Detectionmediumtest

GCP Access Policy Deleted

Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Bryan LimCreated Fri Jan 1232438676-1dba-4ac7-bf69-b86cba995e05cloud

Log Source

Google Cloudgcp.audit

ProductGoogle Cloud← raw: gcp

Servicegcp.audit← raw: gcp.audit

Detection Logic

detection:
    selection:
        data.protoPayload.authorizationInfo.permission:
            - 'accesscontextmanager.accessPolicies.delete'
            - 'accesscontextmanager.accessPolicies.accessLevels.delete'
            - 'accesscontextmanager.accessPolicies.accessZones.delete'
            - 'accesscontextmanager.accessPolicies.authorizedOrgsDescs.delete'
        data.protoPayload.authorizationInfo.granted: 'true'
        data.protoPayload.serviceName: 'accesscontextmanager.googleapis.com'
    condition: selection