Google Cloud Firewall Modified or Deleted

calendar Oct 12, 2023 · attack.defense_evasion attack.t1562  ·
Share on: linkedin copy

Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).

Sigma rule (View on GitHub)

 1title: Google Cloud Firewall Modified or Deleted
 2id: fe513c69-734c-4d4a-8548-ac5f609be82b
 3status: test
 4description: Detects  when a firewall rule is modified or deleted in Google Cloud Platform (GCP).
 5references:
 6    - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
 7    - https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.Firewalls.html
 8author: Austin Songer @austinsonger
 9date: 2021/08/13
10modified: 2022/10/09
11tags:
12    - attack.defense_evasion
13    - attack.t1562
14logsource:
15    product: gcp
16    service: gcp.audit
17detection:
18    selection:
19        gcp.audit.method_name:
20            - v*.Compute.Firewalls.Delete
21            - v*.Compute.Firewalls.Patch
22            - v*.Compute.Firewalls.Update
23            - v*.Compute.Firewalls.Insert
24    condition: selection
25falsepositives:
26    - Firewall rules being modified or deleted may be performed by a system administrator. Verify that the firewall configuration change was expected.
27    - Exceptions can be added to this rule to filter expected behavior.
28level: medium

References

Related rules

to-top