GCP Audit Logs - Detect Bulk VM Snapshot Deletion | Microsoft Sentinel Analytic Rules

Back


Id	dfdffdc7-929f-4c7e-8f48-30e5ffddb067
Rulename	GCP Audit Logs - Detect Bulk VM Snapshot Deletion
Description	Detects bulk deletion of Google Cloud VM snapshots within a short time period, which may indicate data destruction or defense evasion activities. VM snapshots are critical for backup and disaster recovery. Bulk deletion of snapshots can prevent recovery from incidents and may indicate malicious activity such as ransomware, data destruction, or an attempt to cover tracks after a security breach. Adversaries may delete snapshots to maximize damage, prevent forensic investigation, or hinder recovery efforts. This rule triggers when multiple snapshots are deleted by the same user within a 1-minute window.
Severity	High
Tactics	Impact DefenseEvasion
Techniques	T1485 T1490 T1562.001
Required data connectors	GCPAuditLogsDefinition
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Audit%20Logs/Analytic%20Rules/GCPBulkVMSnapshotDeletion.yaml
Version	1.0.0
Arm template	dfdffdc7-929f-4c7e-8f48-30e5ffddb067.json

KQL

// Update these thresholds if noisy in your environment
let SnapshotDeletionThreshold = 10;
let TimeWindow = 1m;
GCPAuditLogs
| where ServiceName == "compute.googleapis.com"
| where MethodName has "compute.snapshots.delete"
| where GCPResourceType == "gce_snapshot" and Severity == "NOTICE"
| extend 
    AuthzInfoJson = parse_json(AuthorizationInfo),
    RequestMetadataJson = parse_json(RequestMetadata),
    ResponseJson = parse_json(Response)
| extend PermissionType = tostring(AuthzInfoJson[0].permissionType)
| where PermissionType == "ADMIN_WRITE"
| extend 
    CallerIpAddress = tostring(RequestMetadataJson.callerIp),
    UserAgent = tostring(RequestMetadataJson.callerSuppliedUserAgent),
    SnapshotName = extract(@"snapshots/([^/]+)", 1, GCPResourceName),
    OperationType = tostring(ResponseJson.operationType),
    OperationId = tostring(ResponseJson.id)
| summarize 
    SnapshotCount = count(),
    SnapshotList = make_set(SnapshotName, 100),
    FirstDeletion = min(TimeGenerated),
    LastDeletion = max(TimeGenerated),
    OperationIds = make_set(OperationId, 100),
    CallerIPs = make_set(CallerIpAddress, 10)
    by PrincipalEmail, ProjectId, UserAgent
| where SnapshotCount >= SnapshotDeletionThreshold
| extend DeletionTimeSpan = LastDeletion - FirstDeletion
| where DeletionTimeSpan <= TimeWindow
| extend 
    AccountName = tostring(split(PrincipalEmail, "@")[0]), 
    AccountUPNSuffix = tostring(split(PrincipalEmail, "@")[1])
| project 
    TimeGenerated = FirstDeletion,
    PrincipalEmail,
    ProjectId,
    SnapshotCount,
    SnapshotList,
    FirstDeletion,
    LastDeletion,
    DeletionTimeSpan,
    CallerIPs,
    UserAgent,
    OperationIds,
    AccountName,
    AccountUPNSuffix

