huntrule

Google Cloud DLP Re-identifies Sensitive Data via projects.content.reidentify

Detects Google Cloud DLP re-identification activity using projects.content.reidentify in audit logs.

FreeReviewedSigma · Medium · v4
Product
gcp
Service
gcp.audit
Author
Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published
2021-08-15
Updated
2026-07-31
AnalysisDetection
title: Google Cloud DLP Re-identifies Sensitive Data via projects.content.reidentify
id: 63884c9e-9536-4d5c-8d4d-00672b58c64f
status: test
description: This rule flags Google Cloud audit events where the DLP re-identification operation is invoked using projects.content.reidentify. Re-identification can expose sensitive information by transforming previously anonymized or de-identified data, making it a high-impact action in data handling workflows. It relies on GCP audit telemetry capturing the API method name for content re-identification requests.
references:
  - https://cloud.google.com/dlp/docs/reference/rest/v2/projects.content/reidentify
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_dlp_re_identifies_sensitive_information.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-15
modified: 2022-10-09
tags:
  - attack.impact
  - attack.t1565
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name: projects.content.reidentify
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 234f9f48-904b-4736-a34c-55d23919e4b7
    type: derived