GCP Audit Logs: Firewall Rule Modified or Deleted

Flags GCP audit events where firewall rules are inserted, updated, patched, or deleted.

FreeUnreviewedSigmamediumv1

gcp-audit-logs-firewall-rule-modified-or-deleted-fe513c69

title: "GCP Audit Logs: Firewall Rule Modified or Deleted"
id: 73a7bdb1-3dd5-423d-ae55-8131d18c27a9
status: test
description: This rule identifies Google Cloud Platform firewall rule changes by matching audit events for firewall Insert, Update, Patch, and Delete API calls. Attackers may modify or remove firewall rules to weaken network exposure or maintain persistence by allowing or denying traffic. It relies on GCP audit log telemetry, specifically the audit method_name values for Compute.Firewalls operations.
references:
  - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
  - https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.Firewalls.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_firewall_rule_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-13
modified: 2022-10-09
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name:
      - v*.Compute.Firewalls.Delete
      - v*.Compute.Firewalls.Patch
      - v*.Compute.Firewalls.Update
      - v*.Compute.Firewalls.Insert
  condition: selection
falsepositives:
  - Firewall rules being modified or deleted may be performed by a system administrator. Verify that the firewall configuration change was expected.
  - Exceptions can be added to this rule to filter expected behavior.
level: medium
license: DRL-1.1
related:
  - id: fe513c69-734c-4d4a-8548-ac5f609be82b
    type: derived

What it detects

This rule identifies Google Cloud Platform firewall rule changes by matching audit events for firewall Insert, Update, Patch, and Delete API calls. Attackers may modify or remove firewall rules to weaken network exposure or maintain persistence by allowing or denying traffic. It relies on GCP audit log telemetry, specifically the audit method_name values for Compute.Firewalls operations.

Known false positives

Firewall rules being modified or deleted may be performed by a system administrator. Verify that the firewall configuration change was expected.
Exceptions can be added to this rule to filter expected behavior.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.