GCP Audit Logs - DNSSEC Disabled on Managed DNS Zone | Microsoft Sentinel Analytic Rules

Back


Id	9129a43e-e204-4a9a-969e-d8861ce3437c
Rulename	GCP Audit Logs - DNSSEC Disabled on Managed DNS Zone
Description	Detects when DNSSEC (DNS Security Extensions) is disabled on a Google Cloud DNS managed zone. DNSSEC provides cryptographic authentication of DNS data, preventing DNS spoofing and cache poisoning attacks. Adversaries may disable DNSSEC to enable DNS-based command and control, phishing campaigns, or to redirect traffic to malicious infrastructure without cryptographic validation. This rule monitors DNS zone patch operations where DNSSEC state changes from ON to OFF.
Severity	High
Tactics	DefenseEvasion CommandAndControl ResourceDevelopment
Techniques	T1562.001 T1071.004 T1584.002
Required data connectors	GCPAuditLogsDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Audit%20Logs/Analytic%20Rules/GCPDNSSECDisabledForDNSZone.yaml
Version	1.0.0
Arm template	9129a43e-e204-4a9a-969e-d8861ce3437c.json

KQL

GCPAuditLogs
| where ServiceName == "dns.googleapis.com"
| where MethodName in ("dns.managedZones.update", "dns.managedZones.patch")
| where GCPResourceType == "dns_managed_zone" and Severity == "NOTICE"
| extend 
    ResponseJson = parse_json(Response),
    RequestMetadataJson = parse_json(RequestMetadata),
    AuthInfoJson = parse_json(AuthenticationInfo)
| extend ZoneContext = ResponseJson.operation.zoneContext
| where isnotempty(ZoneContext)
| extend 
    OldDnsSecState = tostring(ZoneContext.oldValue.dnssecConfig.state),
    NewDnsSecState = tostring(ZoneContext.newValue.dnssecConfig.state)
| where OldDnsSecState == "ON" and NewDnsSecState == "OFF"
| extend 
    ManagedZoneName = extract(@"managedZones/([^/]+)", 1, GCPResourceName),
    DnsName = tostring(ResponseJson.managedZone.dnsName),
    ZoneId = tostring(ResponseJson.managedZone.id),
    ZoneDescription = tostring(ResponseJson.managedZone.description),
    Visibility = tostring(ResponseJson.managedZone.visibility),
    OperationId = tostring(ResponseJson.operation.id),
    CallerIpAddress = tostring(RequestMetadataJson.callerIp),
    AuthEmail = tostring(AuthInfoJson.principalEmail)
| extend 
    AccountName = tostring(split(PrincipalEmail, "@")[0]), 
    AccountUPNSuffix = tostring(split(PrincipalEmail, "@")[1])
| project TimeGenerated,
          PrincipalEmail,
          AuthEmail,
          ProjectId,
          ManagedZoneName,
          DnsName,
          ResourceName = GCPResourceName,
          Visibility,
          ZoneId,
          ZoneDescription,
          OperationId,
          CallerIpAddress,
          MethodName,
          ServiceName,
          Severity,
          LogName,
          InsertId,
          AccountName,
          AccountUPNSuffix

