Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
74 detections
Filters
Last updated
All Time
Detection languages
29
12
10
10
7
Contributors
32
24
7
5
2
Categories
34
17
16
12
12
Platforms
52
12
11
7
7
Products / Services
10,643
9,755
6,688
4,418
3,745
MITRE Techniques
19
17
16
14
14
CVEs
1
1
1
Detects GCP audit log write operations involving settings, IAM, or metadata modifications (such as setMetadata, setIamPolicy, setServiceAccount) that either originate from a known attacker IP or are performed by a default GCP service account from a public caller IP.
Detects anomalous GCP IAM Service Account Credential API calls where a principal impersonates multiple distinct service accounts within a short time window. This behavior often indicates a credential delegation chain or a multi-stage privilege escalation attempt within a GCP environment.
Detects malicious attempts to delete or modify the access control settings of centralized cloud audit log storage, such as S3 buckets, Azure Log Analytics workspaces, or GCP log buckets. These actions aim to impair visibility into an adversary's activities, a common step in anti-forensics and data destruction workflows.
Detects anomalous large-scale data export operations in Google BigQuery (via jobs.insert or jobs.query) performed by identities (service accounts, API keys) not previously observed in the environment. This activity is indicative of credential abuse where stolen third-party analytics or monitoring service tokens are utilized for illicit data exfiltration, a behavior consistent with tactics employed by threat actors such as ShinyHunters.
Detects unauthorized modifications or deletions of cloud logging sinks in Google Cloud Platform (GCP) or diagnostic settings in Azure, which may indicate an attacker attempting to disable audit logs to cover their tracks or evade detection.
Detects suspicious modifications to Google Cloud Platform compute instance metadata, specifically the enabling of serial ports or the addition of startup scripts, which can be leveraged to execute arbitrary commands on a virtual machine. This rule also monitors for the initiation of GCP Cloud Shell environments, which may be used as a platform for further administrative activity.
This rule detects administrative actions in GCP that involve modifying or deleting Cloud Logging sinks, or disabling specific services, with a specific focus on disabling the logging service itself. Adversaries may perform these actions to tamper with audit trails and evade detection of malicious activities.
Detects suspicious modifications to Google Cloud Platform compute instance metadata, specifically the enabling of serial ports or the addition of startup scripts, which can be leveraged to execute arbitrary commands on a virtual machine. This rule also monitors for the initiation of GCP Cloud Shell environments, which may be used as a platform for further administrative activity.
Detects unauthorized or suspicious modifications to machine learning model artifacts within a model registry or deployment pipeline. The rule triggers on detected checksum mismatches, bypassed security/approval workflows, or significant, anomalous deviations in model file size compared to previous versions, which are common indicators of malicious tampering (AML.T0018).
Detects the creation or modification of Google Cloud Config Connector (KCC) IAM resources (IAMPolicyMember, IAMPartialPolicy, IAMPolicy) that assign high-privilege roles like 'roles/owner' or 'roles/resourcemanager.organizationAdmin'. This monitors for potential privilege escalation where a low-privilege actor leverages the KCC controller's high-privilege service account to perform unauthorized IAM binding changes on Google Cloud resources.
Detects malicious attempts to delete or modify the access control settings of centralized cloud audit log storage, such as S3 buckets, Azure Log Analytics workspaces, or GCP log buckets. These actions aim to impair visibility into an adversary's activities, a common step in anti-forensics and data destruction workflows.
Detects anomalous GCP IAM Service Account Credential API calls where a principal impersonates multiple distinct service accounts within a short time window. This behavior often indicates a credential delegation chain or a multi-stage privilege escalation attempt within a GCP environment.
This rule detects administrative actions in GCP that involve modifying or deleting Cloud Logging sinks, or disabling specific services, with a specific focus on disabling the logging service itself. Adversaries may perform these actions to tamper with audit trails and evade detection of malicious activities.
Detects when the Google Cloud Config Connector (KCC) service account is granted highly privileged roles (roles/owner or roles/resourcemanager.organizationAdmin) at the Organization scope. This pattern is indicative of a potential 'ConfigConfusion' confused-deputy attack, where a compromised Kubernetes namespace with IAMPolicyMember creation rights could be used to escalate privileges to Organization Owner.
Detects anomalous large-scale data export operations in Google BigQuery (via jobs.insert or jobs.query) performed by identities (service accounts, API keys) not previously observed in the environment. This activity is indicative of credential abuse where stolen third-party analytics or monitoring service tokens are utilized for illicit data exfiltration, a behavior consistent with tactics employed by threat actors such as ShinyHunters.
Detects OAuth2 JWT bearer-grant token requests to Google's OAuth endpoint using the attacker-controlled service-account identity and Sheets API scope observed in the fake GlobalProtect campaign
Detects OAuth2 JWT bearer-grant token requests to Google's OAuth endpoint using the attacker-controlled service-account identity and Sheets API scope observed in the fake GlobalProtect campaign
This rule monitors GCP VPC Flow logs for potential command and control (C2) or data exfiltration activity by identifying internal-to-external network connections that exhibit high novelty. It calculates the percentage of new destination IP addresses contacted by internal source IPs within a single day. Alerts are triggered when a source IP initiates connections to at least 20 unique external destinations, where at least 20% of those destinations have never been contacted by that source in the previous day. This behavioral analysis is designed to detect reconnaissance, scanning, or large-scale data exfiltration patterns.
This rule monitors GCP Audit logs for the creation or deletion of VPN tunnels. It classifies the actor (human vs. service account) and validates the source of the action against expected patterns such as the use of Terraform and authorized network sources. It highlights activity that deviates from standard infrastructure-as-code deployments or originates from unusual network sources, aiding in the detection of unauthorized or suspicious network configuration changes.
This rule monitors GCP audit logs for the modification, creation, or deletion of organization policies. These actions are often associated with an attacker attempting to weaken the security posture of the cloud environment by modifying or disabling restrictive security configurations.
This rule detects high-volume outbound network traffic from a Google Cloud Platform (GCP) source IP to external (non-private/non-internal) destinations. It establishes a baseline of daily outbound traffic per source IP over time and triggers an alert if the current daily outbound volume exceeds 500MB and shows a significant increase (more than 3x the established average) compared to previous days. This behavior is often indicative of unauthorized data exfiltration or abnormal network activity.
Page 1 of 4