GCP Audit: Full Network Packet Mirroring API Activity

title: "GCP Audit: Full Network Packet Mirroring API Activity"
id: 72efcb3c-dce6-4a68-9d5c-d760ca620a29
status: test
description: This rule flags GCP Audit log events tied to Compute PacketMirrorings API operations, including Get, List/aggregatedList, Insert, Patch, and Delete. Full network packet mirroring can enable an attacker to capture and potentially extract sensitive data from internal network traffic, particularly if traffic is not adequately protected. The detection relies on gcp.audit telemetry that records the API method names for PacketMirrorings requests.
references:
  - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
  - https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.PacketMirrorings.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_full_network_traffic_packet_capture.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-13
modified: 2022-10-09
tags:
  - attack.collection
  - attack.t1074
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name:
      - v*.Compute.PacketMirrorings.Get
      - v*.Compute.PacketMirrorings.Delete
      - v*.Compute.PacketMirrorings.Insert
      - v*.Compute.PacketMirrorings.Patch
      - v*.Compute.PacketMirrorings.List
      - v*.Compute.PacketMirrorings.aggregatedList
  condition: selection
falsepositives:
  - Full Network Packet Capture may be done by a system or network administrator.
  - If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 980a7598-1e7f-4962-9372-2d754c930d0e
    type: derived