Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
134
111
68
41
32
Contributors
136
63
56
49
29
Categories
264
153
62
60
59
Platforms
39,894
7,228
6,523
3,864
3,624
461
Products / Services
260
63
57
52
51
MITRE Techniques
148
103
61
58
58
CVEs
3
2
2
1
1
IDS Classtypes
7
5
5
4
3
IDS Protocols
27
This rule detects when a new Google Cloud Platform (GCP) firewall rule is created that allows traffic from any source IP address (0.0.0.0/0) on all protocols. This configuration significantly broadens the attack surface and could indicate a misconfiguration or malicious activity aimed at bypassing network defenses.
Detect when a GCP Firewall rule is opened to the world (0.0.0.0/0) on all protocols.
Detects when Google Cloud Audit logs are removed from all services at either the project or organization level. This action can indicate an adversary attempting to impair defenses by disabling logging to hide their activities.
This rule detects when highly privileged administrative roles, specifically 'Owner' or 'Editor', are assigned to a service account within Google Cloud Platform. This activity is significant because service accounts with such elevated permissions can be leveraged by attackers for persistence, privilege escalation, and to perform a wide range of actions within the GCP environment, potentially leading to compromise of cloud resources.
This rule detects when a Google Cloud Platform (GCP) BigQuery dataset's access policy is modified to include 'allUsers' or 'allAuthenticatedUsers'. This action effectively makes the dataset publicly accessible, which can lead to unauthorized data exposure and potential data exfiltration. The rule specifically looks for 'IAMPolicy.SetIamPolicy' events on BigQuery resources where a binding delta adds a role (e.g., 'roles/bigquery.dataViewer') to either 'allUsers' or 'allAuthenticatedUsers'.
This rule identifies when a new domain is added to the list of trusted domains within Google Workspace. An adversary might leverage this capability to establish trusted relationships, potentially manipulating sharing settings to gain unauthorized access to sensitive organizational files and folders.
This rule detects when multiple HMAC (Hash-based Message Authentication Code) authentication keys are deleted from Google Cloud Storage settings within a one-hour window by the same user. HMAC keys are used for programmatic access to Cloud Storage, and their deletion can indicate an attempt to disrupt legitimate access, cover tracks, or impact service availability.
This rule detects when a single user generates an excessive number of 'Permission Denied' events within a one-hour timeframe in Google Cloud Platform (GCP). Specifically, it looks for more than 5 'BLOCK' actions with a severity of 'ERROR' and a status code of '7' (which typically indicates 'Permission Denied' in GCP API errors) from a single user. Additionally, it requires these events to span across more than one target application and more than one product event type, which helps to reduce false positives by indicating broader activity rather than a single, isolated error.
This rule detects when a Google Cloud Platform (GCP) Identity and Access Management (IAM) Organization Policy is either updated or deleted. Such actions can indicate an attempt to modify security controls, potentially to facilitate persistence or privilege escalation within the GCP environment. Monitoring these changes is crucial for maintaining the security posture of an organization's cloud resources.
Detects when a user deletes multiple secrets or secret versions from Google Cloud Platform (GCP) Secret Manager within a one-hour period. This activity could indicate an attempt to destroy critical data or disrupt services.
This rule detects when a Google Cloud Platform (GCP) Compute Engine image's access policy is modified to include 'allAuthenticatedUsers'. This action effectively makes the image publicly accessible to any authenticated Google user, which could lead to unauthorized access or data exfiltration if sensitive data is present in the image.
This rule identifies when a custom administrator role is created within Google Workspace. Monitoring such events is crucial for security teams to detect and prevent unauthorized access to data that could result from malicious or accidental configuration of administrator privileges.
This rule detects when a single user disables or destroys 10 or more Google Cloud KMS (Key Management Service) crypto key versions within a one-hour period. This activity could indicate an attacker attempting to destroy data encrypted by these keys, leading to data unavailability or integrity issues. The rule specifically looks for 'DestroyCryptoKeyVersion' events or 'UpdateCryptoKeyVersion' events where the key version state is changed to 'DISABLED'.
This rule identifies when a new application from the Google Workspace Marketplace is added to a Google Workspace organization. Installing certain third-party applications can introduce security risks such as data exfiltration, data leakage, or an expanded attack surface for the organization.
This rule identifies when an encryption key file is accessed (downloaded, viewed, or copied) by an anonymous user in Google Drive. This activity could indicate an adversary attempting to gain access to sensitive encryption keys before moving laterally or compromising data.
This rule identifies when an external user account is added to a group within Google Workspace. This detection helps security teams monitor for unauthorized or unexpected additions of external users to internal groups, which could lead to unauthorized access to sensitive data or resources. The rule works by comparing the domain of the group with the domain of the user being added; if they differ, it indicates an external user is being added.
This rule detects when a single user downloads results from multiple BigQuery tables within a one-hour window. This behavior can be indicative of data exfiltration attempts, where an attacker or insider is trying to extract a large amount of data from an organization's data warehouse.
This rule detects when a single user disables multiple Google Cloud Platform (GCP) Service APIs within a short period (1 hour). Specifically, it triggers if a user performs more than 5 'DisableService' actions on 'serviceusage.googleapis.com' within an hour. This activity could indicate an attempt to disrupt cloud services or evade detection by disabling security-related APIs.
Identifies when a user deletes multiple files from Google Drive within a one-hour period. This activity may indicate an attempt at data destruction or an insider threat activity.
Detects when principals are exempted from GCP Cloud Audit logs at either the project or organization level. This action can significantly impair an organization's ability to monitor security events and maintain compliance, as audit logs are crucial for detecting malicious activity and ensuring accountability. The rule specifically looks for 'SetIamPolicy' events targeting 'cloudresourcemanager.googleapis.com' where audit log exemptions are added for 'allServices'.
This rule detects when free Google email addresses (gmail.com, googlemail.com, or googlegroups.com) are added to an IAM policy in Google Cloud Platform. This activity is suspicious as it could indicate an attempt by an attacker to establish persistence or escalate privileges by granting access to an external, potentially untraceable, account.
Page 19 of 22