deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: AWS IAM Backdoor Users Keys
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: faloker
Date: 2020-02-12
ATT&CK techniques: T1098
Log source: aws/

Description:
Detects AWS API key creation for a user by another user.
Backdoored users can be used to obtain persistence in the AWS environment.
Also with this alert, you can detect a flow of AWS keys in your org.


Detection logic:
{
  "selection_source": {
    "eventSource": "iam.amazonaws.com",
    "eventName": "CreateAccessKey"
  },
  "filter": {
    "userIdentity.arn|contains": "responseElements.accessKey.userName"
  },
  "condition": "selection_source and not filter"
}

References:
  - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__backdoor_users_keys/main.py
Sigma Detection Rule: AWS ElastiCache Security Group Created
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Songer @austinsonger
Date: 2021-07-24
ATT&CK techniques: T1136, T1136.003
Log source: aws/

Description:
Detects when an ElastiCache security group has been created.

Detection logic:
{
  "selection": {
    "eventSource": "elasticache.amazonaws.com",
    "eventName": "CreateCacheSecurityGroup"
  },
  "condition": "selection"
}

References:
  - https://github.com/elastic/detection-rules/blob/598f3d7e0a63221c0703ad9a0ea7e22e7bc5961e/rules/integrations/aws/persistence_elasticache_security_group_creation.toml
Sigma Detection Rule: AWS Console GetSigninToken Potential Abuse
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Chester Le Bron (@123Le_Bron)
Date: 2024-02-26
ATT&CK techniques: T1021.007, T1550.001
Log source: aws/

Description:
Detects potentially suspicious events involving "GetSigninToken".
An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.


Detection logic:
{
  "selection": {
    "eventSource": "signin.amazonaws.com",
    "eventName": "GetSigninToken"
  },
  "filter_main_console_ua": {
    "userAgent|contains": "Jersey/${project.version}"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/NetSPI/aws_consoler
  - https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/
Sigma Detection Rule: AWS IAM S3Browser User or AccessKey Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: daniel.bohannon@permiso.io (@danielhbohannon)
Date: 2023-05-17
ATT&CK techniques: T1059.009, T1078.004
Log source: aws/

Description:
Detects S3 Browser utility creating IAM User or AccessKey.

Detection logic:
{
  "selection": {
    "eventSource": "iam.amazonaws.com",
    "eventName": [
      "CreateUser",
      "CreateAccessKey"
    ],
    "userAgent|contains": "S3 Browser"
  },
  "condition": "selection"
}

References:
  - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor
Sigma Detection Rule: AWS EC2 Startup Shell Script Change
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: faloker
Date: 2020-02-12
ATT&CK techniques: T1059.001, T1059.003, T1059.004
Log source: aws/

Description:
Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

Detection logic:
{
  "selection_source": {
    "eventSource": "ec2.amazonaws.com",
    "requestParameters.attribute": "userData",
    "eventName": "ModifyInstanceAttribute"
  },
  "condition": "selection_source"
}

References:
  - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ec2__startup_shell_script/main.py#L9
Sigma Detection Rule: AWS SAML Provider Deletion Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Ivan Saakov
Date: 2024-12-19
ATT&CK techniques: T1078.004, T1531
Log source: aws/

Description:
Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access.
An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.


Detection logic:
{
  "selection": {
    "eventSource": "iam.amazonaws.com",
    "eventName": "DeleteSAMLProvider",
    "status": "success"
  },
  "condition": "selection"
}

References:
  - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html
Sigma Detection Rule: AWS Route 53 Domain Transferred to Another Account
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Elastic, Austin Songer @austinsonger
Date: 2021-07-22
ATT&CK techniques: T1098
Log source: aws/

Description:
Detects when a request has been made to transfer a Route 53 domain to another AWS account.

