Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
134
111
68
41
32
Contributors
136
63
56
49
29
Categories
264
153
62
60
59
Platforms
39,894
7,228
6,523
3,864
3,624
461
Products / Services
260
63
57
52
51
MITRE Techniques
148
103
61
58
58
CVEs
3
2
2
1
1
IDS Classtypes
7
5
5
4
3
IDS Protocols
27
This rule detects when a Google Cloud Workload Identity Pool is either disabled or deleted. Workload Identity Pools are used to manage external identities (e.g., from AWS, Azure, or on-premises identity providers) that need to access Google Cloud resources. Disabling or deleting a Workload Identity Pool will immediately revoke access for all federated identities associated with that pool, potentially leading to a denial of service for legitimate users or indicating an attempt by an attacker to disrupt operations or remove traces of their access. The rule specifically looks for the 'google.iam.v1.WorkloadIdentityPools.DeleteWorkloadIdentityPool' event or an 'google.iam.v1.WorkloadIdentityPools.UpdateWorkloadIdentityPool' event where the 'req_identityPool_disabled' attribute is set to 'true'.
This rule detects when a new service account key is either created within a monitored Google Cloud project or uploaded to it. This activity is significant because service account keys grant programmatic access to Google Cloud resources and can be used for persistence by adversaries if compromised or maliciously created.
This rule detects when a Google Cloud Storage bucket's access policy is modified to allow public access. This occurs when 'allUsers' or 'allAuthenticatedUsers' are added to the bucket's permissions, granting broad access to its contents. Such a configuration can lead to unintended data exposure and is a significant security risk.
This rule detects the usage of a Google Cloud Platform (GCP) service account key from more than two distinct countries within a one-hour period. It leverages GeoIP enrichment data from Chronicle to identify the geographical origin of the IP addresses making the API calls. This behavior can indicate a compromised service account key being used by an attacker from multiple locations, potentially to evade detection or perform malicious activities across different regions.
This rule detects successful API executions within Google Cloud Platform (GCP) that originate from an IP address identified as a Tor exit node. It correlates GCP Cloud Audit logs, specifically looking for 'ALLOW' actions, with a GCTI (Google Cloud Threat Intelligence) feed that lists known Tor exit node IP addresses. The rule also calculates a risk score, with additional weight given if the originating IP is from certain high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
Detects a successful attempt to retrieve service API Keys within Google Cloud Platform. This activity could indicate an attacker attempting to gain access to sensitive credentials for further malicious actions.
This rule detects when Security Command Center services are disabled in Google Cloud Platform (GCP). Disabling Security Command Center can impair an organization's ability to detect security threats and vulnerabilities, making it a critical security event. The rule specifically looks for 'RESOURCE_WRITTEN' events in GCP Cloud Audit logs where the product event type indicates an update to Security Command Center settings, the target application is 'securitycenter.googleapis.com', and the 'service_enablement_state' label is set to 'DISABLED'.
Domain Prevalence
YARA-L
Detects DNS events querying domains that have a low rolling max prevalence.
Detects excessive PermissionDenied events within an hour timeframe from a user
Detect when GCP Cloud Audit logs are removed from all services at project or organization level. Audit logging helps organizations maintain security and minimize risk.
Detect when multiple HMAC authentication keys are deleted from GCP Storage settings.
Detects usage of service account key from multiple countries using Chronicle GeoIP enrichment.
Detects when a service account key is created in or uploaded to a monitored Google Cloud project.
Detect when GCP Compute Image is opened to public by adding allAuthenticatedUsers to the access policy.
Detect when Google Cloud Storage buckets are opened to public by adding allUsers or allAuthenticatedUsers to the access policy.
Detect when GCP BigQuery datasets are opened to public by adding allUsers or allAuthenticatedUsers to the access policy.
Detect when free Google Email addressess are added to IAM Policy such as gmail.com, googlemail.com or googlegroups.com.
Generates alerts based on Google Workspace alerts center and aggregates them based on severity.
Identifies when a Marketplace app is added in a Google Workspace organization. Installing certain apps may increase the organization's risk of data exfiltration/leakage and increase its attack surface.
Detect when admin privileged roles such as Owner or Editor are added to a Service Account.
Detect a user downloads GCP BigQuery results from multiple tables which might indicate data exfiltration activity.
Page 20 of 22