Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
222 detections
Filters
Last updated
All Time
Detection languages
70
66
42
26
9
Contributors
57
47
32
17
10
Categories
55
38
35
32
24
Platforms
137
63
23
22
12
Products / Services
10,665
9,758
6,692
4,421
3,749
222
MITRE Techniques
79
61
55
43
33
CVEs
1
1
1
1
IDS Classtypes
1
1
IDS Protocols
2
Identifies when an encryption key file is accessed by an anonymous user in Google Drive. An adversary may attempt to access encryption keys before moving laterally and compromising sensitive data.
Identifies when a user shares a file on Google Drive with a free email domain, which may indicate data exfiltration.
Identifies when a user downloads a potentially malicious file from Google Drive.
Identifies when multi-factor authentication (MFA) is disabled for a Google Workspace organization. Security teams can monitor for changes to MFA configuration that may weaken the organization's security posture.
Identifies when a user copies multiple files from Google Drive, which may indicate data exfiltration.
Identifies when a domain is added to the list of trusted domains in Google Workspace. An adversary may attempt to manipulate sharing settings for trusted domains to gain unauthorized access to sensitive files and folders within an organization.
Identifies when a Google Workspace user account is moved between Organizational Units.
Detects when an access level is changed for a Google Workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary could remove access levels to gain easier access to Google Workspace resources, potentially leading to persistence or privilege escalation.
Detects when a role privilege is deleted in Google Workspace. This could indicate an attempt to remove or modify administrative access, potentially as part of a privilege de-escalation by an attacker to avoid detection, or to clean up after an attack.
Detects when an application is removed from Google Workspace, which could indicate an attempt to disrupt services or remove security controls. This includes both direct application removal and removal from a whitelist.
Detects when a role is modified or deleted in Google Workspace. This could indicate an attacker attempting to escalate privileges, maintain persistence, or disrupt services by altering administrative roles.
Detects when multi-factor authentication (MFA) is disabled in Google Workspace. This could indicate an adversary attempting to weaken security controls for persistent access or to facilitate further compromise.
Page 11 of 11