Skip to content

Commit fce9085

Browse files
rahul0216rahul0216
committed
Added GCPDNSSECDisabled.yaml again
1 parent f73c95a commit fce9085

File tree

6 files changed

+315
-7
lines changed

6 files changed

+315
-7
lines changed

‎Solutions/Google Cloud Platform Audit Logs/Analytic Rules/GCPBulkVMSnapshotDeletion.yaml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -65,17 +65,18 @@ query: |
6565
| project
6666
TimeGenerated = FirstDeletion,
6767
PrincipalEmail,
68-
AccountName,
69-
AccountUPNSuffix,
7068
ProjectId,
69+
ResourceName = GCPResourceName,
7170
SnapshotCount,
7271
SnapshotList,
7372
FirstDeletion,
7473
LastDeletion,
7574
DeletionTimeSpan,
7675
CallerIPs,
7776
UserAgent,
78-
OperationIds
77+
OperationIds,
78+
AccountName,
79+
AccountUPNSuffix,
7980
entityMappings:
8081
- entityType: Account
8182
fieldMappings:

‎Solutions/Google Cloud Platform Audit Logs/Analytic Rules/GCPDNSSECDisabled.yaml‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
id: 9129a43e-e204-4a9a-969e-d8861ce3437c
2+
name: GCP Audit Logs - DNSSEC Disabled on Managed DNS Zone
3+
description: |
4+
'Detects when DNSSEC (DNS Security Extensions) is disabled on a Google Cloud DNS managed zone.
5+
DNSSEC provides cryptographic authentication of DNS data, preventing DNS spoofing and cache poisoning attacks.
6+
Adversaries may disable DNSSEC to enable DNS-based command and control, phishing campaigns, or
7+
to redirect traffic to malicious infrastructure without cryptographic validation.
8+
This rule monitors DNS zone patch operations where DNSSEC state changes from ON to OFF.'
9+
severity: High
10+
status: Available
11+
requiredDataConnectors:
12+
- connectorId: GCPAuditLogsDefinition
13+
dataTypes:
14+
- GCPAuditLogs
15+
queryFrequency: 1h
16+
queryPeriod: 1h
17+
triggerOperator: gt
18+
triggerThreshold: 0
19+
tactics:
20+
- DefenseEvasion
21+
- CommandAndControl
22+
- ResourceDevelopment
23+
relevantTechniques:
24+
- T1562.001
25+
- T1071.004
26+
- T1584.002
27+
tags:
28+
- GCP
29+
- DNS
30+
- DNSSEC
31+
- Cloud Security
32+
query: |
33+
GCPAuditLogs
34+
| where ServiceName == "dns.googleapis.com"
35+
| where MethodName in ("dns.managedZones.update", "dns.managedZones.patch")
36+
| where GCPResourceType == "dns_managed_zone" and Severity == "NOTICE"
37+
| extend
38+
ResponseJson = parse_json(Response),
39+
RequestMetadataJson = parse_json(RequestMetadata),
40+
AuthInfoJson = parse_json(AuthenticationInfo)
41+
| extend ZoneContext = ResponseJson.operation.zoneContext
42+
| where isnotempty(ZoneContext)
43+
| extend
44+
OldDnsSecState = tostring(ZoneContext.oldValue.dnssecConfig.state),
45+
NewDnsSecState = tostring(ZoneContext.newValue.dnssecConfig.state)
46+
| where OldDnsSecState == "ON" and NewDnsSecState == "OFF"
47+
| extend
48+
ManagedZoneName = extract(@"managedZones/([^/]+)", 1, GCPResourceName),
49+
DnsName = tostring(ResponseJson.managedZone.dnsName),
50+
ZoneId = tostring(ResponseJson.managedZone.id),
51+
ZoneDescription = tostring(ResponseJson.managedZone.description),
52+
Visibility = tostring(ResponseJson.managedZone.visibility),
53+
OperationId = tostring(ResponseJson.operation.id),
54+
CallerIpAddress = tostring(RequestMetadataJson.callerIp),
55+
AuthEmail = tostring(AuthInfoJson.principalEmail)
56+
| extend
57+
AccountName = tostring(split(PrincipalEmail, "@")[0]),
58+
AccountUPNSuffix = tostring(split(PrincipalEmail, "@")[1])
59+
| project TimeGenerated,
60+
PrincipalEmail,
61+
AuthEmail,
62+
ProjectId,
63+
ManagedZoneName,
64+
DnsName,
65+
ResourceName = GCPResourceName,
66+
Visibility,
67+
ZoneId,
68+
ZoneDescription,
69+
OperationId,
70+
CallerIpAddress,
71+
MethodName,
72+
ServiceName,
73+
Severity,
74+
LogName,
75+
InsertId,
76+
AccountName,
77+
AccountUPNSuffix
78+
entityMappings:
79+
- entityType: Account
80+
fieldMappings:
81+
- identifier: FullName
82+
columnName: PrincipalEmail
83+
- identifier: Name
84+
columnName: AccountName
85+
- identifier: UPNSuffix
86+
columnName: AccountUPNSuffix
87+
- entityType: IP
88+
fieldMappings:
89+
- identifier: Address
90+
columnName: CallerIpAddress
91+
- entityType: CloudApplication
92+
fieldMappings:
93+
- identifier: Name
94+
columnName: ProjectId
95+
- identifier: InstanceName
96+
columnName: ResourceName
97+
- entityType: DNS
98+
fieldMappings:
99+
- identifier: DomainName
100+
columnName: DnsName
101+
customDetails:
102+
ProjectId: ProjectId
103+
ManagedZoneName: ManagedZoneName
104+
DnsName: DnsName
105+
ResourceName: ResourceName
106+
Visibility: Visibility
107+
ZoneId: ZoneId
108+
alertDetailsOverride:
109+
alertDisplayNameFormat: "DNSSEC Disabled on DNS Zone {{ManagedZoneName}} ({{DnsName}}) by {{PrincipalEmail}}"
110+
alertDescriptionFormat: |-
111+
User {{PrincipalEmail}} disabled DNSSEC on DNS managed zone {{ManagedZoneName}} ({{DnsName}}).
112+
This action removes cryptographic validation of DNS responses and may indicate an attempt to facilitate DNS-based attacks.
113+
Investigate immediately to determine if this change was authorized and assess potential security impact.
114+
Review DNS query logs for suspicious activity and consider re-enabling DNSSEC if unauthorized.
115+
version: 1.0.0
116+
kind: Scheduled

