From 475b9cfcadbf128b9b2842400c2185b19ecf9836 Mon Sep 17 00:00:00 2001 From: Brent Murphy Date: Fri, 18 Sep 2020 10:42:13 -0400 Subject: [PATCH 1/5] Create gcp_pub_sub_topic_deletion.toml --- rules/gcp/gcp_pub_sub_topic_deletion.toml | 37 +++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 rules/gcp/gcp_pub_sub_topic_deletion.toml diff --git a/rules/gcp/gcp_pub_sub_topic_deletion.toml b/rules/gcp/gcp_pub_sub_topic_deletion.toml new file mode 100644 index 00000000000..dd302bca255 --- /dev/null +++ b/rules/gcp/gcp_pub_sub_topic_deletion.toml @@ -0,0 +1,37 @@ +[metadata] +creation_date = "2020/09/18" +ecs_version = ["1.6.0"] +maturity = "production" +updated_date = "2020/09/18" + +[rule] +author = ["Elastic"] +description = """ +Identifies the deletion of a topic in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship +(Pub/Sub) is an asynchronous messaging service that decouples services that produce events from services that process +events. A publisher application creates and sends messages to a topic. Deleting a topic can interrupt message flow in +the Pub/Sub pipeline. +""" +false_positives = [ + """ + Topic deletions may be done by a system or network administrator. Verify whether the user email, resource name, + and/or hostname should be making changes in your environment. Topic deletions from unfamiliar users or hosts should + be investigated. If known behavior is causing false positives, it can be exempted from the rule. + """, +] +index = ["filebeat-*"] +language = "kuery" +license = "Elastic License" +name = "GCP Pub/Sub Topic Deletion" +note = "The GCP Filebeat module must be enabled to use this rule." +references = ["https://cloud.google.com/pubsub/docs/overview"] +risk_score = 21 +rule_id = "3202e172-01b1-4738-a932-d024c514ba72" +severity = "low" +tags = ["Elastic", "GCP", "Continuous Monitoring", "SecOps", "Logging"] +type = "query" + +query = ''' +event.module:googlecloud and event.dataset:googlecloud.audit and event.action:google.pubsub.v*.Publisher.DeleteTopic and event.outcome:success +''' + From 752750f5b03c3fee19f0c8f5f61ac04eefb92704 Mon Sep 17 00:00:00 2001 From: Brent Murphy <56412096+bm11100@users.noreply.github.com> Date: Fri, 18 Sep 2020 15:05:33 -0400 Subject: [PATCH 2/5] Update rules/gcp/gcp_pub_sub_topic_deletion.toml Co-authored-by: Justin Ibarra --- rules/gcp/gcp_pub_sub_topic_deletion.toml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/rules/gcp/gcp_pub_sub_topic_deletion.toml b/rules/gcp/gcp_pub_sub_topic_deletion.toml index dd302bca255..b9711c7db43 100644 --- a/rules/gcp/gcp_pub_sub_topic_deletion.toml +++ b/rules/gcp/gcp_pub_sub_topic_deletion.toml @@ -8,8 +8,8 @@ updated_date = "2020/09/18" author = ["Elastic"] description = """ Identifies the deletion of a topic in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship -(Pub/Sub) is an asynchronous messaging service that decouples services that produce events from services that process -events. A publisher application creates and sends messages to a topic. Deleting a topic can interrupt message flow in +(Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. +A publisher application creates and sends messages to a topic. Deleting a topic can interrupt message flow in the Pub/Sub pipeline. """ false_positives = [ @@ -34,4 +34,3 @@ type = "query" query = ''' event.module:googlecloud and event.dataset:googlecloud.audit and event.action:google.pubsub.v*.Publisher.DeleteTopic and event.outcome:success ''' - From 309f432864efd57a915aca806cb162a1ebcf7533 Mon Sep 17 00:00:00 2001 From: Brent Murphy Date: Fri, 18 Sep 2020 15:06:13 -0400 Subject: [PATCH 3/5] linting --- rules/gcp/gcp_pub_sub_topic_deletion.toml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/rules/gcp/gcp_pub_sub_topic_deletion.toml b/rules/gcp/gcp_pub_sub_topic_deletion.toml index b9711c7db43..d2037200633 100644 --- a/rules/gcp/gcp_pub_sub_topic_deletion.toml +++ b/rules/gcp/gcp_pub_sub_topic_deletion.toml @@ -8,9 +8,8 @@ updated_date = "2020/09/18" author = ["Elastic"] description = """ Identifies the deletion of a topic in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship -(Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. -A publisher application creates and sends messages to a topic. Deleting a topic can interrupt message flow in -the Pub/Sub pipeline. +(Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A publisher +application creates and sends messages to a topic. Deleting a topic can interrupt message flow in the Pub/Sub pipeline. """ false_positives = [ """ @@ -34,3 +33,4 @@ type = "query" query = ''' event.module:googlecloud and event.dataset:googlecloud.audit and event.action:google.pubsub.v*.Publisher.DeleteTopic and event.outcome:success ''' + From 6f551ae9dcf60c571b7fe75bd25bb90d990886c8 Mon Sep 17 00:00:00 2001 From: Brent Murphy Date: Thu, 24 Sep 2020 13:07:19 -0400 Subject: [PATCH 4/5] update rule name with mitre tactic --- ...efense_evasion_gcp_pub_sub_topic_deletion.toml} | 14 ++++++++++++++ 1 file changed, 14 insertions(+) rename rules/gcp/{gcp_pub_sub_topic_deletion.toml => defense_evasion_gcp_pub_sub_topic_deletion.toml} (83%) diff --git a/rules/gcp/gcp_pub_sub_topic_deletion.toml b/rules/gcp/defense_evasion_gcp_pub_sub_topic_deletion.toml similarity index 83% rename from rules/gcp/gcp_pub_sub_topic_deletion.toml rename to rules/gcp/defense_evasion_gcp_pub_sub_topic_deletion.toml index d2037200633..dc4b99b56d2 100644 --- a/rules/gcp/gcp_pub_sub_topic_deletion.toml +++ b/rules/gcp/defense_evasion_gcp_pub_sub_topic_deletion.toml @@ -34,3 +34,17 @@ query = ''' event.module:googlecloud and event.dataset:googlecloud.audit and event.action:google.pubsub.v*.Publisher.DeleteTopic and event.outcome:success ''' + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1562" +name = "Impair Defenses" +reference = "https://attack.mitre.org/techniques/T1562/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + From b1068620f1029b27cbc6ac3543f2c52f01e49078 Mon Sep 17 00:00:00 2001 From: Brent Murphy Date: Thu, 24 Sep 2020 13:08:13 -0400 Subject: [PATCH 5/5] correct spelling error in rule --- ...cp_iam_role_deltion.toml => impact_gcp_iam_role_deletion.toml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename rules/gcp/{impact_gcp_iam_role_deltion.toml => impact_gcp_iam_role_deletion.toml} (100%) diff --git a/rules/gcp/impact_gcp_iam_role_deltion.toml b/rules/gcp/impact_gcp_iam_role_deletion.toml similarity index 100% rename from rules/gcp/impact_gcp_iam_role_deltion.toml rename to rules/gcp/impact_gcp_iam_role_deletion.toml