https://feed.craftedsignal.io/products/google-cloud-vpc/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 02 Jan 2024 12:00:00 +0000https://feed.craftedsignal.io/briefs/2024-01-gcp-firewall-deletion/Tue, 02 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-gcp-firewall-deletion/The deletion of firewall rules in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine is detected, potentially weakening security controls and enabling unauthorized access or data exfiltration by adversaries.This detection identifies when a firewall rule is deleted in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. Firewall rules are critical for controlling network traffic to and from virtual machine (VM) instances or specific applications. An adversary may delete a firewall rule to weaken a target's security controls, facilitating unauthorized access or data exfiltration. This behavior can be indicative of a defense evasion attempt. The deletion events are captured in audit logs within GCP, which are then monitored for specific actions related to firewall rule deletion in either VPC or App Engine environments.

Attack Chain

1. An attacker gains initial access to a GCP account, potentially through compromised credentials or exploiting a vulnerability.
2. The attacker enumerates existing firewall rules within the VPC or App Engine environment to identify potential targets for deletion.
3. Using compromised credentials or a service account, the attacker initiates the deletion of a specific firewall rule. The gcloud CLI or GCP console could be used.
4. The firewall rule is removed, altering the network access control configuration.
5. The attacker leverages the modified firewall configuration to establish unauthorized connections to internal resources.
6. The attacker moves laterally within the GCP environment, accessing sensitive data or systems previously protected by the deleted firewall rule.
7. The attacker exfiltrates data or performs other malicious activities, taking advantage of the weakened security posture.

Impact

Successful deletion of GCP firewall rules can lead to significant security breaches, including unauthorized access to sensitive data, lateral movement within the cloud environment, and potential data exfiltration. The impact is highly dependent on the scope and purpose of the deleted firewall rule. This activity allows attackers to bypass intended security controls.

Recommendation

• Deploy the Sigma rule GCP Firewall Rule Deletion to your SIEM to detect unauthorized firewall deletions based on data_stream.dataset:gcp.audit and event.action:(*.compute.firewalls.delete or google.appengine.*.Firewall.Delete*Rule).
• Enable GCP audit logging to ensure that all firewall rule deletion events are captured for analysis.
• Review and update access controls and permissions for users and service accounts to minimize the risk of unauthorized firewall rule modifications.
• Implement enhanced monitoring and alerting for firewall rule changes to detect and respond to similar threats more quickly in the future, based on event.action logs.

]]>mediumadvisoryclouddefense-evasiongcphttps://feed.craftedsignal.io/briefs/2024-01-02-gcp-firewall-rule-creation/Tue, 02 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-02-gcp-firewall-rule-creation/An adversary may create a new firewall rule in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine to weaken their target's security controls and allow more permissive ingress or egress traffic flows for their benefit, indicating a defense evasion attempt.This detection identifies the creation of firewall rules within Google Cloud Platform (GCP), specifically targeting Virtual Private Cloud (VPC) and App Engine environments. While firewall rules are legitimate components of network security, adversaries can exploit them to weaken existing defenses. By creating overly permissive rules, attackers can bypass security controls and establish unauthorized ingress or egress traffic flows. The focus is on detecting unexpected or suspicious firewall rule creation events that could indicate malicious activity. The original Elastic detection rule 30562697-9859-4ae0-a8c5-dab45d664170 published in 2020 and updated in 2026, helps security teams audit configuration changes and identify potential defense evasion attempts within their GCP environments. The scope includes both VPC and App Engine firewall configurations.

Attack Chain

1. The attacker gains initial access to a GCP account, potentially through compromised credentials or exploiting a misconfigured service account.
2. The attacker enumerates existing firewall rules and network configurations to identify potential weaknesses.
3. The attacker crafts a new firewall rule designed to allow unauthorized traffic, such as opening specific ports or IP ranges.
4. The attacker uses the gcloud command-line tool or the GCP console to create the new firewall rule, targeting either VPC or App Engine.
5. The newly created firewall rule is activated, effectively modifying the network's security posture.
6. The attacker leverages the permissive firewall rule to establish a command and control (C2) channel or exfiltrate sensitive data.
7. The attacker uses the open port(s) to move laterally within the network.
8. The attacker achieves their objective (data exfiltration, system compromise, etc.)

Impact

Successful exploitation can lead to unauthorized access to sensitive data, compromised systems, and potential data breaches. The low severity acknowledges that legitimate firewall rule changes occur regularly, but highlights the need to monitor and validate these changes to detect malicious activity. If successful, attackers can bypass existing security controls and potentially gain complete control of affected systems and applications.

Recommendation

• Deploy the Sigma rule GCP Firewall Rule Creation to your SIEM to detect suspicious firewall rule creations in your GCP environment. Tune the rule based on your organization's baseline activity and known service accounts.
• Review the audit logs for event.dataset:gcp.audit entries, specifically focusing on the event.action fields: *.compute.firewalls.insert or google.appengine.*.Firewall.Create*Rule to validate the source of firewall rule changes.
• Implement role-based access control (RBAC) to limit the ability to create or modify firewall rules to only authorized personnel, mitigating the risk of compromised accounts creating malicious rules.
• Establish a baseline of expected firewall rules and configurations to quickly identify deviations that could indicate malicious activity, using the provided references about GCP firewalls.

]]>lowadvisorygcpfirewalldefense_evasion