gcp Sigma detection rules

Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource.

gcp · gcp.audit

Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.

gcp · gcp.audit

Identifies when a DNS Zone is modified or deleted in Google Cloud.

gcp · gcp.audit

Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).

gcp · gcp.audit

Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

gcp · gcp.audit

Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

gcp · gcp.audit

Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.

gcp · gcp.audit

Identifies when the Secrets are Modified or Deleted.

gcp · gcp.audit

Identifies when sensitive information is re-identified in google Cloud.

gcp · gcp.audit

Identifies when a service account is disabled or deleted in Google Cloud.

gcp · gcp.audit

Identifies when a service account is modified in Google Cloud.

gcp · gcp.audit

Detect when a Cloud SQL DB has been modified or deleted.

gcp · gcp.audit

Detects when storage bucket is modified or deleted in Google Cloud.

gcp · gcp.audit

Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.

gcp · gcp.audit

Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.

gcp · gcp.audit

Detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary would be able to remove access levels to gain easier access to Google workspace resources.

gcp · google_workspace.admin

Detects when an an application is removed from Google Workspace.

gcp · google_workspace.admin

Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor

gcp · google_workspace.login

Detects when an API access service account is granted domain authority.

gcp · google_workspace.admin

Detects when multi-factor authentication (MFA) is disabled.

gcp · google_workspace.admin

Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.

gcp · google_workspace.login

Detects when an a role is modified or deleted in Google Workspace.

gcp · google_workspace.admin

Detects when an a role privilege is deleted in Google Workspace.

gcp · google_workspace.admin

Detects when an Google Workspace user is granted admin privileges.

gcp · google_workspace.admin

Detects Google Workspace login activity that's classified as suspicious by Google.

gcp · google_workspace.login

Detects when storage bucket is enumerated in Google Cloud.

gcp · gcp.audit