GCP Cloud SQL: Database or User Modified/Deleted via Audit API

Alerts on Cloud SQL instance create/delete and user update/delete events in GCP audit logs.

FreeUnreviewedSigmamediumv1

gcp-cloud-sql-database-or-user-modified-deleted-via-audit-api-f346bbd5

title: "GCP Cloud SQL: Database or User Modified/Deleted via Audit API"
id: 694670a4-ca02-41dc-bfb5-2c366bdfae94
status: test
description: This rule flags Google Cloud SQL instances being created or deleted, as well as SQL users being updated or deleted, based on matching GCP audit method names. Such changes can indicate administrative activity, but they can also reflect attacker attempts to disrupt services or manipulate access. The detection relies on GCP audit logs that record the API method name for Cloud SQL operations.
references:
  - https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/users/update
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_sql_database_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-10-15
modified: 2022-12-25
tags:
  - attack.impact
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name:
      - cloudsql.instances.create
      - cloudsql.instances.delete
      - cloudsql.users.update
      - cloudsql.users.delete
  condition: selection
falsepositives:
  - SQL Database being modified or deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - SQL Database modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: f346bbd5-2c4e-4789-a221-72de7685090d
    type: derived

What it detects

This rule flags Google Cloud SQL instances being created or deleted, as well as SQL users being updated or deleted, based on matching GCP audit method names. Such changes can indicate administrative activity, but they can also reflect attacker attempts to disrupt services or manipulate access. The detection relies on GCP audit logs that record the API method name for Cloud SQL operations.

Known false positives

SQL Database being modified or deleted may be performed by a system administrator.
Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
SQL Database modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.