LoFP / virtual private cloud routes may be created by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.

Techniques

• T1562

Sample rules

GCP Virtual Private Cloud Route Creation

• source: elastic
• technicques:
  • T1562

Description

Identifies when a virtual private cloud (VPC) route is created in Google Cloud Platform (GCP). Google Cloud routes define the paths that network traffic takes from a virtual machine (VM) instance to other destinations. These destinations can be inside a Google VPC network or outside it. An adversary may create a route in order to impact the flow of network traffic in their target’s cloud environment.

Detection logic

event.dataset:gcp.audit and event.action:(v*.compute.routes.insert or "beta.compute.routes.insert")