Panther medium experimental python

GCP GCS Bulk Object Deletion

Detects bulk deletion of GCS objects. This pattern is indicative of a ransomware attack or data destruction where an adversary deletes storage objects at scale. The threshold of 10+ deletion operations suggests automated bulk deletion rather than normal application behavior. This can be part of a double extortion ransomware attack where data is both encrypted and deleted to increase pressure on victims.

View Source

Detection Logic

def rule(event):

    method_name = event.deep_get("protoPayload", "methodName", default="UNKNOWN_METHOD_NAME")
    service_name = event.deep_get("protoPayload", "serviceName")
    severity = event.get("severity")
    return all(
        [
            method_name == "storage.objects.delete",
            service_name == "storage.googleapis.com",
            severity != "ERROR",  # Operation succeeded
        ]
    )


def title(event):
    principal = event.deep_get("protoPayload", "authenticationInfo", "principalEmail")
    resource = event.deep_get("protoPayload", "resourceName")
    return f"GCP: Bulk object deletion in resource [{resource}] by principal [{principal}]"


def alert_context(event):
    return {
        "principal": event.deep_get("protoPayload", "authenticationInfo", "principalEmail"),
        "project": event.deep_get("resource", "labels", "project_id"),
        "status": event.deep_get("protoPayload", "status"),
        "location": event.deep_get("resource", "labels", "location"),
        "resource": event.deep_get("protoPayload", "resourceName"),
    }

Field Validations

Loading…

Comments (0)

Loading comments...