GCP Audit: Full Network Packet Capture via Compute PacketMirrorings API
Alerts on GCP Compute PacketMirrorings API calls that may enable full network packet capture.
- Product
- gcp
- Service
- gcp.audit
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-08-13
- Updated
- 2026-07-31
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags creation, modification, listing, retrieval, and deletion of Google Compute PacketMirroring resources using gcp.audit method_name events. Attackers can abuse packet mirroring to capture and potentially expose sensitive data from unencrypted internal network traffic. It relies on GCP audit logging telemetry for Compute.PacketMirrorings.* API calls, matching method names across versions (v*).
Reporting behind it
- cloud.google.comhttps://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
- developers.google.comhttps://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.PacketMirrorings.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_full_network_traffic_packet_capture.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "GCP Audit: Full Network Packet Capture via Compute PacketMirrorings API"
id: 72efcb3c-dce6-4a68-9d5c-d760ca620a29
status: test
description: This rule flags creation, modification, listing, retrieval, and deletion of Google Compute PacketMirroring resources using gcp.audit method_name events. Attackers can abuse packet mirroring to capture and potentially expose sensitive data from unencrypted internal network traffic. It relies on GCP audit logging telemetry for Compute.PacketMirrorings.* API calls, matching method names across versions (v*).
references:
- https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
- https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.PacketMirrorings.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_full_network_traffic_packet_capture.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-13
modified: 2022-10-09
tags:
- attack.collection
- attack.t1074
logsource:
product: gcp
service: gcp.audit
detection:
selection:
gcp.audit.method_name:
- v*.Compute.PacketMirrorings.Get
- v*.Compute.PacketMirrorings.Delete
- v*.Compute.PacketMirrorings.Insert
- v*.Compute.PacketMirrorings.Patch
- v*.Compute.PacketMirrorings.List
- v*.Compute.PacketMirrorings.aggregatedList
condition: selection
falsepositives:
- Full Network Packet Capture may be done by a system or network administrator.
- If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
- id: 980a7598-1e7f-4962-9372-2d754c930d0e
type: derived