Elastic medium stable kql

GCP Virtual Private Cloud Route Deletion

Identifies when a Virtual Private Cloud (VPC) route is deleted in Google Cloud Platform (GCP). Google Cloud routes define the paths that network traffic takes from a virtual machine (VM) instance to other destinations. These destinations can be inside a Google VPC network or outside it. An adversary may delete a route in order to impact the flow of network traffic in their target's cloud environment.

View Source

Detection Logic

data_stream.dataset:gcp.audit and event.action:v*.compute.routes.delete and event.outcome:success

False Positives

⚠ Virtual Private Cloud routes may be deleted by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior.

Field Validations

Loading…

Comments (0)

Loading comments...