GCP Audit: Firewall Rule Insert, Update, Patch, or Delete

Flags GCP audit events where firewall rules are inserted, updated, patched, or deleted.

FreeReviewedSigma · Medium · v4

Product: gcp
Service: gcp.audit
Author: Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published: 2021-08-13
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule detects changes to Google Cloud firewall resources by matching GCP audit log API method names for firewall rule Insert, Update, Patch, or Delete. An attacker or unauthorized user could use these operations to weaken network controls or disrupt access by adding, altering, or removing firewall rules. It relies on GCP audit telemetry that records Compute.Firewalls API method_name values and correlates them to modification and deletion activity.

Reporting behind it

Related detections9 linkedT1685 — drag to rearrange

Suspicious Process Explorer Kernel Driver Dropped as PED.sys via File Creation (via file_event)

Malicious Windows Defender Tampering via Set-MpPreference and Add-MpPreference (via ps_script)

Suspicious PowerShell AMSI Bypass via 8220 Gang Hadooken Loader

Malicious Microsoft Defender Services Stopped via sc.exe

Suspicious Microsoft Defender Definitions Removed via MpCmdRun

Suspicious Defender Behavior Monitoring Disable via PowerShell (via process_creation)

Suspicious Windows Defender Real-Time Monitoring Disable (via process_creation)

Malicious Microsoft Defender Real-Time Monitoring Disabled via Set-MpPreference (via process_creation)

Suspicious Windows Defender Exclusion Added via PowerShell via Process Creation (via process_creation)

GCP Audit: Firewall Rule Insert, Update, Patch, or Delete

Pivot detection · T1685 · 9 related

Changelog

v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

gcp-audit-logs-firewall-rule-modified-or-deleted-fe513c69

title: "GCP Audit: Firewall Rule Insert, Update, Patch, or Delete"
id: 73a7bdb1-3dd5-423d-ae55-8131d18c27a9
status: test
description: This rule detects changes to Google Cloud firewall resources by matching GCP audit log API method names for firewall rule Insert, Update, Patch, or Delete. An attacker or unauthorized user could use these operations to weaken network controls or disrupt access by adding, altering, or removing firewall rules. It relies on GCP audit telemetry that records Compute.Firewalls API method_name values and correlates them to modification and deletion activity.
references:
  - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
  - https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.Firewalls.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_firewall_rule_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-13
modified: 2022-10-09
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name:
      - v*.Compute.Firewalls.Delete
      - v*.Compute.Firewalls.Patch
      - v*.Compute.Firewalls.Update
      - v*.Compute.Firewalls.Insert
  condition: selection
falsepositives:
  - Firewall rules being modified or deleted may be performed by a system administrator. Verify that the firewall configuration change was expected.
  - Exceptions can be added to this rule to filter expected behavior.
level: medium
license: DRL-1.1
related:
  - id: fe513c69-734c-4d4a-8548-ac5f609be82b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL