Suspicious Google Cloud SQL Database Modified or Deleted (via gcp.audit)

title: Suspicious Google Cloud SQL Database Modified or Deleted (via gcp.audit)
id: e2d0b60e-0e79-58f8-88f1-521e4650ef62
status: stable
description: This rule detects when a Cloud SQL DB has been modified or deleted.
references:
    - https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/users/update
author: Huntrule Team
date: 2026-03-10
tags:
    - attack.impact
    - attack.t1485
logsource:
    product: gcp
    service: gcp.audit
detection:
    selection:
        gcp.audit.method_name:
            - cloudsql.instances.create
            - cloudsql.instances.delete
            - cloudsql.users.update
            - cloudsql.users.delete
    condition: selection
falsepositives:
    - Unknown
level: medium