Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
222 detections
Filters
Last updated
All Time
Detection languages
70
66
42
26
9
Contributors
57
47
32
17
10
Categories
55
38
35
32
24
Platforms
137
63
23
22
12
Products / Services
10,665
9,758
6,692
4,421
3,749
222
MITRE Techniques
79
61
55
43
33
CVEs
1
1
1
1
IDS Classtypes
1
1
IDS Protocols
2
This rule identifies when the password policy configuration is changed within Google Workspace. Monitoring these changes is crucial for security teams to detect potential weakening of the organization's security posture, which could be exploited by adversaries to maintain or elevate access.
Identifies when a user deletes multiple files from Google Drive within a one-hour period. This activity may indicate an attempt at data destruction or an insider threat activity.
This rule identifies when a Google Workspace user shares a file on Google Drive shortly after a suspicious login event has occurred. It correlates a successful login event flagged as suspicious with subsequent Google Drive file sharing activities (changing user access, document visibility, access scope, or ACL editors) by the same user within a one-hour window. This behavior could indicate an attacker gaining access to an account and then exfiltrating data.
This rule identifies when a user account is unsuspended within Google Workspace. Unsuspending an account can be a legitimate administrative action, but it can also indicate an adversary reactivating a previously disabled account to regain access or enable further malicious activity. Monitoring this activity is crucial for detecting potential account takeover or persistence mechanisms.
This rule identifies when a single user copies a large number of files from Google Drive within a one-hour period. This behavior can be indicative of data exfiltration attempts, where an attacker or malicious insider is trying to move sensitive data out of the organization's control. The rule specifically looks for 'copy' or 'source_copy' events within Google Workspace Drive logs and triggers if more than 10 distinct documents are copied by the same user in an hour.
This rule identifies when a Google Workspace user transfers the ownership of a file within Google Drive. This activity is logged as a 'CREATE_DATA_TRANSFER_REQUEST' event in the Google Workspace admin logs, specifically categorized under 'USER_SETTINGS'. This could indicate an attempt to move sensitive data to a different account, potentially for exfiltration or to obscure ownership.
This rule identifies when the Google Workspace Marketplace allowlist is configured to allow users to install and run any applications from the Marketplace. This configuration may increase an organization's risk of data exfiltration/leakage and expand its attack surface by permitting the use of potentially malicious or unapproved third-party applications.
Identifies when an administrator role is assigned to a user account in Google Workspace. Security teams can monitor for the malicious or accidental assignment of administrator privileges to prevent unauthorized access to data. The rule specifically looks for `USER_RESOURCE_UPDATE_PERMISSIONS` events with `ASSIGN_ROLE` as the product event type and `DELEGATED_ADMIN_SETTINGS` in the security result category details. It also calculates a higher risk score if the assigned role is `_SEED_ADMIN_ROLE`.
Identifies when a Google Workspace user downloads a file from Google Drive after a suspicious login event occurred.
Identifies when Google Workspace password policy is changed. Security teams can monitor for changes to password policy configuration that may weaken the organization's security posture.
Identifies when a user sends multiple files from Google Drive as an email attachment to a free email domain, which may indicate data exfiltration.
Identifies when a user account is unsuspended in Google Workspace.
Generates alerts based on Google Workspace alerts center and aggregates them based on severity.
Identifies when a Marketplace app is added in a Google Workspace organization. Installing certain apps may increase the organization's risk of data exfiltration/leakage and increase its attack surface.
Identifies when the Google Workspace Marketplace allowlist is configured to allow users to install and run any apps from the Marketplace. Allowing users to install and run any apps may increase the organization's risk of data exfiltration/leakage and increase its attack surface.
Identifies when a user downloads multiple files from Google Drive, which may indicate data exfiltration.
Identifies when an external user account is added to a group in Google Workspace. Security teams can monitor for unexpected user accounts being added to Google Workspace groups to prevent unauthorized access to data.
Identifies when a Google Workspace user transfers the ownership of a file.
Identifies SAML provider configuration changes in Google Workspace. Security teams can monitor for changes to SAML provider configuration that may weaken the organization's security posture.
Identifies when an administrator role is assigned to a user account in Google Workspace. Security teams can monitor for the malicious or accidental assignment of administrator privileges to prevent unauthorized access to data.
Identifies when a custom administrator role is created in Google Workspace. Security teams can monitor for malicious or accidental configuration of administrator privileges to prevent unauthorized access to data.
Page 10 of 11