YAML

status: Available
triggerThreshold: 0
relevantTechniques:
- T1562.001
- T1071.004
- T1584.002
queryPeriod: 1h
tactics:
- DefenseEvasion
- CommandAndControl
- ResourceDevelopment
name: GCP Audit Logs - DNSSEC Disabled on Managed DNS Zone
customDetails:
  Visibility: Visibility
  ManagedZoneName: ManagedZoneName
  ResourceName: ResourceName
  ProjectId: ProjectId
  DnsName: DnsName
  ZoneId: ZoneId
description: |
  'Detects when DNSSEC (DNS Security Extensions) is disabled on a Google Cloud DNS managed zone.
  DNSSEC provides cryptographic authentication of DNS data, preventing DNS spoofing and cache poisoning attacks.
  Adversaries may disable DNSSEC to enable DNS-based command and control, phishing campaigns, or
  to redirect traffic to malicious infrastructure without cryptographic validation.
  This rule monitors DNS zone patch operations where DNSSEC state changes from ON to OFF.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Audit%20Logs/Analytic%20Rules/GCPDNSSECDisabledForDNSZone.yaml
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: PrincipalEmail
    identifier: FullName
  - columnName: AccountName
    identifier: Name
  - columnName: AccountUPNSuffix
    identifier: UPNSuffix
  entityType: Account
- fieldMappings:
  - columnName: CallerIpAddress
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: ProjectId
    identifier: Name
  - columnName: ResourceName
    identifier: InstanceName
  entityType: CloudApplication
- fieldMappings:
  - columnName: DnsName
    identifier: DomainName
  entityType: DNS
alertDetailsOverride:
  alertDescriptionFormat: |-
    User {{PrincipalEmail}} disabled DNSSEC on DNS managed zone {{ManagedZoneName}} ({{DnsName}}).    
    This action removes cryptographic validation of DNS responses and may indicate an attempt to facilitate DNS-based attacks.
    Investigate immediately to determine if this change was authorized and assess potential security impact.
    Review DNS query logs for suspicious activity and consider re-enabling DNSSEC if unauthorized.
  alertDisplayNameFormat: DNSSEC Disabled on DNS Zone {{ManagedZoneName}} ({{DnsName}}) by {{PrincipalEmail}}
tags:
- GCP
- DNS
- DNSSEC
- Cloud Security
triggerOperator: gt
id: 9129a43e-e204-4a9a-969e-d8861ce3437c
severity: High
version: 1.0.0
requiredDataConnectors:
- connectorId: GCPAuditLogsDefinition
  dataTypes:
  - GCPAuditLogs
query: |
  GCPAuditLogs
  | where ServiceName == "dns.googleapis.com"
  | where MethodName in ("dns.managedZones.update", "dns.managedZones.patch")
  | where GCPResourceType == "dns_managed_zone" and Severity == "NOTICE"
  | extend 
      ResponseJson = parse_json(Response),
      RequestMetadataJson = parse_json(RequestMetadata),
      AuthInfoJson = parse_json(AuthenticationInfo)
  | extend ZoneContext = ResponseJson.operation.zoneContext
  | where isnotempty(ZoneContext)
  | extend 
      OldDnsSecState = tostring(ZoneContext.oldValue.dnssecConfig.state),
      NewDnsSecState = tostring(ZoneContext.newValue.dnssecConfig.state)
  | where OldDnsSecState == "ON" and NewDnsSecState == "OFF"
  | extend 
      ManagedZoneName = extract(@"managedZones/([^/]+)", 1, GCPResourceName),
      DnsName = tostring(ResponseJson.managedZone.dnsName),
      ZoneId = tostring(ResponseJson.managedZone.id),
      ZoneDescription = tostring(ResponseJson.managedZone.description),
      Visibility = tostring(ResponseJson.managedZone.visibility),
      OperationId = tostring(ResponseJson.operation.id),
      CallerIpAddress = tostring(RequestMetadataJson.callerIp),
      AuthEmail = tostring(AuthInfoJson.principalEmail)
  | extend 
      AccountName = tostring(split(PrincipalEmail, "@")[0]), 
      AccountUPNSuffix = tostring(split(PrincipalEmail, "@")[1])
  | project TimeGenerated,
            PrincipalEmail,
            AuthEmail,
            ProjectId,
            ManagedZoneName,
            DnsName,
            ResourceName = GCPResourceName,
            Visibility,
            ZoneId,
            ZoneDescription,
            OperationId,
            CallerIpAddress,
            MethodName,
            ServiceName,
            Severity,
            LogName,
            InsertId,
            AccountName,
            AccountUPNSuffix
queryFrequency: 1h

