceptions can be added to this rule to filter expected behavior.
18    """,
19]
20index = ["filebeat-*", "logs-gcp*"]
21language = "kuery"
22license = "Elastic License v2"
23name = "GCP Storage Bucket Permissions Modification"
24note = """## Setup
25
26The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
27references = ["https://cloud.google.com/storage/docs/access-control/iam-permissions"]
28risk_score = 47
29rule_id = "2326d1b2-9acf-4dee-bd21-867ea7378b4d"
30severity = "medium"
31tags = [
32    "Domain: Cloud",
33    "Data Source: GCP",
34    "Data Source: Google Cloud Platform",
35    "Use Case: Identity and Access Audit",
36    "Tactic: Defense Evasion",
37]
38timestamp_override = "event.ingested"
39type = "query"
40
41query = '''
42event.dataset:gcp.audit and event.action:"storage.setIamPermissions" and event.outcome:success
43'''
44
45
46[[rule.threat]]
47framework = "MITRE ATT&CK"
48[[rule.threat.technique]]
49id = "T1222"
50name = "File and Directory Permissions Modification"
51reference = "https://attack.mitre.org/techniques/T1222/"
52
53
54[rule.threat.tactic]
55id = "TA0005"
56name = "Defense Evasion"
57reference = "https://attack.mitre.org/tactics/TA0005/"