Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,179 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detect when the Unified Audit Log is disabled
Continual logins to Azure AD PowerShell app are not a security best practice, if this is observed, additional investigation is needed
Detects when an Entra ID conditional access policy has been modified
Secrets added to applications have legitimate purposes, but can also be a method of persistence.
This rule detects O365 login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
Detects file downloads using O365 or Graph Activity logs, not including anonymous file links
Detect when the Unified Audit Log is enabled
Adding users to roles is expected but if it occurs outside of PIM, validation should occur
Detects Azure AD admin login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
This rule detects Azure AD login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
Page 35 of 76