YAML

tags:
- GCP
- Compute
- Data Destruction
- Cloud Security
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Audit%20Logs/Analytic%20Rules/GCPBulkVMSnapshotDeletion.yaml
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - GCPAuditLogs
  connectorId: GCPAuditLogsDefinition
tactics:
- Impact
- DefenseEvasion
relevantTechniques:
- T1485
- T1490
- T1562.001
kind: Scheduled
alertDetailsOverride:
  alertDescriptionFormat: |-
    User {{PrincipalEmail}} deleted {{SnapshotCount}} VM snapshots in project {{ProjectId}} within a short time period. 
    This may indicate ransomware, data destruction, or defense evasion activity. Verify authorization, check remaining snapshots, review IP addresses, and investigate for compromise.
  alertDisplayNameFormat: 'Bulk VM Snapshot Deletion: {{SnapshotCount}} snapshots deleted by {{PrincipalEmail}} in {{ProjectId}}'
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: PrincipalEmail
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: AccountUPNSuffix
  entityType: Account
- fieldMappings:
  - identifier: Name
    columnName: ProjectId
  entityType: CloudApplication
description: |
  'Detects bulk deletion of Google Cloud VM snapshots within a short time period, which may indicate data destruction or defense evasion activities.
  VM snapshots are critical for backup and disaster recovery. Bulk deletion of snapshots can prevent recovery from incidents and may indicate
  malicious activity such as ransomware, data destruction, or an attempt to cover tracks after a security breach.
  Adversaries may delete snapshots to maximize damage, prevent forensic investigation, or hinder recovery efforts.
  This rule triggers when multiple snapshots are deleted by the same user within a 1-minute window.'
triggerOperator: gt
status: Available
queryFrequency: 15m
id: dfdffdc7-929f-4c7e-8f48-30e5ffddb067
name: GCP Audit Logs - Detect Bulk VM Snapshot Deletion
severity: High
query: |
  // Update these thresholds if noisy in your environment
  let SnapshotDeletionThreshold = 10;
  let TimeWindow = 1m;
  GCPAuditLogs
  | where ServiceName == "compute.googleapis.com"
  | where MethodName has "compute.snapshots.delete"
  | where GCPResourceType == "gce_snapshot" and Severity == "NOTICE"
  | extend 
      AuthzInfoJson = parse_json(AuthorizationInfo),
      RequestMetadataJson = parse_json(RequestMetadata),
      ResponseJson = parse_json(Response)
  | extend PermissionType = tostring(AuthzInfoJson[0].permissionType)
  | where PermissionType == "ADMIN_WRITE"
  | extend 
      CallerIpAddress = tostring(RequestMetadataJson.callerIp),
      UserAgent = tostring(RequestMetadataJson.callerSuppliedUserAgent),
      SnapshotName = extract(@"snapshots/([^/]+)", 1, GCPResourceName),
      OperationType = tostring(ResponseJson.operationType),
      OperationId = tostring(ResponseJson.id)
  | summarize 
      SnapshotCount = count(),
      SnapshotList = make_set(SnapshotName, 100),
      FirstDeletion = min(TimeGenerated),
      LastDeletion = max(TimeGenerated),
      OperationIds = make_set(OperationId, 100),
      CallerIPs = make_set(CallerIpAddress, 10)
      by PrincipalEmail, ProjectId, UserAgent
  | where SnapshotCount >= SnapshotDeletionThreshold
  | extend DeletionTimeSpan = LastDeletion - FirstDeletion
  | where DeletionTimeSpan <= TimeWindow
  | extend 
      AccountName = tostring(split(PrincipalEmail, "@")[0]), 
      AccountUPNSuffix = tostring(split(PrincipalEmail, "@")[1])
  | project 
      TimeGenerated = FirstDeletion,
      PrincipalEmail,
      ProjectId,
      SnapshotCount,
      SnapshotList,
      FirstDeletion,
      LastDeletion,
      DeletionTimeSpan,
      CallerIPs,
      UserAgent,
      OperationIds,
      AccountName,
      AccountUPNSuffix
queryPeriod: 15m
customDetails:
  UserAgent: UserAgent
  FirstDeletion: FirstDeletion
  SnapshotCount: SnapshotCount
  DeletionTimeSpan: DeletionTimeSpan
  SnapshotList: SnapshotList
  LastDeletion: LastDeletion
  CallerIPs: CallerIPs
  ProjectId: ProjectId

