huntrule

Google Cloud Audit: DNS Managed Zone Modified or Deleted

Flags Google Cloud DNS Managed Zone delete, update, and patch events from audit logs.

FreeReviewedSigma · Medium · v4
Product
gcp
Service
gcp.audit
Author
Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published
2021-08-15
Updated
2026-07-31
AnalysisDetection
title: "Google Cloud Audit: DNS Managed Zone Modified or Deleted"
id: 9f9f27e8-fefb-4929-9ced-71b143a37f47
status: test
description: This rule identifies audit events where a Google Cloud DNS managed zone is updated, patched, or deleted. Attackers may alter or remove zones to disrupt name resolution, redirect traffic, or impact dependent services. The detection relies on Google Cloud audit log telemetry capturing DNS method names for zone update/patch/delete actions.
references:
  - https://cloud.google.com/dns/docs/reference/v1/managedZones
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_dns_zone_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-15
modified: 2022-10-09
tags:
  - attack.impact
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name:
      - Dns.ManagedZones.Delete
      - Dns.ManagedZones.Update
      - Dns.ManagedZones.Patch
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 28268a8f-191f-4c17-85b2-f5aa4fa829c3
    type: derived