Vendor: Google

Product: Virtual Private Cloud

Rules	Models	MITRE TTPs	Event Types	Parsers
29	15	6	1	1

Use-Case	Event Types/Parsers	MITRE TTP	Content
Compromised Credentials	netflow-connection ↳ gcpvpc-netflow-connection	T1046 - Network Service Scanning	1 Rules 1 Models
Data Exfiltration	netflow-connection ↳ gcpvpc-netflow-connection	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol T1071.002 - Application Layer Protocol: File Transfer Protocols	1 Rules
Lateral Movement	netflow-connection ↳ gcpvpc-netflow-connection	T1043 - Commonly Used Port T1046 - Network Service Scanning T1071 - Application Layer Protocol T1090.002 - Proxy: External Proxy T1571 - Non-Standard Port	26 Rules 15 Models
Ransomware	netflow-connection ↳ gcpvpc-netflow-connection	T1071 - Application Layer Protocol	1 Rules

ATT&CK Matrix for Enterprise

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
						Network Service Scanning			Non-Standard Port Commonly Used Port Application Layer Protocol: File Transfer Protocols Proxy: External Proxy Application Layer Protocol Proxy	Exfiltration Over Alternative Protocol Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol