Google Cloud DNS Managed Zone Updated, Patched, or Deleted (Audit Logs)

title: Google Cloud DNS Managed Zone Updated, Patched, or Deleted (Audit Logs)
id: 9f9f27e8-fefb-4929-9ced-71b143a37f47
status: test
description: This rule identifies DNS Managed Zone changes in Google Cloud by matching audit log method names for delete, update, and patch operations. Attackers may modify or remove DNS records to redirect traffic, disrupt services, or alter resolution behavior. The detection relies on Google Cloud audit log events in the gcp.audit service, using the recorded method_name for DNS managed zone operations.
references:
  - https://cloud.google.com/dns/docs/reference/v1/managedZones
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_dns_zone_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-15
modified: 2022-10-09
tags:
  - attack.impact
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name:
      - Dns.ManagedZones.Delete
      - Dns.ManagedZones.Update
      - Dns.ManagedZones.Patch
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 28268a8f-191f-4c17-85b2-f5aa4fa829c3
    type: derived