Google Cloud Storage Buckets Modified or Deleted via Audit API

Alert on GCP audit events indicating storage bucket insert, update, patch, or delete actions.

FreeUnreviewedSigmamediumv1

google-cloud-storage-buckets-modified-or-deleted-via-audit-api-4d9f2ee2

title: Google Cloud Storage Buckets Modified or Deleted via Audit API
id: 2aa3e5a0-73ec-47b8-a75d-275d72ba21e0
status: test
description: This rule flags Google Cloud audit events where storage buckets are deleted or altered through methods for insert, update, patch, or delete. Attackers may change bucket configurations or remove data to disrupt availability or impact stored content. It relies on GCP audit log telemetry capturing the bucket-related method name within the audit service.
references:
  - https://cloud.google.com/storage/docs/json_api/v1/buckets
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_bucket_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-14
modified: 2022-10-09
tags:
  - attack.impact
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name:
      - storage.buckets.delete
      - storage.buckets.insert
      - storage.buckets.update
      - storage.buckets.patch
  condition: selection
falsepositives:
  - Storage Buckets being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Storage Buckets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 4d9f2ee2-c903-48ab-b9c1-8c0f474913d0
    type: derived

What it detects

This rule flags Google Cloud audit events where storage buckets are deleted or altered through methods for insert, update, patch, or delete. Attackers may change bucket configurations or remove data to disrupt availability or impact stored content. It relies on GCP audit log telemetry capturing the bucket-related method name within the audit service.

Known false positives

Storage Buckets being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
Storage Buckets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.