GCP Cloud SQL Database Modified or Deleted via Audit API
Alerts on Cloud SQL instance create/delete and user update/delete events in GCP audit logs.
FreeReviewedSigma · Medium · v4
- Product
- gcp
- Service
- gcp.audit
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-10-15
- Updated
- 2026-07-31
What it detects
This rule flags Cloud SQL events where a database instance is created or deleted, or where Cloud SQL user accounts are updated or deleted. Attackers may use these actions to disrupt services or change access by altering database users and removing instances. The detection relies on GCP audit log telemetry, specifically the recorded method name in gcp.audit.method_name for matching Cloud SQL operations.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
gcp-cloud-sql-database-or-user-modified-deleted-via-audit-api-f346bbd5
title: GCP Cloud SQL Database Modified or Deleted via Audit API
id: 694670a4-ca02-41dc-bfb5-2c366bdfae94
status: test
description: This rule flags Cloud SQL events where a database instance is created or deleted, or where Cloud SQL user accounts are updated or deleted. Attackers may use these actions to disrupt services or change access by altering database users and removing instances. The detection relies on GCP audit log telemetry, specifically the recorded method name in gcp.audit.method_name for matching Cloud SQL operations.
references:
- https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/users/update
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_sql_database_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-10-15
modified: 2022-12-25
tags:
- attack.impact
logsource:
product: gcp
service: gcp.audit
detection:
selection:
gcp.audit.method_name:
- cloudsql.instances.create
- cloudsql.instances.delete
- cloudsql.users.update
- cloudsql.users.delete
condition: selection
falsepositives:
- SQL Database being modified or deleted may be performed by a system administrator.
- Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
- SQL Database modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
- id: f346bbd5-2c4e-4789-a221-72de7685090d
type: derived