Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
222 detections
Filters
Last updated
All Time
Detection languages
70
66
42
26
9
Contributors
57
47
32
17
10
Categories
55
38
35
32
24
Platforms
137
63
23
22
12
Products / Services
10,661
9,758
6,692
4,418
3,749
222
MITRE Techniques
79
61
55
43
33
CVEs
1
1
1
1
IDS Classtypes
1
1
IDS Protocols
2
The following analytic detects emails in Gsuite containing links to known abuse web services such as Pastebin, Telegram, and Discord. It leverages Gsuite Gmail logs to identify emails with these specific domains in their links. This activity is significant because these services are commonly used by attackers to deliver malicious payloads. If confirmed malicious, this could lead to the delivery of malware, phishing attacks, or other harmful activities, potentially compromising sensitive information or systems within the organization.
The following analytic detects suspicious use of the `modprobe` command to unload kernel modules, which may indicate an attempt to disable critical system components or evade detection. The `modprobe` utility manages kernel modules, and unauthorized unloading of modules can disrupt system security features, remove logging capabilities, or conceal malicious activities. By monitoring for unusual or unauthorized `modprobe` operations involving module unloading, this analytic helps identify potential tampering with kernel functionality, enabling security teams to investigate and address possible threats to system integrity.
This analytic detects the execution of the 'shred' command on a Linux machine, which is used to overwrite files to make them unrecoverable. It leverages data from Linux Auditd, focusing on process names and command-line arguments. This activity is significant because the 'shred' command can be used in destructive attacks, such as those seen in the Industroyer2 malware targeting energy facilities. If confirmed malicious, this activity could lead to the permanent destruction of critical files, severely impacting system integrity and data availability.
The analytic identifies modifications to the registry path .wav\\OpenWithProgIds, associated with the Snake Malware campaign. This activity is significant because Snake's WerFault.exe uses this registry path to decrypt an encrypted blob containing critical components like the AES key, IV, and paths for its kernel driver and loader. If confirmed malicious, this could allow the attacker to load and execute Snake's kernel driver, leading to potential system compromise and persistent access.
The following analytic identifies Gsuite emails with suspicious subjects and attachments commonly used in spear phishing attacks. It leverages Gsuite email logs, focusing on specific keywords in the subject line and known malicious file types in attachments. This activity is significant for a SOC as spear phishing is a prevalent method for initial compromise, often leading to further malicious actions. If confirmed malicious, this activity could result in unauthorized access, data exfiltration, or further malware deployment, posing a significant risk to the organization's security.
The analytic identifies suspicious file-sharing activity on Google Drive, where internal users share documents with more than 50 external recipients. It leverages GSuite Drive logs, focusing on changes in user access and filtering for emails outside the organization's domain. This activity is significant as it may indicate compromised accounts or intentional data exfiltration. If confirmed malicious, this behavior could lead to unauthorized access to sensitive information, data leaks, and potential compliance violations.
This rule identifies when a user downloads, views, or copies a potentially malicious file from Google Drive. The detection is triggered if the file has a public visibility setting ('people_with_link' or 'public_on_the_web') and its name matches a common executable or script file extension (e.g., .dll, .exe, .scr, .jar, .pif, .app, .dmg, .pkg, .elf, .so, .bin, .deb, .rpm, .sh, .hta, .lnk). This aims to detect user interaction with suspicious files that could lead to execution of malicious code.
This rule detects when a new Google Cloud Platform (GCP) firewall rule is created that allows traffic from any source IP address (0.0.0.0/0) on all protocols. This configuration significantly broadens the attack surface and could indicate a misconfiguration or malicious activity aimed at bypassing network defenses.
This rule identifies changes to SAML (Security Assertion Markup Language) provider configurations within Google Workspace. Monitoring these changes is crucial for security teams as modifications to SAML configurations can potentially weaken an organization's security posture, leading to unauthorized access or other security incidents. The rule specifically looks for events categorized as 'SAML2_SERVICE_PROVIDER_CONFIG_SETTINGS' or with product event types matching 'SAML2_SERVICE_PROVIDER_CONFIG'.
This rule identifies when a new domain is added to the list of trusted domains within Google Workspace. An adversary might leverage this capability to establish trusted relationships, potentially manipulating sharing settings to gain unauthorized access to sensitive organizational files and folders.
This rule identifies when a single user downloads multiple files from Google Drive within a one-hour window. This behavior can be indicative of data exfiltration attempts, where an attacker or malicious insider is trying to extract sensitive information from the organization's Google Drive storage. The rule specifically looks for 'download' events from the 'Google Workspace' vendor and 'drive' product, and triggers an alert if more than 10 distinct files are downloaded by the same user within the specified timeframe.
This rule identifies when a custom administrator role is created within Google Workspace. Monitoring such events is crucial for security teams to detect and prevent unauthorized access to data that could result from malicious or accidental configuration of administrator privileges.
This rule identifies when a new application from the Google Workspace Marketplace is added to a Google Workspace organization. Installing certain third-party applications can introduce security risks such as data exfiltration, data leakage, or an expanded attack surface for the organization.
This rule identifies when an encryption key file is accessed (downloaded, viewed, or copied) by an anonymous user in Google Drive. This activity could indicate an adversary attempting to gain access to sensitive encryption keys before moving laterally or compromising data.
This rule identifies a suspicious sequence of events within Google Workspace. Specifically, it triggers when a user successfully logs in under suspicious circumstances (indicated by the 'is_suspicious' label) and subsequently downloads a file from Google Drive. The rule correlates these two events by the user ID and ensures the download occurs after the suspicious login, within a 1-hour window.
This rule identifies when an external user account is added to a group within Google Workspace. This detection helps security teams monitor for unauthorized or unexpected additions of external users to internal groups, which could lead to unauthorized access to sensitive data or resources. The rule works by comparing the domain of the group with the domain of the user being added; if they differ, it indicates an external user is being added.
This rule identifies potential data exfiltration attempts where a user sends multiple files (more than 10) from Google Drive as email attachments to free email domains (e.g., gmail.com, aol.com, hotmail.com, outlook.com, icloud.com) within a one-hour window. This behavior can indicate an adversary attempting to move sensitive data out of the organization's controlled environment.
This rule identifies when a Google Workspace user account is moved between Organizational Units (OUs). This activity can be a legitimate administrative action, but it can also be used by an attacker to move a compromised account to an OU with different policies, potentially granting them more privileges or evading existing security controls. For example, an attacker might move an account to an OU with less stringent multi-factor authentication requirements or different access policies to sensitive data.
This rule generates alerts based on Google Workspace Alerts Center data and aggregates them by severity. It processes events from 'Google Workspace Alerts' and assigns a risk score based on the severity of the alert (LOW, MEDIUM, HIGH). The rule also extracts various details from the alerts such as event count, event type, product event type, security category details, security category, security investigation tool link, security summary, and alert severity.
This rule identifies when a user shares a file from Google Drive with an email address belonging to a common free email domain (e.g., gmail.com, aol.com, hotmail.com, outlook.com, icloud.com). This activity is flagged as it may indicate an attempt at data exfiltration, where sensitive information is moved outside the organization's controlled environment to personal or untracked accounts.
This rule identifies when multi-factor authentication (MFA) is disabled for a Google Workspace organization. This change can weaken the organization's security posture by removing an important layer of defense against unauthorized access. Security teams should monitor for such changes to prevent potential account compromise.
Page 9 of 11