GCP-NET - VPC Route Creation or Deletion
This rule monitors Google Cloud Platform (GCP) Audit Logs for changes to VPC network routes, specifically tracking 'insert' and 'delete' operations. It classifies actors as either human or service account, flags non-Terraform service account modifications, and identifies service accounts originating from unexpected network sources to detect potentially unauthorized infrastructure changes.
Sigma
