{"id":"fe513c69-734c-4d4a-8548-ac5f609be82b","title":"Google Cloud Firewall Modified or Deleted","description":"Detects  when a firewall rule is modified or deleted in Google Cloud Platform (GCP).","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-13","modified":"2022-10-09","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"product":"gcp","service":"gcp.audit"},"falsepositives":["Firewall rules being modified or deleted may be performed by a system administrator. Verify that the firewall configuration change was expected.","Exceptions can be added to this rule to filter expected behavior."],"references":["https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging","https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.Firewalls.html"],"source_path":"rules/cloud/gcp/audit/gcp_firewall_rule_modified_or_deleted.yml","source_sha256":"a885d49d11447f2414e4b372ed0dc22fb6289a527e5568fb472a603f4beec83f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/gcp/audit/gcp_firewall_rule_modified_or_deleted.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Google Cloud Firewall Modified or Deleted\nid: fe513c69-734c-4d4a-8548-ac5f609be82b\nstatus: test\ndescription: Detects  when a firewall rule is modified or deleted in Google Cloud Platform (GCP).\nreferences:\n    - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging\n    - https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.Firewalls.html\nauthor: Austin Songer @austinsonger\ndate: 2021-08-13\nmodified: 2022-10-09\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    product: gcp\n    service: gcp.audit\ndetection:\n    selection:\n        gcp.audit.method_name:\n            - v*.Compute.Firewalls.Delete\n            - v*.Compute.Firewalls.Patch\n            - v*.Compute.Firewalls.Update\n            - v*.Compute.Firewalls.Insert\n    condition: selection\nfalsepositives:\n    - Firewall rules being modified or deleted may be performed by a system administrator. Verify that the firewall configuration change was expected.\n    - Exceptions can be added to this rule to filter expected behavior.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/fe513c69-734c-4d4a-8548-ac5f609be82b.json","kind":"sigma"}