Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
289 detections
Filters
Last updated
All Time
Detection languages
82
73
38
36
26
Contributors
85
49
34
33
30
Categories
216
120
57
34
27
Platforms
260
70
64
37
11
Products / Services
10,650
9,755
6,688
4,418
3,745
289
MITRE Techniques
111
81
43
42
42
CVEs
1
1
1
1
IDS Classtypes
3
2
1
1
IDS Protocols
7
Detect a user downloads GCP BigQuery results from multiple tables which might indicate data exfiltration activity.
Detect when GCP Cloud Audit logs are exempted for principals in all services at project or organization level. Audit logging helps organizations maintain security and minimize risk.
Detect when GCP IAM Organization Policy is updated or deleted.
Detect when multiple KMS crypto key versions are disabled or destroyed from GCP Cloud KMS.
Detect when GCP Security Command Center services are disabled.
Detect when GCP Workload identity pools are disabled or deleted. Disabling or deleting a pool will prevent any connected identities from accessing all GCP resources.
Detect when multiple secrets or secret versions are deleted from GCP Secret Manager.
Detect when multiple GCP Service APIs are disabled in a short period of time.
Detects a successful attempt to retrieve the service API Keys.
Detects successful API executions from a Tor exit node.
Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource.
Detects when an access policy that is applied to a GCP cloud resource is deleted.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
This rule identifies when sensitive information is re-identified in Google Cloud Platform (GCP). The detection is based on the 'projects.content.reidentify' method name in GCP audit logs, indicating an attempt to reverse a de-identification process, potentially exposing sensitive data.
This rule identifies when a VPN Tunnel is modified or deleted within Google Cloud Platform. Adversaries may modify or delete VPN tunnels to disrupt network connectivity, reroute traffic, or hinder defensive efforts, impacting the availability or integrity of services.
Detects when Google Cloud Storage buckets are enumerated. This activity involves listing storage buckets or their channels, which can be an indicator of reconnaissance by an attacker attempting to understand the environment's data storage landscape.
Detects the creation, modification, or deletion of Kubernetes RoleBindings and ClusterRoleBindings in Google Cloud. These actions can indicate an adversary attempting to escalate privileges or maintain persistence within a Kubernetes cluster by granting themselves or other accounts additional roles and permissions.
Detects when a Google Cloud Storage bucket is modified or deleted. This includes operations such as deleting a bucket, inserting (creating) a bucket, or updating/patching a bucket's properties. Such activities can indicate unauthorized access, data manipulation, or attempts to disrupt services.
This rule identifies the creation or modification of Kubernetes Jobs or CronJobs within a Google Cloud environment. Adversaries may use these scheduled tasks to maintain persistence, execute malicious code, or escalate privileges within a Kubernetes cluster by scheduling containers to run at specific times or intervals.
Detects when a Google Cloud SQL database instance or its user accounts are created, deleted, or modified. This can indicate malicious activity such as data destruction, unauthorized access attempts, or attempts to disrupt services.
This rule identifies when Kubernetes secrets are modified or deleted within a Google Cloud Platform (GCP) environment. It specifically looks for audit log entries related to the creation, update, patch, or deletion of Kubernetes secrets.
Detects when a firewall rule is modified, deleted, or inserted in Google Cloud Platform (GCP). This activity can indicate an adversary attempting to impair defenses or establish persistence by altering network access controls.
Page 13 of 14