Route - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/route/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 09 Jan 2024 15:00:00 +0000GCP Virtual Private Cloud Route Deletion for Defense Evasionhttps://feed.craftedsignal.io/briefs/2024-01-09-gcp-vpc-route-deletion/Tue, 09 Jan 2024 15:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-09-gcp-vpc-route-deletion/An adversary may delete a Virtual Private Cloud (VPC) route in Google Cloud Platform (GCP) to disrupt network traffic flow and evade defenses.This threat brief addresses the deletion of Virtual Private Cloud (VPC) routes within Google Cloud Platform (GCP) environments. VPC routes define network traffic paths between virtual machine (VM) instances and other destinations, both inside and outside the VPC network. An attacker may intentionally delete or modify these routes to disrupt network communications, potentially evading security controls or impairing critical services. This activity is often observed as part of a broader attack campaign, where adversaries attempt to weaken the security posture of the target environment. The Elastic detection rule "GCP Virtual Private Cloud Route Deletion", updated on 2026/04/10, identifies these events by monitoring GCP audit logs for route deletion actions. Defenders should prioritize monitoring VPC route configurations and access logs to detect and respond to unauthorized modifications.

Attack Chain

  1. The attacker gains unauthorized access to a GCP account with sufficient privileges to modify VPC configurations. This could be achieved through compromised credentials, privilege escalation, or exploiting misconfigured IAM roles.
  2. The attacker enumerates existing VPC routes to identify potential targets for disruption, using tools like gcloud compute routes list.
  3. The attacker selects a critical VPC route that is essential for network communication between key services or network segments.
  4. The attacker deletes the selected VPC route using gcloud compute routes delete [ROUTE_NAME], causing a disruption in network traffic flow.
  5. The successful deletion of the route is logged in GCP audit logs.
  6. Network services relying on the deleted route experience connectivity issues, leading to service degradation or failure.
  7. The attacker may repeat this process with other critical routes to further isolate network segments or prevent detection.

Impact

Successful deletion of VPC routes can lead to significant disruptions in network connectivity and service availability. Victims may experience degraded performance, application failures, or complete outages, depending on the criticality of the affected routes. The deletion of VPC routes can affect any organization utilizing GCP, especially those reliant on stable and predictable network traffic patterns. The risk score associated with this activity is 47.

Recommendation

  • Deploy the provided Sigma rule to your SIEM to detect VPC route deletion events in GCP audit logs (logsource: service: gcp and category: audit).
  • Review and harden IAM permissions to restrict access to VPC route management functions to authorized personnel only.
  • Implement automated monitoring and alerting for any changes to VPC route configurations.
  • Investigate any alerts generated by the Sigma rule by reviewing the associated audit logs and identifying the user or service account responsible for the route deletion.
  • Establish a process for quickly restoring deleted VPC routes from backups or configuration management tools.
  • Implement the recommendations in the provided investigation guide to analyze the context and impact of route deletion events.
]]>mediumadvisorygcpvpcroutedefense-evasioncloudGCP Virtual Private Cloud Route Creation for Defense Evasionhttps://feed.craftedsignal.io/briefs/2024-01-gcp-vpc-route-creation/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-gcp-vpc-route-creation/The creation of a virtual private cloud (VPC) route in Google Cloud Platform (GCP) can indicate an adversary attempting to impact the flow of network traffic for defense evasion.This threat brief addresses the potential for attackers to create or modify Virtual Private Cloud (VPC) routes within Google Cloud Platform (GCP) environments. Google Cloud routes define the paths that network traffic takes from a virtual machine (VM) instance to other destinations, either inside a Google VPC network or outside it. By creating malicious routes, an attacker can reroute or intercept traffic, potentially disrupting network communications or eavesdropping on sensitive data. This activity is often performed to impair defenses or gain unauthorized access to resources. This brief focuses on detecting the creation of new routes within GCP, specifically monitored through audit logs.

Attack Chain

  1. Initial Access: The attacker gains access to a GCP account, possibly through compromised credentials or exploiting a misconfigured IAM role.
  2. Privilege Escalation (If Necessary): The attacker attempts to elevate their privileges within the GCP environment to gain the necessary permissions to modify network configurations.
  3. Discovery: The attacker enumerates existing VPC routes to understand the current network topology.
  4. Route Creation: The attacker creates a new VPC route using the gcloud command-line tool or the GCP console, targeting a specific subnet or IP range. The attacker crafts a route that redirects traffic to a malicious destination. The audit logs record the event with event.action: v*.compute.routes.insert or beta.compute.routes.insert.
  5. Traffic Redirection: Network traffic matching the new route's destination is now redirected to the attacker-controlled destination.
  6. Data Interception/Manipulation: The attacker intercepts the redirected traffic, potentially exfiltrating sensitive data or manipulating the traffic before forwarding it to its original destination.
  7. Defense Evasion: By rerouting network traffic, the attacker can bypass security controls or monitoring systems, making their activities more difficult to detect.

Impact

Successful exploitation can lead to unauthorized access to sensitive data, disruption of critical services, and potential data breaches. While the severity is low at initial route creation, the impact escalates significantly if the route is used for malicious purposes like data exfiltration or man-in-the-middle attacks. The number of affected VMs depends on the scope of the created route (e.g., a specific subnet or the entire VPC). Organizations in any sector utilizing GCP VPCs are potentially at risk.

Recommendation

  • Deploy the Sigma rule GCP VPC Route Creation to your SIEM to detect suspicious route creation activities based on data_stream.dataset:gcp.audit and event.action.
  • Review IAM permissions and roles to ensure that only authorized personnel have the ability to create or modify VPC routes. Focus on service accounts with excessive permissions.
  • Investigate any alerts generated by the Sigma rule, correlating them with other security events or unusual network activity to identify potential malicious intent.
  • Enable and regularly review VPC Flow Logs to monitor network traffic patterns and detect any unauthorized redirection.
]]>lowadvisorygcpvpcroutedefense-evasioncloud