Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
222 detections
Filters
Last updated
All Time
Detection languages
70
66
42
26
9
Contributors
57
47
32
17
10
Categories
55
38
35
32
24
Platforms
137
63
23
22
12
Products / Services
10,665
9,758
6,692
4,421
3,749
222
MITRE Techniques
79
61
55
43
33
CVEs
1
1
1
1
IDS Classtypes
1
1
IDS Protocols
2
Detects web traffic directed towards Google Apps Script endpoints that exhibit characteristics of malicious activity, specifically targeting browser-side data collection and user interaction lures. The rule identifies potential phishing attempts by correlating access to Google Apps Script pages (e.g., sidebars or add-ons) with external document-based referrers (e.g., Google Docs) or social media referrers, combined with scripts that attempt to exfiltrate user device environment data, location, or cryptocurrency wallet information.
Detects potential post-authentication persistent actions (e.g., OAuth app grants, MFA changes, mailbox rule updates) performed shortly after a successful Google Workspace login, specifically flagging actions originating from IP addresses different from the login session to identify session hijacking or token replay (AiTM) activity. Includes suppression for known corporate IP ranges, trusted OAuth application consents, and recurring user behavior.
Detects potential post-authentication persistent actions (e.g., OAuth app grants, MFA changes, mailbox rule updates) performed shortly after a successful Google Workspace login, specifically flagging actions originating from IP addresses different from the login session to identify session hijacking or token replay (AiTM) activity. Includes suppression for known corporate IP ranges, trusted OAuth application consents, and recurring user behavior.
Detects anomalous activity where AI-enabled browser agents or extensions perform email summarization or access actions without corresponding user UI interaction, subsequently sending or sharing the information to an external recipient address distinct from the mailbox owner.
Detects Google Workspace login activity that's classified as suspicious by Google.
Detects potential post-authentication persistent actions (e.g., OAuth app grants, MFA changes, mailbox rule updates) performed shortly after a successful Google Workspace login, specifically flagging actions originating from IP addresses different from the login session to identify session hijacking or token replay (AiTM) activity. Includes suppression for known corporate IP ranges, trusted OAuth application consents, and recurring user behavior.
Detects suspicious administrative activity within Google Tag Manager, including tag creation, updates, and container publishing, combined with logins originating from multiple IP addresses or geographical locations for the same account. This is indicative of potential account compromise or unauthorized configuration changes.
This rule detects anomalous, high-volume file access or download activity across cloud applications and file storage services. It tracks users over a period of time, flagging individuals whose daily activity consistently contributes to a large total volume of data access (exceeding 500MB) over at least five days, specifically looking for sustained behavior that deviates from sudden, single-day spikes.
Detects potential session replay or cookie theft attacks against Google Workspace accounts. The rule identifies anomalous session activity where a single session ID is associated with multiple country codes within a short timeframe (less than 60 minutes), suggesting that a stolen session token is being used by an adversary in a different location than the legitimate user.
This rule detects instances where Google Workspace flags a sensitive action as risky (such as sign-ins from suspicious locations, unusual devices, or known-bad IPs), yet the action is allowed to proceed. This indicates a potential bypass of security controls or an account compromise where an adversary is utilizing a valid account despite triggered risk indicators.
Detects potential session replay or cookie theft attacks against Google Workspace accounts. The rule identifies anomalous session activity where a single session ID is associated with multiple country codes within a short timeframe (less than 60 minutes), suggesting that a stolen session token is being used by an adversary in a different location than the legitimate user.
Detects instances where a high-value security or transaction-related notification email is received concurrently with a burst of non-essential bulk or subscription-based emails. This pattern is indicative of an email-bombing (inbox flooding) attack, often used to bury critical alerts and mask malicious activity such as unauthorized account access or fraudulent financial transactions.
Detects potential session replay or cookie theft attacks against Google Workspace accounts. The rule identifies anomalous session activity where a single session ID is associated with multiple country codes within a short timeframe (less than 60 minutes), suggesting that a stolen session token is being used by an adversary in a different location than the legitimate user.
Detects anomalous login activity in Google Workspace characterized by a high volume of login failures (5 or more) originating from a single IP address. The rule identifies potential brute force or credential stuffing campaigns and flags instances where a successful login occurs following a burst of failure events from the same source.
Detects potential session replay or cookie theft attacks against Google Workspace accounts. The rule identifies anomalous session activity where a single session ID is associated with multiple country codes within a short timeframe (less than 60 minutes), suggesting that a stolen session token is being used by an adversary in a different location than the legitimate user.
Detects potential session replay or cookie theft attacks against Google Workspace accounts. The rule identifies anomalous session activity where a single session ID is associated with multiple country codes within a short timeframe (less than 60 minutes), suggesting that a stolen session token is being used by an adversary in a different location than the legitimate user.
Detects users who have downloaded more than 50 files from cloud storage applications within a single hour, potentially indicating data exfiltration or mass data harvesting.
Detects Google Workspace bulk export/Takeout activity occurring shortly after an OAuth grant or app-password creation, or an unusual volume of export/download events, consistent with automated Gmail/Docs/Keep data exfiltration.
Detects users who have downloaded more than 50 files from cloud storage applications within a single hour, potentially indicating data exfiltration or mass data harvesting.
Detects OAuth application authorization events where the granted scopes include highly sensitive access such as Gmail, Drive, or Admin APIs. This rule identifies potential consent phishing attacks where users are tricked into granting malicious third-party applications broad, unauthorized access to their Google Workspace account. The rule excludes common, expected applications like Google Cloud SDK or standard Google services.
Detects mass revocation of OAuth tokens by a user, which may indicate an attacker cleaning up evidence after data extraction, or legitimate administrative incident response activity.
Page 2 of 11