GCP Access Policy Deletion via accesscontextmanager Audit Logs

Flags GCP Access Context Manager audit events where granted access policy delete permissions occur.

FreeUnreviewedSigmamediumv1

gcp-access-policy-deletion-via-accesscontextmanager-audit-logs-32438676

title: GCP Access Policy Deletion via accesscontextmanager Audit Logs
id: 7b13bf52-14cd-49e4-8583-42aba3a1ac8f
status: test
description: This rule identifies audit log events where Access Context Manager access policies, access levels, access zones, or authorized org descriptors are deleted. Deleting these policies can remove enforcement controls and help an adversary regain or expand access to protected GCP resources. It relies on GCP audit telemetry that records granted delete permissions for the accesscontextmanager.googleapis.com service in the protoPayload authorization and service fields.
references:
  - https://cloud.google.com/access-context-manager/docs/audit-logging
  - https://cloud.google.com/logging/docs/audit/understanding-audit-logs
  - https://cloud.google.com/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_access_policy_deleted.yml
author: Bryan Lim, Huntrule Team
date: 2024-01-12
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    data.protoPayload.authorizationInfo.permission:
      - accesscontextmanager.accessPolicies.delete
      - accesscontextmanager.accessPolicies.accessLevels.delete
      - accesscontextmanager.accessPolicies.accessZones.delete
      - accesscontextmanager.accessPolicies.authorizedOrgsDescs.delete
    data.protoPayload.authorizationInfo.granted: "true"
    data.protoPayload.serviceName: accesscontextmanager.googleapis.com
  condition: selection
falsepositives:
  - Legitimate administrative activities
level: medium
license: DRL-1.1
related:
  - id: 32438676-1dba-4ac7-bf69-b86cba995e05
    type: derived

What it detects

This rule identifies audit log events where Access Context Manager access policies, access levels, access zones, or authorized org descriptors are deleted. Deleting these policies can remove enforcement controls and help an adversary regain or expand access to protected GCP resources. It relies on GCP audit telemetry that records granted delete permissions for the accesscontextmanager.googleapis.com service in the protoPayload authorization and service fields.

Known false positives

Legitimate administrative activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.