gcp-logging-exclusion-evasion

Create or update a log exclusion filter to drop matching log entries before they are stored - granular evasion for specific resource types, methods, or caller identities, while leaving the sink apparently active.

derived gcp emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`LoggingService`
source	`?principal`
target	`?log_scope`
permissions	`logging.exclusions.create` `logging.exclusions.update`
conditions	`iam_permission`
state logic	ACTIVE when the principal holds EFFECTIVE logging.exclusions.create or logging.exclusions.update at the project/folder/org scope; BLOCKED under IAM deny or org policy.

source type

Identity

target type

LoggingService

source

?principal

target

?log_scope

permissions

logging.exclusions.create logging.exclusions.update

conditions

iam_permission

state logic

ACTIVE when the principal holds EFFECTIVE logging.exclusions.create or logging.exclusions.update at the project/folder/org scope; BLOCKED under IAM deny or org policy.

Narrative

{principal.name} can create or update a log exclusion (logging.exclusions.create / logging.exclusions.update) that drops matching audit entries before they are stored. The sink remains active and no configuration alert fires, making this a stealthy evasion technique for specific resources, API methods, or attacker-controlled identities.

Raw rule rules/derived/gcp/logging.yaml

id: gcp-logging-exclusion-evasion
emits: CanModifyConfiguration
description: "Create or update a log exclusion filter to drop matching log entries before they are stored\
  \ \u2014 granular evasion for specific resource types, methods, or caller identities, while leaving\
  \ the sink apparently active."
match:
- - principal: null
  - HasPermission
  - log_scope: null
where:
- node_type(?log_scope) == LoggingService
- effective_action(?principal, ?log_scope) includes any of ['logging.exclusions.create', 'logging.exclusions.update']
emit:
  source_type: Identity
  target_type: LoggingService
  source: ?principal
  target: ?log_scope
  permissions:
  - logging.exclusions.create
  - logging.exclusions.update
  conditions:
  - iam_permission
  state_logic: ACTIVE when the principal holds EFFECTIVE logging.exclusions.create or logging.exclusions.update
    at the project/folder/org scope; BLOCKED under IAM deny or org policy.
  confidence: 0.88
  derived_from:
  - HasPermission(?principal, logging.exclusions.create|logging.exclusions.update, ?log_scope)
  false_positive_note: "Log exclusions apply only to new entries \u2014 they do not retroactively delete\
    \ stored entries (use gcp-logging-delete-log-bucket for retroactive destruction). A broad exclusion\
    \ (e.g. resource.type=\"*\") silences all log output but causes operational impact (monitoring alerts,\
    \ compliance failures) that may trigger independent detection. An exclusion targeting only the attacker's\
    \ principal email is highly suspicious but requires precise knowledge of the logged identity. This\
    \ is stealth evasion \u2014 the sink remains IsLogging=true and active from a monitoring perspective.\
    \ No resource access is granted; do not chain to escalation."
  narrative: '{principal.name} can create or update a log exclusion (logging.exclusions.create / logging.exclusions.update)
    that drops matching audit entries before they are stored. The sink remains active and no configuration
    alert fires, making this a stealthy evasion technique for specific resources, API methods, or attacker-controlled
    identities.'