Detection logic:
{
  "selection": {
    "eventSource": "route53.amazonaws.com",
    "eventName": "TransferDomainToAnotherAwsAccount"
  },
  "condition": "selection"
}

References:
  - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml
Sigma Detection Rule: AWS Root Credentials
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: vitaliy0x1
Date: 2020-01-21
ATT&CK techniques: T1078.004
Log source: aws/

Description:
Detects AWS root account usage

Detection logic:
{
  "selection_usertype": {
    "userIdentity.type": "Root"
  },
  "selection_eventtype": {
    "eventType": "AwsServiceEvent"
  },
  "condition": "selection_usertype and not selection_eventtype"
}

References:
  - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
Sigma Detection Rule: Potential Bucket Enumeration on AWS
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io
Date: 2023-01-06
ATT&CK techniques: T1580, T1619
Log source: aws/

Description:
Looks for potential enumeration of AWS buckets via ListBuckets.

Detection logic:
{
  "selection": {
    "eventSource": "s3.amazonaws.com",
    "eventName": "ListBuckets"
  },
  "filter": {
    "userIdentity.type": "AssumedRole"
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md
  - https://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html
  - https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/
Sigma Detection Rule: AWS ElastiCache Security Group Modified or Deleted
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Songer @austinsonger
Date: 2021-07-24
ATT&CK techniques: T1531
Log source: aws/

Description:
Identifies when an ElastiCache security group has been modified or deleted.

Detection logic:
{
  "selection": {
    "eventSource": "elasticache.amazonaws.com",
    "eventName": [
      "DeleteCacheSecurityGroup",
      "AuthorizeCacheSecurityGroupIngress",
      "RevokeCacheSecurityGroupIngress",
      "AuthorizeCacheSecurityGroupEgress",
      "RevokeCacheSecurityGroupEgress"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/elastic/detection-rules/blob/7d5efd68603f42be5e125b5a6a503b2ef3ac0f4e/rules/integrations/aws/impact_elasticache_security_group_modified_or_deleted.toml
Sigma Detection Rule: Google Workspace Role Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer
Date: 2021-08-24
Log source: gcp/

Description:
Detects when an a role is modified or deleted in Google Workspace.

Detection logic:
{
  "selection": {
    "eventService": "admin.googleapis.com",
    "eventName": [
      "DELETE_ROLE",
      "RENAME_ROLE",
      "UPDATE_ROLE"
    ]
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings
Sigma Detection Rule: Google Workspace Granted Domain API Access
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer
Date: 2021-08-23
ATT&CK techniques: T1098
Log source: gcp/

Description:
Detects when an API access service account is granted domain authority.

Detection logic:
{
  "selection": {
    "eventService": "admin.googleapis.com",
    "eventName": "AUTHORIZE_API_CLIENT_ACCESS"
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings#AUTHORIZE_API_CLIENT_ACCESS
Sigma Detection Rule: Google Workspace Role Privilege Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer
Date: 2021-08-24
Log source: gcp/

Description:
Detects when an a role privilege is deleted in Google Workspace.

Detection logic:
{
  "selection": {
    "eventService": "admin.googleapis.com",
    "eventName": "REMOVE_PRIVILEGE"
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings
Sigma Detection Rule: Google Workspace Application Access Level Modified
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Bryan Lim
Date: 2024-01-12
ATT&CK techniques: T1098.003
Log source: gcp/

Description:
Detects when an access level is changed for a Google workspace application.
An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model.
An adversary would be able to remove access levels to gain easier access to Google workspace resources.


Detection logic:
{
  "selection": {
    "eventService": "admin.googleapis.com",
    "eventName": "CHANGE_APPLICATION_SETTING",
    "setting_name|startswith": "ContextAwareAccess"
  },
  "condition": "selection"
}

References:
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-application-settings
  - https://support.google.com/a/answer/9261439
Sigma Detection Rule: Google Workspace MFA Disabled
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer
Date: 2021-08-26
Log source: gcp/

Description:
Detects when multi-factor authentication (MFA) is disabled.

Detection logic:
{
  "selection_base": {
    "eventService": "admin.googleapis.com",
    "eventName": [
      "ENFORCE_STRONG_AUTHENTICATION",
      "ALLOW_STRONG_AUTHENTICATION"
    ]
  },
  "selection_eventValue": {
    "new_value": "false"
  },
  "condition": "all of selection*"
}

References:
  - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings#ENFORCE_STRONG_AUTHENTICATION
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings?hl=en#ALLOW_STRONG_AUTHENTICATION
Sigma Detection Rule: Google Workspace Application Removed
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer
Date: 2021-08-26
Log source: gcp/

Description:
Detects when an an application is removed from Google Workspace.

