GCP Audit Logs - DNSSEC Disabled on Managed DNS Zone
Detects when DNSSEC (DNS Security Extensions) is disabled on a Google Cloud DNS managed zone. DNSSEC provides cryptographic authentication of DNS data, preventing DNS spoofing and cache poisoning attacks. Adversaries…
Description
Detects when DNSSEC (DNS Security Extensions) is disabled on a Google Cloud DNS managed zone. DNSSEC provides cryptographic authentication of DNS data, preventing DNS spoofing and cache poisoning attacks. Adversaries may disable DNSSEC to enable DNS-based command and control, phishing campaigns, or to redirect traffic to malicious infrastructure without cryptographic validation. This rule monitors DNS zone patch operations where DNSSEC state changes from ON to OFF.
Detection logic
Detection requirements
- Platform
- ContainersESXiIaaSLinuxmacOSNetwork DevicesPREWindows
The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.
- Log source product
- gcpauditlogsdefinition
- Log source service
- gcpauditlogs
MITRE ATT&CK mappings
1 exclusive technique.This is coverage no other published rule has; it is not this rule's total technique count.
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- 9129a43e-e204-4a9a-969e-d8861ce3437c
- Tagged by the source as
- CommandAndControlDefenseEvasionResourceDevelopment
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 1, 2026
- Version
- 1