Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1578-modify-cloud-compute-infrastructure

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when a Google Security Command Center muteconfigs rule was created.

Strategy

Google Security Command Center helps you strengthen your security posture by evaluating your security and data attack surface; providing asset inventory and discovery; identifying misconfigurations, vulnerabilities and threats; and helping you mitigate and remediate risks.

This detection rule detects when a user creates a rule to mute future findings or mute multiple existing findings. This could indicate an attacker attempting to hide malicious activity.

Triage and response

1. Investigate the finding to determine if the action was expected.
2. If the finding is deemed malicious, follow the investigation and remediation guidance provided by Google and also any internal incident response processes.