GCP Multiple KMS Keys Disabled Or Destroyed

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•4•0•69

This rule detects when a single user disables or destroys 10 or more Google Cloud KMS (Key Management Service) crypto key versions within a one-hour period. This activity could indicate an attacker attempting to destroy data encrypted by these keys, leading to data unavailability or integrity issues. The rule specifically looks for 'DestroyCryptoKeyVersion' events or 'UpdateCryptoKeyVersion' events where the key version state is changed to 'DISABLED'.