[metadata]
creation_date = "2020/09/21"
maturity = "production"
updated_date = "2020/12/16"

[rule]
author = ["Elastic"]
description = """
Identifies when a Google Cloud Platform (GCP) storage bucket is deleted. An adversary may delete a storage bucket in
order to disrupt their target's business operations.
"""
false_positives = [
    """
    Storage buckets may be deleted by a system or network administrator. Verify whether the user email, resource name,
    and/or hostname should be making changes in your environment. Bucket deletions from unfamiliar users or hosts should
    be investigated. If known behavior is causing false positives, it can be exempted from the rule.
    """,
]
index = ["filebeat-*", "logs-gcp*"]
language = "kuery"
license = "Elastic License"
name = "GCP Storage Bucket Deletion"
note = "The GCP Filebeat module must be enabled to use this rule."
references = ["https://cloud.google.com/storage/docs/key-terms#buckets"]
risk_score = 47
rule_id = "bc0f2d83-32b8-4ae2-b0e6-6a45772e9331"
severity = "medium"
tags = ["Elastic", "Cloud", "GCP", "Continuous Monitoring", "SecOps", "Monitoring"]
type = "query"

query = '''
event.dataset:(googlecloud.audit or gcp.audit) and event.action:storage.buckets.delete
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1485"
name = "Data Destruction"
reference = "https://attack.mitre.org/techniques/T1485/"


[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

