{"id":"980a7598-1e7f-4962-9372-2d754c930d0e","title":"Google Full Network Traffic Packet Capture","description":"Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-13","modified":"2022-10-09","tags":["attack.collection","attack.t1074"],"technique_ids":["T1074"],"logsource":{"product":"gcp","service":"gcp.audit"},"falsepositives":["Full Network Packet Capture may be done by a system or network administrator.","If known behavior is causing false positives, it can be exempted from the rule."],"references":["https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging","https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.PacketMirrorings.html"],"source_path":"rules/cloud/gcp/audit/gcp_full_network_traffic_packet_capture.yml","source_sha256":"bb72ea3cafbadfb77f9e133bf9f6d6ad44ec59df741584a50241672c8de5b4c9","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/gcp/audit/gcp_full_network_traffic_packet_capture.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Google Full Network Traffic Packet Capture\nid: 980a7598-1e7f-4962-9372-2d754c930d0e\nstatus: test\ndescription: Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.\nreferences:\n    - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging\n    - https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.PacketMirrorings.html\nauthor: Austin Songer @austinsonger\ndate: 2021-08-13\nmodified: 2022-10-09\ntags:\n    - attack.collection\n    - attack.t1074\nlogsource:\n    product: gcp\n    service: gcp.audit\ndetection:\n    selection:\n        gcp.audit.method_name:\n            - v*.Compute.PacketMirrorings.Get\n            - v*.Compute.PacketMirrorings.Delete\n            - v*.Compute.PacketMirrorings.Insert\n            - v*.Compute.PacketMirrorings.Patch\n            - v*.Compute.PacketMirrorings.List\n            - v*.Compute.PacketMirrorings.aggregatedList\n    condition: selection\nfalsepositives:\n    - Full Network Packet Capture may be done by a system or network administrator.\n    - If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1074","id":"T1074","name":"Data Staged","page":"techniques/enterprise/T1074/"}],"data_path":"data/detection-rules/980a7598-1e7f-4962-9372-2d754c930d0e.json","kind":"sigma"}