Google Compute Engine network route created or modified

gcp

Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1578-modify-cloud-compute-infrastructure

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detect when a firewall rule is created or modified.

Strategy

This rule lets you monitor GCE activity audit logs to determine if a firewall is being adjusted by showing you when any of the following methods are invoked:

  • beta.compute.routes.insert
  • beta.compute.routes.patch

Triage and response

Verify that the GCE network route is configured properly and that the user intended to modify the firewall.