Suspicious Google Cloud VPN Tunnel Modified or Deleted (via gcp.audit)

title: Suspicious Google Cloud VPN Tunnel Modified or Deleted (via gcp.audit)
id: 5ae6b174-5cab-5e19-bf54-d6ab486e5c3e
status: stable
description: This rule detects when a VPN Tunnel Modified or Deleted in Google Cloud.
references:
    - https://any-api.com/googleapis_com/compute/docs/vpnTunnels
author: Huntrule Team
date: 2026-06-05
tags:
    - attack.impact
    - attack.defense-evasion
    - attack.t1562.007
logsource:
    product: gcp
    service: gcp.audit
detection:
    selection:
        gcp.audit.method_name:
            - compute.vpnTunnels.insert
            - compute.vpnTunnels.delete
    condition: selection
falsepositives:
    - Unknown
level: medium