Google Cloud VPN Tunnel Insert or Delete via Audit Logs

Alerts on Google Cloud audit events showing VPN tunnel insertion or deletion.

FreeUnreviewedSigmamediumv1

google-cloud-vpn-tunnel-insert-or-delete-via-audit-logs-99980a85

title: Google Cloud VPN Tunnel Insert or Delete via Audit Logs
id: 3ccb2306-4730-4beb-8ae7-2441792abd19
status: test
description: This rule flags events in Google Cloud audit logs where VPN Tunnels are inserted or deleted. Attackers or administrators can use these actions to disrupt network connectivity or reconfigure access paths. Detection relies on gcp.audit method_name values for compute.vpnTunnels.insert and compute.vpnTunnels.delete recorded in GCP audit telemetry.
references:
  - https://any-api.com/googleapis_com/compute/docs/vpnTunnels
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_vpn_tunnel_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-16
modified: 2022-10-09
tags:
  - attack.impact
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name:
      - compute.vpnTunnels.insert
      - compute.vpnTunnels.delete
  condition: selection
falsepositives:
  - VPN Tunnel being modified or deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - VPN Tunnel modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 99980a85-3a61-43d3-ac0f-b68d6b4797b1
    type: derived

What it detects

This rule flags events in Google Cloud audit logs where VPN Tunnels are inserted or deleted. Attackers or administrators can use these actions to disrupt network connectivity or reconfigure access paths. Detection relies on gcp.audit method_name values for compute.vpnTunnels.insert and compute.vpnTunnels.delete recorded in GCP audit telemetry.

Known false positives

VPN Tunnel being modified or deleted may be performed by a system administrator.
Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
VPN Tunnel modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.