gcp-cloudasset-feed-tamper

Delete or modify a Cloud Asset Inventory asset feed, disrupting continuous inventory delivery to the reference collector's Pub/Sub topic - a cover-tracks evasion primitive that creates a detection blind spot.

derived gcp emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'feed': None}

where

node_class(?feed) == ConfigurationService node_type(?feed) == ConfigurationService ?feed.provider_type == 'google.cloudasset.Feed' effective_action(?principal, ?feed) includes any of ['cloudasset.feeds.delete', 'cloudasset.feeds.update']

emit

source type	`Identity`
target type	`ConfigurationService`
source	`?principal`
target	`?feed`
permissions	`cloudasset.feeds.delete` `cloudasset.feeds.update`
conditions	`iam_permission`
state logic	ACTIVE when the principal holds effective cloudasset.feeds.delete (can delete the feed entirely) OR cloudasset.feeds.update (can modify destination, filter, or disable the feed) on the Feed resource at the project/folder/org scope, with no IAM deny policy blocking the action; CONDITIONAL(iam_permission) if the grant is at a broader scope (folder/org) that may not resolve to this specific feed; BLOCKED if an IAM deny policy denies cloudasset.feeds.delete or cloudasset.feeds.update at the effective scope.

Narrative

{principal.name} can call cloudasset.feeds.delete or cloudasset.feeds.update on an asset feed and disrupt continuous Cloud Asset Inventory delivery to the Pub/Sub topic. Deleting the feed stops it entirely; updating it can redirect the destination topic or filter, silencing change notifications that the reference collector and other defenses rely on. This is a cover-tracks primitive - it creates a blind spot in real-time detection; it does not grant access to resources or credentials.

Raw rule rules/derived/gcp/cloudasset.yaml

id: gcp-cloudasset-feed-tamper
emits: CanModifyConfiguration
description: "Delete or modify a Cloud Asset Inventory asset feed, disrupting continuous inventory delivery\
  \ to the reference collector's Pub/Sub topic \u2014 a cover-tracks evasion primitive that creates a\
  \ detection blind spot."
match:
- - principal: null
  - HasPermission
  - feed: null
where:
- node_class(?feed) == ConfigurationService
- node_type(?feed) == ConfigurationService
- ?feed.provider_type == 'google.cloudasset.Feed'
- effective_action(?principal, ?feed) includes any of ['cloudasset.feeds.delete', 'cloudasset.feeds.update']
emit:
  source_type: Identity
  target_type: ConfigurationService
  source: ?principal
  target: ?feed
  permissions:
  - cloudasset.feeds.delete
  - cloudasset.feeds.update
  conditions:
  - iam_permission
  state_logic: ACTIVE when the principal holds effective cloudasset.feeds.delete (can delete the feed
    entirely) OR cloudasset.feeds.update (can modify destination, filter, or disable the feed) on the
    Feed resource at the project/folder/org scope, with no IAM deny policy blocking the action; CONDITIONAL(iam_permission)
    if the grant is at a broader scope (folder/org) that may not resolve to this specific feed; BLOCKED
    if an IAM deny policy denies cloudasset.feeds.delete or cloudasset.feeds.update at the effective scope.
  confidence: 0.8
  derived_from:
  - HasPermission(?principal, cloudasset.feeds.delete|cloudasset.feeds.update, ?feed)
  false_positive_note: "This is DEFENSE EVASION only \u2014 deleting or disabling a feed suppresses continuous\
    \ inventory delivery but does NOT grant access to any resource, credential, or identity. The collector\
    \ can re-enumerate on demand via searchAllResources; this evasion slows operational response rather\
    \ than blocking it outright. Do NOT chain to CanExecuteAs, CanEnterProject, CanEnterOrganization,\
    \ or CanEscalateTo. Detective-control tampering does not set BLOCKED state on capability edges. Modifying\
    \ only feed metadata (labels, display_name) without changing destination or filter is NOT evasion\
    \ \u2014 scope to capability-affecting updates."
  narrative: "{principal.name} can call cloudasset.feeds.delete or cloudasset.feeds.update on an asset\
    \ feed and disrupt continuous Cloud Asset Inventory delivery to the Pub/Sub topic. Deleting the feed\
    \ stops it entirely; updating it can redirect the destination topic or filter, silencing change notifications\
    \ that the reference collector and other defenses rely on. This is a cover-tracks primitive \u2014\
    \ it creates a blind spot in real-time detection; it does not grant access to resources or credentials."