huntrule

GCP Cloud SQL Database Modified or Deleted via Audit API

Alerts on Cloud SQL instance create/delete and user update/delete events in GCP audit logs.

FreeReviewedSigma · Medium · v4
Product
gcp
Service
gcp.audit
Author
Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published
2021-10-15
Updated
2026-07-31
AnalysisDetection
title: GCP Cloud SQL Database Modified or Deleted via Audit API
id: 694670a4-ca02-41dc-bfb5-2c366bdfae94
status: test
description: This rule flags Cloud SQL events where a database instance is created or deleted, or where Cloud SQL user accounts are updated or deleted. Attackers may use these actions to disrupt services or change access by altering database users and removing instances. The detection relies on GCP audit log telemetry, specifically the recorded method name in gcp.audit.method_name for matching Cloud SQL operations.
references:
  - https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/users/update
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_sql_database_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-10-15
modified: 2022-12-25
tags:
  - attack.impact
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name:
      - cloudsql.instances.create
      - cloudsql.instances.delete
      - cloudsql.users.update
      - cloudsql.users.delete
  condition: selection
falsepositives:
  - SQL Database being modified or deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - SQL Database modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: f346bbd5-2c4e-4789-a221-72de7685090d
    type: derived