Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,181 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects when a GitHub Personal Access Token is created from a known Tor exit node IP address. An adversary may create a Personal Access Token before carrying out follow up actions such as cloning GitHub repositories to steal data.
This rule detects suspicious user-agent strings associated with the GraphRunner tool. GraphRunner is a PowerShell script used for interacting with Microsoft Graph API and other Microsoft services, often for malicious purposes like token manipulation or brute-forcing client IDs. The rule specifically looks for a predefined set of user-agent strings that are hardcoded within GraphRunner's functions. Detection is focused on Azure Activity, Office 365, Azure AD, Azure AD Directory Audit, and Microsoft Graph Activity logs. The rule aggregates detections by principal IP or user ID over a 5-minute window.
Detects when a GitHub audit log stream is modified (e.g. paused, enabled, or disabled). An adversary may attempt to interrupt audit logging to erase their tracks.
Detects when a user clones a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
Detects when third-party application access restrictions are disabled for a GitHub organization.
Detects when branch protection rules are disabled for a GitHub repository.
Detects when components of GitHub secret scanning is disabled for an enterprise or organization.
Detects when two-factor authentication requirements are disabled for a GitHub enterprise or organization.
This rule detects GET requests to the Microsoft Graph API's '/v1.0/groups' endpoint. This activity can indicate an adversary enumerating groups within an Azure Active Directory environment, potentially using tools like GraphRunner's 'Get-DynamicGroups' function or similar custom scripts. Successful requests (HTTP 200) are specifically targeted.
This rule detects the enumeration of members within groups in Microsoft Entra ID (formerly Azure AD) via the Microsoft Graph API. Specifically, it looks for GET requests to the `/v1.0/groups/*/members` endpoint, which is indicative of an attempt to list group members. The rule's description notes that it is based on the behavior of the GraphRunner tool's `Get-SecurityGroups` function, suggesting it targets a specific method of enumeration.
Page 40 of 76