From 3e223925ad1e4e8874defb509fdd33cd52d1fd67 Mon Sep 17 00:00:00 2001 From: Charles Goggins Date: Fri, 28 Aug 2026 15:55:50 -0400 Subject: [PATCH] Revert "Adjusted rule [GCP] Google Login From Bluedot Flagged IP" --- gcp-cloud-audit.rules | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gcp-cloud-audit.rules b/gcp-cloud-audit.rules index cbb0cda0..a57977b9 100644 --- a/gcp-cloud-audit.rules +++ b/gcp-cloud-audit.rules @@ -179,7 +179,7 @@ alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] Google Passkey Enrollment D # [truncated for JSON_MAX_KEY_SIZE=32 engine limit -- legacy engine stores keys clipped to 31 chars, full path never matches] .protoPayload.requestMetadata.callerIp -> .protoPayload.requestMetadata.c alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] Multiple SecretManager Secrets Deleted"; program:gcp; content:"secretmanager.googleapis.com"; meta_content:"%sagan%",DestroySecretVersion,DeleteSecret; meta_nocase; json_map:"src_ip",".protoPayload.requestMetadata.c"; parse_src_ip:1; after:track by_src, count 10, seconds 3600; threshold:type suppress,track by_src, count 1, seconds 3600; classtype:system-event; reference:url,attack.mitre.org/techniques/T1485; sid:5017819; rev:1;) #alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] Google Suspicious Login Detected"; program:gcp; json_content:".protoPayload.methodName","google.login.LoginService.loginSuccess"; content:"|22|boolValue|22 3a|true,|22|label|22 3a 22|LABEL_OPTIONAL|22|,|22|name|22 3a 22|is_suspicious|22|"; parse_src_ip:1; classtype:system-event; sid:5017820; rev:2;) -alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] Google Login From Bluedot Flagged IP"; program:gcp; json_content:".protoPayload.methodName","google.login.LoginService.loginSuccess"; parse_src_ip:1; bluedot:type ip_reputation, cdate_effective_period 3 months, track by_src,none,Malicious,Tor,Proxy; classtype:system-event; sid:5017821; rev:3;) +alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] Google Login From Bluedot Flagged IP"; program:gcp; json_content:".protoPayload.methodName","google.login.LoginService.loginSuccess"; parse_src_ip:1; bluedot:type ip_reputation, track by_src,none,Malicious,Tor,Proxy; classtype:system-event; sid:5017821; rev:2;) alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] Google Login Challenge Failed"; program:gcp; content:"login_challenge_status"; content:"failed"; parse_src_ip:1; classtype:system-event; sid:5017822; rev:2;) alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] Google Download User List"; program:gcp; json_content:".protoPayload.methodName","google.admin.AdminService.downloadUserlistCsv"; parse_src_ip:1; classtype:system-event; sid:5017823; rev:2;) alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] User Unenrolled from Strong Auth"; program:gcp; json_content:".protoPayload.methodName","google.admin.AdminService.unenrollUserFromStrongAuth"; parse_src_ip:1; classtype:system-event; sid:5017824; rev:2;)