GCP-NET - Cloud DNS Managed Zone Modification
This rule detects modifications to Google Cloud Platform (GCP) Cloud DNS managed zones, including creating, deleting, patching, updating, or changing records within a managed zone. It performs triage by categorizing the actor as either a human or a service account, checks for the use of Infrastructure-as-Code (Terraform), and flags potentially anomalous activity such as service accounts interacting with DNS outside of expected networks or without using automated tooling.
Sigma
