GCP Access Policy Deleted

Title: GCP Access Policy Deleted
Status: test
Description:Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource.
References:
  -https://cloud.google.com/access-context-manager/docs/audit-logging
  -https://cloud.google.com/logging/docs/audit/understanding-audit-logs
  -https://cloud.google.com/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog
Author: Bryan Lim
Date: 2024-01-12
modified:None
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.t1098'

Logsource:

• product: gcp
• service: gcp.audit

Detection:
  selection:
    data.protoPayload.authorizationInfo.permission:
      -'accesscontextmanager.accessPolicies.delete'
      -'accesscontextmanager.accessPolicies.accessLevels.delete'
      -'accesscontextmanager.accessPolicies.accessZones.delete'
      -'accesscontextmanager.accessPolicies.authorizedOrgsDescs.delete'

    data.protoPayload.authorizationInfo.granted: 'true'
    data.protoPayload.serviceName: 'accesscontextmanager.googleapis.com'
  condition:selection
Falsepositives:
  -Legitimate administrative activities
Level: medium