Cloud Organizational policy was created or modified

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Gcp Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Defense Impairment (TA0112)
ATT&CK Technique	Disable or Modify Tools (T1685), Domain or Tenant Policy Modification (T1484)
Severity	Informational

Description

Cloud organizational policy was created or modified.

Attacker's Goals

Gain elevated privileges, disable security measures, misuse resources or cause disruption.

Investigative actions

• Check which services were affected by the policy creation.
• Check The cloud identity activity prior/after the policy creation.

Variations

Cloud Organizational policy was created or modified

Synopsis

Field	Value
ATT&CK Tactic	Defense Impairment (TA0112)
ATT&CK Technique	Disable or Modify Tools (T1685), Domain or Tenant Policy Modification (T1484)
Severity	Low

Description

Cloud organizational policy was created or modified.

Attacker's Goals

Gain elevated privileges, disable security measures, misuse resources or cause disruption.

Investigative actions

• Check which services were affected by the policy creation.
• Check The cloud identity activity prior/after the policy creation.