valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 01:45:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Create gcp_bucket_modified_or_deleted.yml

Browse Source
This commit is contained in:
Austin Songer 2021-08-14 21:53:56 -05:00 committed by GitHub
parent 5c4fd3a122
commit 980954751e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
rules/cloud/gcp/gcp_bucket_modified_or_deleted.yml Normal file
View File

@ -0,0 +1,24 @@
title: Google Cloud Storage Buckets Modified or Deleted
id: 4d9f2ee2-c903-48ab-b9c1-8c0f474913d0
description: Detects when storage bucket is modified or deleted in Google Cloud.
author: Austin Songer
status: experimental
date: 2021/08/14
references:
- https://cloud.google.com/storage/docs/json_api/v1/buckets
logsource:
service: gcp.audit
detection:
selection:
gcp.audit.method_name:
- storage.v*.buckets.delete
- storage.v*.buckets.insert
- storage.v*.buckets.update
- storage.v*.buckets.patch
condition: selection
level: medium
tags:
- attack.impact
falsepositives:
- Storage Buckets being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
- Storage Buckets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.