Update gcp_dns_zone_modified_or_deleted.yml

2021-08-15 16:01:10 -05:00
parent 7605795a9f
commit e4314aa4b8
1 changed files with 22 additions and 1 deletions
@@ -1 +1,22 @@
-
+title: Google Cloud DNS Zone Modified or Deleted
+id: 28268a8f-191f-4c17-85b2-f5aa4fa829c3
+description: Identifies when a DNS Zone is modified or deleted in Google Cloud. 
+author: Austin Songer
+status: experimental
+date: 2021/08/15
+references:
+    - https://cloud.google.com/dns/docs/reference/v1/managedZones
+logsource:
+  service: gcp.audit
+detection:
+    selection:
+        gcp.audit.method_name: 
+            - Dns.ManagedZones.Delete
+            - Dns.ManagedZones.Update
+            - Dns.ManagedZones.Patch
+    condition: selection
+level: medium
+tags:
+    - attack.impact
+falsepositives:
+ - Unkown