Detection logic:
{
  "selection": {
    "eventService": "admin.googleapis.com",
    "eventName": [
      "REMOVE_APPLICATION",
      "REMOVE_APPLICATION_FROM_WHITELIST"
    ]
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION_FROM_WHITELIST
Sigma Detection Rule: Google Workspace User Granted Admin Privileges
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer
Date: 2021-08-23
ATT&CK techniques: T1098
Log source: gcp/

Description:
Detects when an Google Workspace user is granted admin privileges.

Detection logic:
{
  "selection": {
    "eventService": "admin.googleapis.com",
    "eventName": [
      "GRANT_DELEGATED_ADMIN_PRIVILEGES",
      "GRANT_ADMIN_PRIVILEGE"
    ]
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
  - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-user-settings#GRANT_ADMIN_PRIVILEGE
Sigma Detection Rule: Google Workspace Government Attack Warning
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Tom Kluter
Date: 2026-04-28
ATT&CK techniques: T1078
Log source: gcp/

Description:
Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor

Detection logic:
{
  "selection": {
    "protoPayload.serviceName": "login.googleapis.com",
    "protoPayload.metadata.event.eventName": "gov_attack_warning"
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging
  - https://cloud.google.com/logging/docs/audit/understanding-audit-logs
  - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#gov_attack_warning
Sigma Detection Rule: Suspicious Login Activity Classified By Google
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Tom Kluter
Date: 2026-04-28
ATT&CK techniques: T1078.004
Log source: gcp/

Description:
Detects Google Workspace login activity that's classified as suspicious by Google.

Detection logic:
{
  "selection": {
    "protoPayload.Servicename": "login.googleapis.com",
    "protoPayload.metadata.event.eventName": [
      "suspicious_login_less_secure_app",
      "suspicious_login",
      "suspicious_programmatic_login"
    ]
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging
  - https://cloud.google.com/logging/docs/audit/understanding-audit-logs
  - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_login
  - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_login_less_secure_app
  - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_programmatic_login
Sigma Detection Rule: Google Workspace Out Of Domain Email Forwarding
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Tom kluter
Date: 2026-04-28
ATT&CK techniques: T1114.003
Log source: gcp/

Description:
Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.

Detection logic:
{
  "selection": {
    "protoPayload.serviceName": "login.googleapis.com",
    "protoPayload.metadata.event.eventName": "email_forwarding_out_of_domain"
  },
  "condition": "selection"
}

References:
  - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#email_forwarding_out_of_domain
Sigma Detection Rule: Google Cloud Service Account Disabled or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-14
ATT&CK techniques: T1531
Log source: gcp/

Description:
Identifies when a service account is disabled or deleted in Google Cloud.

Detection logic:
{
  "selection": {
    "gcp.audit.method_name|endswith": [
      ".serviceAccounts.disable",
      ".serviceAccounts.delete"
    ]
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts
Sigma Detection Rule: Google Cloud Kubernetes CronJob
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-11-22
Log source: gcp/

Description:
Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate.
Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.
An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.


Detection logic:
{
  "selection": {
    "gcp.audit.method_name": [
      "io.k8s.api.batch.v*.Job",
      "io.k8s.api.batch.v*.CronJob"
    ]
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/kubernetes-engine/docs
  - https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
  - https://kubernetes.io/docs/concepts/workloads/controllers/job/
Sigma Detection Rule: Google Cloud DNS Zone Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-15
Log source: gcp/

Description:
Identifies when a DNS Zone is modified or deleted in Google Cloud.

Detection logic:
{
  "selection": {
    "gcp.audit.method_name": [
      "Dns.ManagedZones.Delete",
      "Dns.ManagedZones.Update",
      "Dns.ManagedZones.Patch"
    ]
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/dns/docs/reference/v1/managedZones
Sigma Detection Rule: Google Cloud Kubernetes Admission Controller
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-11-25
ATT&CK techniques: T1078, T1552, T1552.007
Log source: gcp/

Description:
Identifies when an admission controller is executed in GCP Kubernetes.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.


