GCP Audit: Full Network Packet Capture via Compute PacketMirrorings API

title: "GCP Audit: Full Network Packet Capture via Compute PacketMirrorings API"
id: 72efcb3c-dce6-4a68-9d5c-d760ca620a29
status: test
description: This rule flags creation, modification, listing, retrieval, and deletion of Google Compute PacketMirroring resources using gcp.audit method_name events. Attackers can abuse packet mirroring to capture and potentially expose sensitive data from unencrypted internal network traffic. It relies on GCP audit logging telemetry for Compute.PacketMirrorings.* API calls, matching method names across versions (v*).
references:
  - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
  - https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.PacketMirrorings.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_full_network_traffic_packet_capture.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-13
modified: 2022-10-09
tags:
  - attack.collection
  - attack.t1074
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name:
      - v*.Compute.PacketMirrorings.Get
      - v*.Compute.PacketMirrorings.Delete
      - v*.Compute.PacketMirrorings.Insert
      - v*.Compute.PacketMirrorings.Patch
      - v*.Compute.PacketMirrorings.List
      - v*.Compute.PacketMirrorings.aggregatedList
  condition: selection
falsepositives:
  - Full Network Packet Capture may be done by a system or network administrator.
  - If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 980a7598-1e7f-4962-9372-2d754c930d0e
    type: derived