valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 01:45:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1852 from austinsonger/gcp_dns_zone_modified_or_deleted.yml

Browse Source 
gcp_dns_zone_modified_or_deleted.yml
This commit is contained in:
frack113 2021-08-16 07:37:28 +02:00 committed by GitHub
commit c57ded1ecd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
rules/cloud/gcp/gcp_dns_zone_modified_or_deleted.yml Normal file
View File

@ -0,0 +1,22 @@
title: Google Cloud DNS Zone Modified or Deleted
id: 28268a8f-191f-4c17-85b2-f5aa4fa829c3
description: Identifies when a DNS Zone is modified or deleted in Google Cloud.
author: Austin Songer @austinsonger
status: experimental
date: 2021/08/15
references:
- https://cloud.google.com/dns/docs/reference/v1/managedZones
logsource:
service: gcp.audit
detection:
selection:
gcp.audit.method_name:
- Dns.ManagedZones.Delete
- Dns.ManagedZones.Update
- Dns.ManagedZones.Patch
condition: selection
level: medium
tags:
- attack.impact
falsepositives:
- Unkown