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/dfdffdc7-929f-4c7e-8f48-30e5ffddb067')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/dfdffdc7-929f-4c7e-8f48-30e5ffddb067')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "User {{PrincipalEmail}} deleted {{SnapshotCount}} VM snapshots in project {{ProjectId}} within a short time period. \nThis may indicate ransomware, data destruction, or defense evasion activity. Verify authorization, check remaining snapshots, review IP addresses, and investigate for compromise.",
          "alertDisplayNameFormat": "Bulk VM Snapshot Deletion: {{SnapshotCount}} snapshots deleted by {{PrincipalEmail}} in {{ProjectId}}"
        },
        "alertRuleTemplateName": "dfdffdc7-929f-4c7e-8f48-30e5ffddb067",
        "customDetails": {
          "CallerIPs": "CallerIPs",
          "DeletionTimeSpan": "DeletionTimeSpan",
          "FirstDeletion": "FirstDeletion",
          "LastDeletion": "LastDeletion",
          "ProjectId": "ProjectId",
          "SnapshotCount": "SnapshotCount",
          "SnapshotList": "SnapshotList",
          "UserAgent": "UserAgent"
        },
        "description": "'Detects bulk deletion of Google Cloud VM snapshots within a short time period, which may indicate data destruction or defense evasion activities.\nVM snapshots are critical for backup and disaster recovery. Bulk deletion of snapshots can prevent recovery from incidents and may indicate\nmalicious activity such as ransomware, data destruction, or an attempt to cover tracks after a security breach.\nAdversaries may delete snapshots to maximize damage, prevent forensic investigation, or hinder recovery efforts.\nThis rule triggers when multiple snapshots are deleted by the same user within a 1-minute window.'\n",
        "displayName": "GCP Audit Logs - Detect Bulk VM Snapshot Deletion",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "PrincipalEmail",
                "identifier": "FullName"
              },
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "AccountUPNSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "ProjectId",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Cloud%20Platform%20Audit%20Logs/Analytic%20Rules/GCPBulkVMSnapshotDeletion.yaml",
        "query": "// Update these thresholds if noisy in your environment\nlet SnapshotDeletionThreshold = 10;\nlet TimeWindow = 1m;\nGCPAuditLogs\n| where ServiceName == \"compute.googleapis.com\"\n| where MethodName has \"compute.snapshots.delete\"\n| where GCPResourceType == \"gce_snapshot\" and Severity == \"NOTICE\"\n| extend \n    AuthzInfoJson = parse_json(AuthorizationInfo),\n    RequestMetadataJson = parse_json(RequestMetadata),\n    ResponseJson = parse_json(Response)\n| extend PermissionType = tostring(AuthzInfoJson[0].permissionType)\n| where PermissionType == \"ADMIN_WRITE\"\n| extend \n    CallerIpAddress = tostring(RequestMetadataJson.callerIp),\n    UserAgent = tostring(RequestMetadataJson.callerSuppliedUserAgent),\n    SnapshotName = extract(@\"snapshots/([^/]+)\", 1, GCPResourceName),\n    OperationType = tostring(ResponseJson.operationType),\n    OperationId = tostring(ResponseJson.id)\n| summarize \n    SnapshotCount = count(),\n    SnapshotList = make_set(SnapshotName, 100),\n    FirstDeletion = min(TimeGenerated),\n    LastDeletion = max(TimeGenerated),\n    OperationIds = make_set(OperationId, 100),\n    CallerIPs = make_set(CallerIpAddress, 10)\n    by PrincipalEmail, ProjectId, UserAgent\n| where SnapshotCount >= SnapshotDeletionThreshold\n| extend DeletionTimeSpan = LastDeletion - FirstDeletion\n| where DeletionTimeSpan <= TimeWindow\n| extend \n    AccountName = tostring(split(PrincipalEmail, \"@\")[0]), \n    AccountUPNSuffix = tostring(split(PrincipalEmail, \"@\")[1])\n| project \n    TimeGenerated = FirstDeletion,\n    PrincipalEmail,\n    ProjectId,\n    SnapshotCount,\n    SnapshotList,\n    FirstDeletion,\n    LastDeletion,\n    DeletionTimeSpan,\n    CallerIPs,\n    UserAgent,\n    OperationIds,\n    AccountName,\n    AccountUPNSuffix\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT15M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1562.001"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Impact"
        ],
        "tags": [
          "GCP",
          "Compute",
          "Data Destruction",
          "Cloud Security"
        ],
        "techniques": [
          "T1485",
          "T1490",
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}