Merge PR #4621 from @zestsg - Add New GCP / Google Workspace Related …

…Rules

new: GCP Break-glass Container Workload Deployed
new: Google Workspace Application Access Levels Modified
new: GCP Access Policy Deleted 

---------

Co-authored-by: Nasreddine Bencherchali <[email protected]>
Co-authored-by: phantinuss <[email protected]>

rules/cloud/gcp/audit/gcp_access_policy_deleted.yml

@@ -0,0 +1,32 @@
+title: GCP Access Policy Deleted
+id: 32438676-1dba-4ac7-bf69-b86cba995e05
+status: experimental
+description: |
+    Detects when an access policy that is applied to a GCP cloud resource is deleted.
+    An adversary would be able to remove access policies to gain access to a GCP cloud resource.
+references:
+    - https://cloud.google.com/access-context-manager/docs/audit-logging
+    - https://cloud.google.com/logging/docs/audit/understanding-audit-logs
+    - https://cloud.google.com/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog
+author: Bryan Lim
+date: 2024/01/12
+tags:
+    - attack.persistence
+    - attack.privilege_escalation
+    - attack.t1098
+logsource:
+    product: gcp
+    service: gcp.audit
+detection:
+    selection:
+        data.protoPayload.authorizationInfo.permission:
+            - 'accesscontextmanager.accessPolicies.delete'
+            - 'accesscontextmanager.accessPolicies.accessLevels.delete'
+            - 'accesscontextmanager.accessPolicies.accessZones.delete'
+            - 'accesscontextmanager.accessPolicies.authorizedOrgsDescs.delete'
+        data.protoPayload.authorizationInfo.granted: 'true'
+        data.protoPayload.serviceName: 'accesscontextmanager.googleapis.com'
+    condition: selection
+falsepositives:
+    - Legitimate administrative activities
+level: medium

rules/cloud/gcp/audit/gcp_breakglass_container_workload_deployed.yml

@@ -0,0 +1,28 @@
+title: GCP Break-glass Container Workload Deployed
+id: 76737c19-66ee-4c07-b65a-a03301d1573d
+status: experimental
+description: |
+    Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.
+references:
+    - https://cloud.google.com/binary-authorization
+author: Bryan Lim
+date: 2024/01/12
+tags:
+    - attack.defense_evasion
+    - attack.t1548
+logsource:
+    product: gcp
+    service: gcp.audit
+detection:
+    selection:
+        data.protoPayload.resource.type: 'k8s_cluster'
+        data.protoPayload.logName:
+            - 'cloudaudit.googleapis.com/activity'
+            - 'cloudaudit.googleapis.com%2Factivity'
+        data.protoPayload.methodName: 'io.k8s.core.v1.pods.create'
+    keywords:
+        - 'image-policy.k8s.io/break-glass'
+    condition: selection and keywords
+falsepositives:
+    - Unknown
+level: medium

rules/cloud/gcp/gworkspace/gcp_gworkspace_application_access_levels_modified.yml

@@ -0,0 +1,28 @@
+title: Google Workspace Application Access Level Modified
+id: 22f2fb54-5312-435d-852f-7c74f81684ca
+status: experimental
+description: |
+    Detects when an access level is changed for a Google workspace application.
+    An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model.
+    An adversary would be able to remove access levels to gain easier access to Google workspace resources.
+references:
+    - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-application-settings
+    - https://support.google.com/a/answer/9261439
+author: Bryan Lim
+date: 2024/01/12
+tags:
+    - attack.persistence
+    - attack.privilege_escalation
+    - attack.t1098.003
+logsource:
+    product: gcp
+    service: google_workspace.admin
+detection:
+    selection:
+        eventService: 'admin.googleapis.com'
+        eventName: 'CHANGE_APPLICATION_SETTING'
+        setting_name|startswith: 'ContextAwareAccess'
+    condition: selection
+falsepositives:
+    - Legitimate administrative activities changing the access levels for an application
+level: medium