‎Solutions/Google Cloud Platform Audit Logs/Data/Solution_GCPAuditLogs.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,8 @@
1212
"Analytic Rules/GCPOpenFirewallRuleCreated.yaml",
1313
"Analytic Rules/GCPOrgPolicyDeletion.yaml",
1414
"Analytic Rules/GCPStorageBucketMadePublic.yaml",
15-
"Analytic Rules/GCPVpcFlowLogsDisabled.yaml"
15+
"Analytic Rules/GCPVpcFlowLogsDisabled.yaml",
16+
"Analytic Rules/GCPDNSSECDisabled.yaml"
1617
],
1718
"Hunting Queries": [
1819
"Hunting Queries/GCPDataAccessLoggingDisabled.yaml",

‎Solutions/Google Cloud Platform Audit Logs/Package/3.0.2.zip‎

1.1 KB
Binary file not shown.

‎Solutions/Google Cloud Platform Audit Logs/Package/createUiDefinition.json‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"config": {
77
"isWizard": false,
88
"basics": {
9-
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Google%20Cloud%20Platform%20Audit%20Logs/logo/Google-Cloud-Branding.png\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Google%20Cloud%20Platform%20Audit%20Logs/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Google Cloud Platform (GCP) audit logs, ingested from Microsoft Sentinel's connector, enables you to capture and track all activity that occurs in your GCP environment. These audit logs provide valuable insights for monitoring user activity, troubleshooting issues, and ensuring compliance with security regulations. They serve as a record of events that practitioners can utilize to monitor access and identify potential threats across GCP resources.\n\n**Data Connectors:** 1, **Analytic Rules:** 6, **Hunting Queries:** 5\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
9+
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Google%20Cloud%20Platform%20Audit%20Logs/logo/Google-Cloud-Branding.png\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Google%20Cloud%20Platform%20Audit%20Logs/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Google Cloud Platform (GCP) audit logs, ingested from Microsoft Sentinel's connector, enables you to capture and track all activity that occurs in your GCP environment. These audit logs provide valuable insights for monitoring user activity, troubleshooting issues, and ensuring compliance with security regulations. They serve as a record of events that practitioners can utilize to monitor access and identify potential threats across GCP resources.\n\n**Data Connectors:** 1, **Analytic Rules:** 7, **Hunting Queries:** 5\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
1010
"subscription": {
1111
"resourceProviders": [
1212
"Microsoft.OperationsManagement/solutions",
@@ -184,6 +184,20 @@
184184
}
185185
}
186186
]
187+
},
188+
{
189+
"name": "analytic7",
190+
"type": "Microsoft.Common.Section",
191+
"label": "GCP Audit Logs - DNSSEC Disabled on Managed DNS Zone",
192+
"elements": [
193+
{
194+
"name": "analytic7-text",
195+
"type": "Microsoft.Common.TextBlock",
196+
"options": {
197+
"text": "Detects when DNSSEC (DNS Security Extensions) is disabled on a Google Cloud DNS managed zone.\nDNSSEC provides cryptographic authentication of DNS data, preventing DNS spoofing and cache poisoning attacks.\nAdversaries may disable DNSSEC to enable DNS-based command and control, phishing campaigns, or\nto redirect traffic to malicious infrastructure without cryptographic validation.\nThis rule monitors DNS zone patch operations where DNSSEC state changes from ON to OFF."
198+
}
199+
}
200+
]
187201
}
188202
]
189203
},

0 commit comments

Comments
 (0)