Detectionmediumtest

Google Cloud DNS Zone Modified or Deleted

Identifies when a DNS Zone is modified or deleted in Google Cloud.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Austin SongerCreated Sun Aug 15Updated Sun Oct 0928268a8f-191f-4c17-85b2-f5aa4fa829c3cloud

Log Source

Google Cloudgcp.audit

ProductGoogle Cloud← raw: gcp

Servicegcp.audit← raw: gcp.audit

Detection Logic

detection:
    selection:
        gcp.audit.method_name:
            - Dns.ManagedZones.Delete
            - Dns.ManagedZones.Update
            - Dns.ManagedZones.Patch
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

Resolving title…

cloud.google.com

MITRE ATT&CK

Tactics

TA0040 · Impact

Rule Metadata

Rule ID

28268a8f-191f-4c17-85b2-f5aa4fa829c3

Status

test

Level

medium

Type

Detection

Created

Sun Aug 15

Modified

Sun Oct 09

Author

Austin Songer

Path

rules/cloud/gcp/audit/gcp_dns_zone_modified_or_deleted.yml

Raw Tags

attack.impact

View on GitHub