GCP IAM - Disable Data Access Logging

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'Detects when Data Access Logging is disabled.'

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Rules detecting the same action

These rules filter on the same operation.

GCP Admin Privileged Roles Added To Service Accounts (YARA-L)
GCP Corporate Email Not Used (Panther)
GCP Free Gmail Domains Added To IAM Policy (YARA-L)
GCP IAM - High privileged role added to service account (Kusto)
GCP Org or Folder Policy Was Changed Manually (Panther)

Rule body

id: 2530a631-9605-404d-ae58-58ef1f91b17c
name: GCP IAM - Disable Data Access Logging
description: |
  'Detects when Data Access Logging is disabled.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: GCPIAMDataConnector
    dataTypes:
      - GCP_IAM
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
query: |
  GCP_IAM
  | where PayloadMethodname == 'SetIamPolicy'
  | extend s = parse_json(todynamic(PayloadRequestPolicyAuditconfigs))[0]['auditLogConfigs']
  | where isempty(s)
  | extend AccountName = tostring(split(PayloadAuthenticationinfoPrincipalemail, "@")[0]), AccountUPNSuffix = tostring(split(PayloadAuthenticationinfoPrincipalemail, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: PayloadAuthenticationinfoPrincipalemail
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SrcIpAddr
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: `source`

GCP_IAM

Stage 2: `where`

| where PayloadMethodname == 'SetIamPolicy'

Stage 3: `extend`

| extend s = parse_json(todynamic(PayloadRequestPolicyAuditconfigs))[0]['auditLogConfigs']

Stage 4: `where`

| where isempty(s)

Stage 5: `extend`

| extend AccountName = tostring(split(PayloadAuthenticationinfoPrincipalemail, "@")[0]), AccountUPNSuffix = tostring(split(PayloadAuthenticationinfoPrincipalemail, "@")[1])

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`PayloadMethodname`	eq	`SetIamPolicy`	`field:"gcp::method_name" kind:eq value:"SetIamPolicy"`
`s`	is_null	(no value, null check)	`field:"s" kind:is_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`s`	`extend`
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`

GCP IAM - Disable Data Access Logging

MITRE ATT&CK coverage

Rules detecting the same action

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: where

Stage 5: extend

Indicators

Output fields

Stage 1: `source`

Stage 2: `where`

Stage 3: `extend`

Stage 4: `where`

Stage 5: `extend`