Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule detects unauthorized attempts by non-automation Kubernetes users to create or update IAM policies for Google Cloud resources via Config Connector (KCC). It specifically monitors for actions that assign high-privilege roles (e.g., Organization Owner, Organization Admin) to Organization-scoped resources, excluding authorized platform service accounts and KCC reconciliation traffic.
This rule detects unauthorized attempts by non-automation Kubernetes users to create or update IAM policies for Google Cloud resources via Config Connector (KCC). It specifically monitors for actions that assign high-privilege roles (e.g., Organization Owner, Organization Admin) to Organization-scoped resources, excluding authorized platform service accounts and KCC reconciliation traffic.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Detects multiple AWS API calls (Publish, GetCallerIdentity, ListTopics) originating from a specific IP address (23.234.84.102) associated with a Zapier SNS sender. This rule monitors for potentially unauthorized or anomalous API usage patterns by identifying repeated, successful, and non-error events from a known source that may indicate misuse or compromise of an integration account.
Detects high-volume API call patterns targeting Google Gemini/Vertex AI services originating from a small, coordinated set of user accounts. This behavior may indicate an automated actor cluster, such as those leveraging generative AI to rapidly generate content for phishing kits or other malicious purposes.
Detects anomalous activity associated with AI and LLM service providers by identifying accounts that are either interacting with these services for the first time or exhibiting a significant spike in API call volume compared to their 14-day historical baseline. This pattern may indicate unauthorized use of enterprise AI resources, potential persistence mechanisms, or exfiltration activities abusing legitimate LLM orchestration APIs.
Detects potential post-authentication persistent actions (e.g., OAuth app grants, MFA changes, mailbox rule updates) performed shortly after a successful Google Workspace login, specifically flagging actions originating from IP addresses different from the login session to identify session hijacking or token replay (AiTM) activity. Includes suppression for known corporate IP ranges, trusted OAuth application consents, and recurring user behavior.
Detects accounts showing a spike in requests to public generative-AI services compared to their historical baseline, combined with anomalous indicators like multiple source IPs, regions, or off-hours activity.
Detects accounts showing a spike in requests to public generative-AI services compared to their historical baseline, combined with anomalous indicators like multiple source IPs, regions, or off-hours activity.
Detects instances where a single user account exhibits an anomalously high frequency of requests to public generative-AI platforms within a one-hour window, potentially indicating automated reconnaissance or data staging activities using AI tools.
Detects a suspicious correlation between the registration of new authentication methods or application integrations and the subsequent modification of Conditional Access policies within a 2-hour window. This behavior is indicative of the activation phase of a TrustSink attack, where an adversary sets up a malicious MFA provider and forces its use by expanding Conditional Access policy scope.
Detects potential session hijacking of a Claude SaaS account by identifying sign-ins from unrecognized IP addresses followed by a high-volume burst of API usage or message activity that deviates from the account's established baseline.
Detects high-velocity retrieval of multiple secrets from AWS Secrets Manager using a single IAM role or session shortly after activity initiation. This behavior is indicative of automated credential harvesting, often occurring post-compromise of a host (e.g., an SSH bastion) that has been assigned a high-privilege IAM role.
Detects potential token-replay persistence by identifying repeated 'MailItemsAccessed' events for the same user account from a non-native 'REST' and 'Firefox' client string, recurring at consistent ~30-minute intervals.
Page 41 of 135