Sigma rule: GCP Access Policy Deleted

Rule

Title

GCP Access Policy Deleted

Status

test

Level

medium

Author

Bryan Lim

Date

2024-01-12

File

rules/cloud/gcp/audit/gcp_access_policy_deleted.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when an access policy that is applied to a GCP cloud resource is deleted.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.

Log source

product

gcp

service

gcp.audit

Detection

selection:
    data.protoPayload.authorizationInfo.permission:
        - 'accesscontextmanager.accessPolicies.delete'
        - 'accesscontextmanager.accessPolicies.accessLevels.delete'
        - 'accesscontextmanager.accessPolicies.accessZones.delete'
        - 'accesscontextmanager.accessPolicies.authorizedOrgsDescs.delete'
    data.protoPayload.authorizationInfo.granted: 'true'
    data.protoPayload.serviceName: 'accesscontextmanager.googleapis.com'
condition: selection

False positives (as the rule lists them)

• Legitimate administrative activities

Tags

• attack.persistence
• attack.privilege-escalation
• attack.t1098

MITRE ATT&CK ids this rule names

• T1098

References

• https://cloud.google.com/access-context-manager/docs/audit-logging
• https://cloud.google.com/logging/docs/audit/understanding-audit-logs
• https://cloud.google.com/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/gcp/audit/gcp_access_policy_deleted.yml