Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
289 detections
Filters
Last updated
All Time
Detection languages
82
73
38
36
26
Contributors
85
49
34
33
30
Categories
216
120
57
34
27
Platforms
260
70
64
37
11
Products / Services
10,650
9,755
6,688
4,418
3,745
289
MITRE Techniques
111
81
43
42
42
CVEs
1
1
1
1
IDS Classtypes
3
2
1
1
IDS Protocols
7
This rule identifies when a DNS Zone is either modified or deleted within Google Cloud Platform. This activity is captured through specific Google Cloud DNS API calls: 'Dns.ManagedZones.Delete', 'Dns.ManagedZones.Update', and 'Dns.ManagedZones.Patch'. Such actions can indicate malicious activity aimed at disrupting services or redirecting traffic, or legitimate administrative changes.
This rule identifies activities related to Google Cloud Platform (GCP) Packet Mirroring. Packet Mirroring allows capturing full network traffic, which can be abused by adversaries to intercept and collect sensitive data from unencrypted internal network communications. The rule specifically looks for various API calls related to the creation, modification, deletion, or listing of Packet Mirroring configurations.
Identifies when a service account is disabled or deleted in Google Cloud. This activity can indicate an attempt to remove access for legitimate services or users, potentially as part of an impact or defense evasion strategy.
Identifies when a service account is modified, created, updated, enabled, or undeleted in Google Cloud. This rule specifically looks for API calls related to service account management, which could indicate an attacker establishing persistence, escalating privileges, or otherwise manipulating cloud resources.
Identifies when a DNS Zone is modified or deleted in Google Cloud.
Detects when storage bucket is modified or deleted in Google Cloud.
Identifies when sensitive information is re-identified in google Cloud.
Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.
Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.
Identifies when the Secrets are Modified or Deleted.
Identifies when a service account is disabled or deleted in Google Cloud.
Identifies when a service account is modified in Google Cloud.
Detects when storage bucket is enumerated in Google Cloud.
Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.
Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate.
Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.
An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.
Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.
An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.
Detect when a Cloud SQL DB has been modified or deleted.
Page 14 of 14