/
impact_gcp_storage_bucket_deleted.toml
52 lines (44 loc) · 1.61 KB
/
impact_gcp_storage_bucket_deleted.toml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
[metadata]
creation_date = "2020/09/21"
integration = ["gcp"]
maturity = "production"
updated_date = "2024/05/21"
[rule]
author = ["Elastic"]
description = """
Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket in
order to disrupt their target's business operations.
"""
false_positives = [
"""
Storage buckets may be deleted by a system or network administrator. Verify whether the user email, resource name,
and/or hostname should be making changes in your environment. Bucket deletions by unfamiliar users or hosts should
be investigated. If known behavior is causing false positives, it can be exempted from the rule.
""",
]
index = ["filebeat-*", "logs-gcp*"]
language = "kuery"
license = "Elastic License v2"
name = "GCP Storage Bucket Deletion"
note = """## Setup
The GCP Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
references = ["https://cloud.google.com/storage/docs/key-terms#buckets"]
risk_score = 47
rule_id = "bc0f2d83-32b8-4ae2-b0e6-6a45772e9331"
severity = "medium"
tags = ["Domain: Cloud", "Data Source: GCP", "Data Source: Google Cloud Platform", "Tactic: Impact"]
timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:gcp.audit and event.action:"storage.buckets.delete"
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1485"
name = "Data Destruction"
reference = "https://attack.mitre.org/techniques/T1485/"
[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"