Detection rules › By event

GCP-compute.googleapis.com

Event	Rules
any	3
compute.disks.setIamPolicy	1
compute.firewalls.delete	3
compute.firewalls.insert	4
compute.firewalls.patch	3
compute.firewalls.update	2
compute.images.setIamPolicy	2
compute.instances.insert	1
compute.instances.setMetadata	1
compute.networks.delete	1
compute.packetMirrorings.aggregatedList	1
compute.packetMirrorings.delete	1
compute.packetMirrorings.get	1
compute.packetMirrorings.insert	1
compute.packetMirrorings.list	1
compute.packetMirrorings.patch	1
compute.projects.setCommonInstanceMetadata	1
compute.routes.delete	1
compute.routes.insert	1
compute.snapshots.delete	1
compute.snapshots.insert	1
compute.snapshots.setIamPolicy	1
compute.subnetworks.patch	1
compute.vpnTunnels.delete	1
compute.vpnTunnels.insert	1

any

3 detection rules reference this event. View event page.

Kusto (3)

Cross-Cloud Suspicious Compute resource creation in GCP severity low T1059, T1069, T1078, T1547, T1548, T1552
GCP Audit Logs - Open Firewall Rule Created or Modified severity high T1133, T1685, T1686
Suspicious VM Instance Creation Activity Detected severity medium T1078, T1106, T1526

compute.disks.setIamPolicy

1 detection rules reference this event. View event page.

Panther (1)

GCP Compute IAM Policy Update Detection severity medium

compute.firewalls.delete

3 detection rules reference this event. View event page.

Sigma (1)

Google Cloud Firewall Modified or Deleted severity medium T1685

Elastic (1)

GCP Firewall Rule Deletion severity medium T1685, T1686.001

Panther (1)

GCP Firewall Rule Deleted severity low

compute.firewalls.insert

4 detection rules reference this event. View event page.

Sigma (1)

Google Cloud Firewall Modified or Deleted severity medium T1685

Elastic (1)

GCP Firewall Rule Creation severity low T1685, T1686.001

YARA-L (1)

GCP Firewall Rule Opened To The World severity high T1685

Panther (1)

GCP Firewall Rule Created severity low

compute.firewalls.patch

3 detection rules reference this event. View event page.

Sigma (1)

Google Cloud Firewall Modified or Deleted severity medium T1685

Elastic (1)

GCP Firewall Rule Modification severity medium T1685, T1686.001

Panther (1)

GCP Firewall Rule Modified severity low

compute.firewalls.update

2 detection rules reference this event. View event page.

Sigma (1)

Google Cloud Firewall Modified or Deleted severity medium T1685

Panther (1)

GCP Firewall Rule Modified severity low

compute.images.setIamPolicy

2 detection rules reference this event. View event page.

YARA-L (1)

GCP GCE Image Open To Public severity high T1537

Panther (1)

GCP Compute IAM Policy Update Detection severity medium

compute.instances.insert

1 detection rules reference this event. View event page.

Panther (1)

GCP compute.instances.create Privilege Escalation severity high T1548

compute.instances.setMetadata

1 detection rules reference this event. View event page.

Panther (1)

GCP Compute SSH Connection severity informational

compute.networks.delete

1 detection rules reference this event. View event page.

Elastic (1)

GCP Virtual Private Cloud Network Deletion severity medium T1485, T1685, T1686.001

compute.packetMirrorings.aggregatedList

1 detection rules reference this event. View event page.

Sigma (1)

Google Full Network Traffic Packet Capture severity medium T1074

compute.packetMirrorings.delete

1 detection rules reference this event. View event page.

Sigma (1)

Google Full Network Traffic Packet Capture severity medium T1074

compute.packetMirrorings.get

1 detection rules reference this event. View event page.

Sigma (1)

Google Full Network Traffic Packet Capture severity medium T1074

compute.packetMirrorings.insert

1 detection rules reference this event. View event page.

Sigma (1)

Google Full Network Traffic Packet Capture severity medium T1074

compute.packetMirrorings.list

1 detection rules reference this event. View event page.

Sigma (1)

Google Full Network Traffic Packet Capture severity medium T1074

compute.packetMirrorings.patch

1 detection rules reference this event. View event page.

Sigma (1)

Google Full Network Traffic Packet Capture severity medium T1074

compute.projects.setCommonInstanceMetadata

1 detection rules reference this event. View event page.

Panther (1)

GCP Compute SSH Connection severity informational

compute.routes.delete

1 detection rules reference this event. View event page.

Elastic (1)

GCP Virtual Private Cloud Route Deletion severity medium T1578, T1578.005, T1685, T1686.001

compute.routes.insert

1 detection rules reference this event. View event page.

Elastic (1)

GCP Virtual Private Cloud Route Creation severity low T1578, T1578.005, T1685, T1686.001

compute.snapshots.delete

1 detection rules reference this event. View event page.

Kusto (1)

GCP Audit Logs - Detect Bulk VM Snapshot Deletion severity high T1485, T1490, T1685

compute.snapshots.insert

1 detection rules reference this event. View event page.

Panther (1)

GCP Snapshot Creation Detection severity medium

compute.snapshots.setIamPolicy

1 detection rules reference this event. View event page.

Panther (1)

GCP Compute IAM Policy Update Detection severity medium

compute.subnetworks.patch

1 detection rules reference this event. View event page.

Panther (1)

GCP VPC Flow Logs Disabled severity medium

compute.vpnTunnels.delete

1 detection rules reference this event. View event page.

Sigma (1)

Google Cloud VPN Tunnel Modified or Deleted severity medium

compute.vpnTunnels.insert

1 detection rules reference this event. View event page.

Sigma (1)

Google Cloud VPN Tunnel Modified or Deleted severity medium