Google Cloud Audit: DNS Managed Zone Modified or Deleted
Flags Google Cloud DNS Managed Zone delete, update, and patch events from audit logs.
FreeReviewedSigma · Medium · v4
- Product
- gcp
- Service
- gcp.audit
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-08-15
- Updated
- 2026-07-31
What it detects
This rule identifies audit events where a Google Cloud DNS managed zone is updated, patched, or deleted. Attackers may alter or remove zones to disrupt name resolution, redirect traffic, or impact dependent services. The detection relies on Google Cloud audit log telemetry capturing DNS method names for zone update/patch/delete actions.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
google-cloud-dns-managed-zone-updated-patched-or-deleted-audit-logs-28268a8f
title: "Google Cloud Audit: DNS Managed Zone Modified or Deleted"
id: 9f9f27e8-fefb-4929-9ced-71b143a37f47
status: test
description: This rule identifies audit events where a Google Cloud DNS managed zone is updated, patched, or deleted. Attackers may alter or remove zones to disrupt name resolution, redirect traffic, or impact dependent services. The detection relies on Google Cloud audit log telemetry capturing DNS method names for zone update/patch/delete actions.
references:
- https://cloud.google.com/dns/docs/reference/v1/managedZones
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_dns_zone_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-15
modified: 2022-10-09
tags:
- attack.impact
logsource:
product: gcp
service: gcp.audit
detection:
selection:
gcp.audit.method_name:
- Dns.ManagedZones.Delete
- Dns.ManagedZones.Update
- Dns.ManagedZones.Patch
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 28268a8f-191f-4c17-85b2-f5aa4fa829c3
type: derived