Detectionmediumtest

Google Cloud Storage Buckets Modified or Deleted

Detects when storage bucket is modified or deleted in Google Cloud.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Austin SongerCreated Sat Aug 14Updated Sun Oct 094d9f2ee2-c903-48ab-b9c1-8c0f474913d0cloud

Log Source

Google Cloudgcp.audit

ProductGoogle Cloud← raw: gcp

Servicegcp.audit← raw: gcp.audit

Detection Logic

detection:
    selection:
        gcp.audit.method_name:
            - storage.buckets.delete
            - storage.buckets.insert
            - storage.buckets.update
            - storage.buckets.patch
    condition: selection

False Positives

Storage Buckets being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.

Storage Buckets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

References

Resolving title…

cloud.google.com

MITRE ATT&CK

Tactics

TA0040 · Impact

Rule Metadata

Rule ID

4d9f2ee2-c903-48ab-b9c1-8c0f474913d0

Status

test

Level