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/9129a43e-e204-4a9a-969e-d8861ce3437c')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/9129a43e-e204-4a9a-969e-d8861ce3437c')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "User {{PrincipalEmail}} disabled DNSSEC on DNS managed zone {{ManagedZoneName}} ({{DnsName}}).    \nThis action removes cryptographic validation of DNS responses and may indicate an attempt to facilitate DNS-based attacks.\nInvestigate immediately to determine if this change was authorized and assess potential security impact.\nReview DNS query logs for suspicious activity and consider re-enabling DNSSEC if unauthorized.",
          "alertDisplayNameFormat": "DNSSEC Disabled on DNS Zone {{ManagedZoneName}} ({{DnsName}}) by {{PrincipalEmail}}"
        },
        "alertRuleTemplateName": "9129a43e-e204-4a9a-969e-d8861ce3437c",
        "customDetails": {
          "DnsName": "DnsName",
          "ManagedZoneName": "ManagedZoneName",
          "ProjectId": "ProjectId",
          "ResourceName": "ResourceName",
          "Visibility": "Visibility",
          "ZoneId": "ZoneId"
        },
        "description": "'Detects when DNSSEC (DNS Security Extensions) is disabled on a Google Cloud DNS managed zone.\nDNSSEC provides cryptographic authentication of DNS data, preventing DNS spoofing and cache poisoning attacks.\nAdversaries may disable DNSSEC to enable DNS-based command and control, phishing campaigns, or\nto redirect traffic to malicious infrastructure without cryptographic validation.\nThis rule monitors DNS zone patch operations where DNSSEC state changes from ON to OFF.'\n",
        "displayName": "GCP Audit Logs - DNSSEC Disabled on Managed DNS Zone",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "PrincipalEmail",
                "identifier": "FullName"
              },
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "AccountUPNSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "CallerIpAddress",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "ProjectId",
                "identifier": "Name"
              },
              {
                "columnName": "ResourceName",
                "identifier": "InstanceName"
              }
            ]
          },
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "DnsName",
                "identifier": "DomainName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Audit%20Logs/Analytic%20Rules/GCPDNSSECDisabledForDNSZone.yaml",
        "query": "GCPAuditLogs\n| where ServiceName == \"dns.googleapis.com\"\n| where MethodName in (\"dns.managedZones.update\", \"dns.managedZones.patch\")\n| where GCPResourceType == \"dns_managed_zone\" and Severity == \"NOTICE\"\n| extend \n    ResponseJson = parse_json(Response),\n    RequestMetadataJson = parse_json(RequestMetadata),\n    AuthInfoJson = parse_json(AuthenticationInfo)\n| extend ZoneContext = ResponseJson.operation.zoneContext\n| where isnotempty(ZoneContext)\n| extend \n    OldDnsSecState = tostring(ZoneContext.oldValue.dnssecConfig.state),\n    NewDnsSecState = tostring(ZoneContext.newValue.dnssecConfig.state)\n| where OldDnsSecState == \"ON\" and NewDnsSecState == \"OFF\"\n| extend \n    ManagedZoneName = extract(@\"managedZones/([^/]+)\", 1, GCPResourceName),\n    DnsName = tostring(ResponseJson.managedZone.dnsName),\n    ZoneId = tostring(ResponseJson.managedZone.id),\n    ZoneDescription = tostring(ResponseJson.managedZone.description),\n    Visibility = tostring(ResponseJson.managedZone.visibility),\n    OperationId = tostring(ResponseJson.operation.id),\n    CallerIpAddress = tostring(RequestMetadataJson.callerIp),\n    AuthEmail = tostring(AuthInfoJson.principalEmail)\n| extend \n    AccountName = tostring(split(PrincipalEmail, \"@\")[0]), \n    AccountUPNSuffix = tostring(split(PrincipalEmail, \"@\")[1])\n| project TimeGenerated,\n          PrincipalEmail,\n          AuthEmail,\n          ProjectId,\n          ManagedZoneName,\n          DnsName,\n          ResourceName = GCPResourceName,\n          Visibility,\n          ZoneId,\n          ZoneDescription,\n          OperationId,\n          CallerIpAddress,\n          MethodName,\n          ServiceName,\n          Severity,\n          LogName,\n          InsertId,\n          AccountName,\n          AccountUPNSuffix\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1562.001",
          "T1071.004",
          "T1584.002"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "DefenseEvasion",
          "ResourceDevelopment"
        ],
        "tags": [
          "GCP",
          "DNS",
          "DNSSEC",
          "Cloud Security"
        ],
        "techniques": [
          "T1071",
          "T1562",
          "T1584"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}