Detection logic:
{
  "selection": {
    "gcp.audit.method_name|startswith": "admissionregistration.k8s.io.v",
    "gcp.audit.method_name|contains": [
      ".mutatingwebhookconfigurations.",
      ".validatingwebhookconfigurations."
    ],
    "gcp.audit.method_name|endswith": [
      "create",
      "patch",
      "replace"
    ]
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/kubernetes-engine/docs
Sigma Detection Rule: GCP Break-glass Container Workload Deployed
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Bryan Lim
Date: 2024-01-12
ATT&CK techniques: T1548
Log source: gcp/

Description:
Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.


Detection logic:
{
  "selection": {
    "data.protoPayload.resource.type": "k8s_cluster",
    "data.protoPayload.logName": [
      "cloudaudit.googleapis.com/activity",
      "cloudaudit.googleapis.com%2Factivity"
    ],
    "data.protoPayload.methodName": "io.k8s.core.v1.pods.create"
  },
  "keywords": [
    "image-policy.k8s.io/break-glass"
  ],
  "condition": "selection and keywords"
}

References:
  - https://cloud.google.com/binary-authorization
Sigma Detection Rule: Google Cloud Re-identifies Sensitive Information
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-15
ATT&CK techniques: T1565
Log source: gcp/

Description:
Identifies when sensitive information is re-identified in google Cloud.

Detection logic:
{
  "selection": {
    "gcp.audit.method_name": "projects.content.reidentify"
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/dlp/docs/reference/rest/v2/projects.content/reidentify
Sigma Detection Rule: Google Cloud Storage Buckets Enumeration
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-14
Log source: gcp/

Description:
Detects when storage bucket is enumerated in Google Cloud.

Detection logic:
{
  "selection": {
    "gcp.audit.method_name": [
      "storage.buckets.list",
      "storage.buckets.listChannels"
    ]
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/storage/docs/json_api/v1/buckets
Sigma Detection Rule: Google Cloud SQL Database Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-10-15
Log source: gcp/

Description:
Detect when a Cloud SQL DB has been modified or deleted.

Detection logic:
{
  "selection": {
    "gcp.audit.method_name": [
      "cloudsql.instances.create",
      "cloudsql.instances.delete",
      "cloudsql.users.update",
      "cloudsql.users.delete"
    ]
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/users/update
Sigma Detection Rule: Google Cloud Service Account Modified
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-14
Log source: gcp/

Description:
Identifies when a service account is modified in Google Cloud.

Detection logic:
{
  "selection": {
    "gcp.audit.method_name|endswith": [
      ".serviceAccounts.patch",
      ".serviceAccounts.create",
      ".serviceAccounts.update",
      ".serviceAccounts.enable",
      ".serviceAccounts.undelete"
    ]
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts
Sigma Detection Rule: Google Full Network Traffic Packet Capture
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-13
ATT&CK techniques: T1074
Log source: gcp/

Description:
Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.

Detection logic:
{
  "selection": {
    "gcp.audit.method_name": [
      "v*.Compute.PacketMirrorings.Get",
      "v*.Compute.PacketMirrorings.Delete",
      "v*.Compute.PacketMirrorings.Insert",
      "v*.Compute.PacketMirrorings.Patch",
      "v*.Compute.PacketMirrorings.List",
      "v*.Compute.PacketMirrorings.aggregatedList"
    ]
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
  - https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.PacketMirrorings.html
Sigma Detection Rule: Google Cloud Firewall Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-13
ATT&CK techniques: T1685
Log source: gcp/

Description:
Detects  when a firewall rule is modified or deleted in Google Cloud Platform (GCP).

Detection logic:
{
  "selection": {
    "gcp.audit.method_name": [
      "v*.Compute.Firewalls.Delete",
      "v*.Compute.Firewalls.Patch",
      "v*.Compute.Firewalls.Update",
      "v*.Compute.Firewalls.Insert"
    ]
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
  - https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.Firewalls.html