Sigma rule: Google Full Network Traffic Packet Capture

Rule

Title

Google Full Network Traffic Packet Capture

Status

test

Level

medium

Author

Austin Songer @austinsonger

Date

2021-08-13

Modified

2022-10-09

File

rules/cloud/gcp/audit/gcp_full_network_traffic_packet_capture.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.

Log source

product

gcp

service

gcp.audit

Detection

selection:
    gcp.audit.method_name:
        - v*.Compute.PacketMirrorings.Get
        - v*.Compute.PacketMirrorings.Delete
        - v*.Compute.PacketMirrorings.Insert
        - v*.Compute.PacketMirrorings.Patch
        - v*.Compute.PacketMirrorings.List
        - v*.Compute.PacketMirrorings.aggregatedList
condition: selection

False positives (as the rule lists them)

• Full Network Packet Capture may be done by a system or network administrator.
• If known behavior is causing false positives, it can be exempted from the rule.

Tags

• attack.collection
• attack.t1074

MITRE ATT&CK ids this rule names

• T1074

References

• https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
• https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.PacketMirrorings.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/gcp/audit/gcp_full_network_traffic_packet_capture.yml