Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
289 detections
Filters
Last updated
All Time
Detection languages
82
73
38
36
26
Contributors
85
49
34
33
30
Categories
216
120
57
34
27
Platforms
260
70
64
37
11
Products / Services
10,650
9,755
6,688
4,418
3,745
289
MITRE Techniques
111
81
43
42
42
CVEs
1
1
1
1
IDS Classtypes
3
2
1
1
IDS Protocols
7
This rule detects when a single user disables multiple Google Cloud Platform (GCP) Service APIs within a short period (1 hour). Specifically, it triggers if a user performs more than 5 'DisableService' actions on 'serviceusage.googleapis.com' within an hour. This activity could indicate an attempt to disrupt cloud services or evade detection by disabling security-related APIs.
Detects when principals are exempted from GCP Cloud Audit logs at either the project or organization level. This action can significantly impair an organization's ability to monitor security events and maintain compliance, as audit logs are crucial for detecting malicious activity and ensuring accountability. The rule specifically looks for 'SetIamPolicy' events targeting 'cloudresourcemanager.googleapis.com' where audit log exemptions are added for 'allServices'.
This rule detects when free Google email addresses (gmail.com, googlemail.com, or googlegroups.com) are added to an IAM policy in Google Cloud Platform. This activity is suspicious as it could indicate an attempt by an attacker to establish persistence or escalate privileges by granting access to an external, potentially untraceable, account.
This rule detects when a Google Cloud Workload Identity Pool is either disabled or deleted. Workload Identity Pools are used to manage external identities (e.g., from AWS, Azure, or on-premises identity providers) that need to access Google Cloud resources. Disabling or deleting a Workload Identity Pool will immediately revoke access for all federated identities associated with that pool, potentially leading to a denial of service for legitimate users or indicating an attempt by an attacker to disrupt operations or remove traces of their access. The rule specifically looks for the 'google.iam.v1.WorkloadIdentityPools.DeleteWorkloadIdentityPool' event or an 'google.iam.v1.WorkloadIdentityPools.UpdateWorkloadIdentityPool' event where the 'req_identityPool_disabled' attribute is set to 'true'.
This rule detects when a new service account key is either created within a monitored Google Cloud project or uploaded to it. This activity is significant because service account keys grant programmatic access to Google Cloud resources and can be used for persistence by adversaries if compromised or maliciously created.
This rule detects when a Google Cloud Storage bucket's access policy is modified to allow public access. This occurs when 'allUsers' or 'allAuthenticatedUsers' are added to the bucket's permissions, granting broad access to its contents. Such a configuration can lead to unintended data exposure and is a significant security risk.
This rule detects the usage of a Google Cloud Platform (GCP) service account key from more than two distinct countries within a one-hour period. It leverages GeoIP enrichment data from Chronicle to identify the geographical origin of the IP addresses making the API calls. This behavior can indicate a compromised service account key being used by an attacker from multiple locations, potentially to evade detection or perform malicious activities across different regions.
This rule detects successful API executions within Google Cloud Platform (GCP) that originate from an IP address identified as a Tor exit node. It correlates GCP Cloud Audit logs, specifically looking for 'ALLOW' actions, with a GCTI (Google Cloud Threat Intelligence) feed that lists known Tor exit node IP addresses. The rule also calculates a risk score, with additional weight given if the originating IP is from certain high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
Detects a successful attempt to retrieve service API Keys within Google Cloud Platform. This activity could indicate an attacker attempting to gain access to sensitive credentials for further malicious actions.
This rule detects when Security Command Center services are disabled in Google Cloud Platform (GCP). Disabling Security Command Center can impair an organization's ability to detect security threats and vulnerabilities, making it a critical security event. The rule specifically looks for 'RESOURCE_WRITTEN' events in GCP Cloud Audit logs where the product event type indicates an update to Security Command Center settings, the target application is 'securitycenter.googleapis.com', and the 'service_enablement_state' label is set to 'DISABLED'.
This rule detects DNS queries for domains that have a very low rolling maximum prevalence (3 or less over a 10-day period). This can indicate newly registered domains, domains used for command and control, or other suspicious activity that has not yet gained widespread legitimate use. The rule correlates DNS events with derived prevalence data to identify these low-prevalence domains.
Detects excessive PermissionDenied events within an hour timeframe from a user
Detect when GCP Cloud Audit logs are removed from all services at project or organization level. Audit logging helps organizations maintain security and minimize risk.
Detect when multiple HMAC authentication keys are deleted from GCP Storage settings.
Detects usage of service account key from multiple countries using Chronicle GeoIP enrichment.
Detects when a service account key is created in or uploaded to a monitored Google Cloud project.
Detect when GCP Compute Image is opened to public by adding allAuthenticatedUsers to the access policy.
Detect when Google Cloud Storage buckets are opened to public by adding allUsers or allAuthenticatedUsers to the access policy.
Detect when GCP BigQuery datasets are opened to public by adding allUsers or allAuthenticatedUsers to the access policy.
Detect when free Google Email addressess are added to IAM Policy such as gmail.com, googlemail.com or googlegroups.com.
Detect when admin privileged roles such as Owner or Editor are added to a Service Account.
Page 12 of 14