sentinel
high
kql
GCP Audit Logs - DNSSEC Disabled on Managed DNS Zone
'Detects when DNSSEC (DNS Security Extensions) is disabled on a Google Cloud DNS managed zone.
DNSSEC provides cryptographic authentication of DNS data, preventing DNS spoofing and cache poisoning attacks.
Adversaries may disable DNSSEC to enable DNS-based command and control, phishing campaigns, or
to redirect traffic to malicious infrastructure without cryptographic validation.
This rule monitors DNS zone patch operations where DNSSEC state changes from ON to OFF.'