GCP Storage Bucket Deletion

 1[metadata]
 2creation_date = "2020/09/21"
 3integration = ["gcp"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket in
13order to disrupt their target's business operations.
14"""
15false_positives = [
16    """
17    Storage buckets may be deleted by a system or network administrator. Verify whether the user email, resource name,
18    and/or hostname should be making changes in your environment. Bucket deletions by unfamiliar users or hosts should
19    be investigated. If known behavior is causing false positives, it can be exempted from the rule.
20    """,
21]
22index = ["filebeat-*", "logs-gcp*"]
23language = "kuery"
24license = "Elastic License v2"
25name = "GCP Storage Bucket Deletion"
26note = """## Setup
27
28The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
29references = ["https://cloud.google.com/storage/docs/key-terms#buckets"]
30risk_score = 47
31rule_id = "bc0f2d83-32b8-4ae2-b0e6-6a45772e9331"
32severity = "medium"
33tags = ["Domain: Cloud", "Data Source: GCP", "Data Source: Google Cloud Platform", "Tactic: Impact"]
34timestamp_override = "event.ingested"
35type = "query"
36
37query = '''
38event.dataset:gcp.audit and event.action:"storage.buckets.delete"
39'''
40
41
42[[rule.threat]]
43framework = "MITRE ATT&CK"
44[[rule.threat.technique]]
45id = "T1485"
46name = "Data Destruction"
47reference = "https://attack.mitre.org/techniques/T1485/"
48
49
50[rule.threat.tactic]
51id = "TA0040"
52name = "Impact"
53reference = "https://attack.mitre.org/tactics/TA0040/"