Google Compute Engine firewall rule modified

gcp

Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1562-impair-defenses

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when a firewall rule is created, modified or deleted.

Strategy

Monitor Google Compute Engine activity audit logs to determine when any of the following methods are invoked:

  • v1.compute.firewalls.delete
  • v1.compute.firewalls.insert
  • v1.compute.firewalls.patch

Triage and response

  1. Review the log and role and ensure the permissions are scoped properly.
  2. Review the users associated with the role and ensure they should have the permissions attached to the role.