gcp-scc-notification-config-modify

Principal with securitycenter.notificationconfigs.delete or .update can delete or modify notification configs that route SCC findings to external systems (SIEM, SOAR, ticketing), disrupting the downstream alerting pipeline.

derived gcp emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'scc': None}

where

node_type(?scc) == SecurityService ?scc.provider_type in ['google.securitycenter.OrganizationSettings', 'google.securitycenter.ProjectSettings'] ?principal has EFFECTIVE securitycenter.notificationconfigs.delete OR securitycenter.notificationconfigs.update at the scope of ?scc

emit

source type	`Identity`
target type	`SecurityService`
source	`?principal`
target	`?scc`
permissions	`securitycenter.notificationconfigs.delete` `securitycenter.notificationconfigs.update`
conditions	`iam_permission`
state logic	ACTIVE when ?principal holds effective securitycenter.notificationconfigs.delete or securitycenter.notificationconfigs.update at ?scc.scope. BLOCKED if an IAM deny policy or VPC-SC perimeter denies both delete and update at the effective scope. This is distinct from gcp-scc-disable-service: SCC findings continue to be generated, but external systems are silenced.

Narrative

{principal.name} holds securitycenter.notificationconfigs.delete or .update at {scc.scope} and can delete or modify notification configurations that route SCC findings to external systems (e.g., Pub/Sub topics, Cloud Logging destinations, or third-party SIEM connectors). Deletion or disabling a config silences downstream alerting without affecting SCC finding generation - the attack surface remains exposed to the attacker, but external teams and automated response systems never see the findings. This is a high-impact cover-tracks primitive that persists until an administrator manually restores the config.

Raw rule rules/derived/gcp/scc.yaml

id: gcp-scc-notification-config-modify
emits: CanModifyConfiguration
description: Principal with securitycenter.notificationconfigs.delete or .update can delete or modify
  notification configs that route SCC findings to external systems (SIEM, SOAR, ticketing), disrupting
  the downstream alerting pipeline.
match:
- - principal: null
  - HasPermission
  - scc: null
where:
- node_type(?scc) == SecurityService
- ?scc.provider_type in ['google.securitycenter.OrganizationSettings', 'google.securitycenter.ProjectSettings']
- ?principal has EFFECTIVE securitycenter.notificationconfigs.delete OR securitycenter.notificationconfigs.update
  at the scope of ?scc
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?scc
  permissions:
  - securitycenter.notificationconfigs.delete
  - securitycenter.notificationconfigs.update
  conditions:
  - iam_permission
  state_logic: 'ACTIVE when ?principal holds effective securitycenter.notificationconfigs.delete or securitycenter.notificationconfigs.update
    at ?scc.scope. BLOCKED if an IAM deny policy or VPC-SC perimeter denies both delete and update at
    the effective scope. This is distinct from gcp-scc-disable-service: SCC findings continue to be generated,
    but external systems are silenced.'
  confidence: 0.85
  derived_from:
  - HasPermission(?principal, securitycenter.notificationconfigs.delete|securitycenter.notificationconfigs.update,
    ?scc)
  false_positive_note: "Notification config modification/deletion disrupts the downstream alerting pipeline\
    \ (SIEM, SOAR, ticketing integrations) WITHOUT disabling SCC services or stopping finding generation.\
    \ The SCC service continues operating at its current state \u2014 findings are still generated but\
    \ external teams never receive them. This is DEFENSE EVASION only; do NOT chain to access/escalation\
    \ edges. Deletion is destructive but required to realize the evasion primitive (deletion creates a\
    \ gap in alerting). The deletion is both a capability and an impact: once deleted, the config must\
    \ be manually recreated by an administrator. Scope: org-scoped notification configs route findings\
    \ org-wide; project-scoped configs route only that project's findings."
  narrative: "{principal.name} holds securitycenter.notificationconfigs.delete or .update at {scc.scope}\
    \ and can delete or modify notification configurations that route SCC findings to external systems\
    \ (e.g., Pub/Sub topics, Cloud Logging destinations, or third-party SIEM connectors). Deletion or\
    \ disabling a config silences downstream alerting without affecting SCC finding generation \u2014\
    \ the attack surface remains exposed to the attacker, but external teams and automated response systems\
    \ never see the findings. This is a high-impact cover-tracks primitive that persists until an administrator\
    \ manually restores the config."