Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,181 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects when an Okta user's password is reset and MFA factor(s) are deactivated or reset within a 30 minute time window. This activity may indicate that the user account has been compromised.
This rule detects suspicious activity involving an initial successful authentication to Office 365, followed by a non-interactive sign-in to Azure Activity (Entra ID) from the same user and IP address, but with different session IDs, applications, and user agents. This pattern is indicative of token theft and reuse, potentially using tools like GraphRunner, where an adversary uses a stolen token to perform non-interactive actions. The rule specifically looks for a mismatch in session ID, application, and user agent between the initial interactive login and the subsequent non-interactive login, while the user and IP remain consistent. The user agent strings are specifically chosen to align with those used by the GraphRunner tool.
This rule detects attempts to retrieve the Microsoft Graph authorization policy, specifically targeting the `/policies/authorizationPolicy` endpoint. This policy contains sensitive information about who can create applications, invite guest users, and other critical settings within Entra ID (formerly Azure AD). Such requests are typically made by administrators for review or modification, and unexpected calls to this endpoint could indicate reconnaissance or unauthorized access attempts. The rule filters for successful GET requests (HTTP 200) and excludes known Azure IP ranges to reduce false positives.
This rule detects the enumeration of applications and service principals within Microsoft Entra ID (formerly Azure AD) via the Microsoft Graph API. Specifically, it looks for two sequential GET requests: one to the `/v1.0/applications` endpoint and another to the `/v1.0/servicePrincipals(appId='<GUID>')/appRoleAssignedTo` endpoint. This activity is indicative of tools like GraphRunner's Invoke-DumpApps function, which collects information about applications, external applications, and users who have consented to permissions within those applications. The rule correlates these events by IP address and session ID within a 5-minute window.
This rule identifies enumeration of user inboxes within an Entra ID tenant via the Microsoft Graph API. It specifically looks for multiple GET requests to the `/v1.0/users/*/mailFolders/Inbox/messages` endpoint from a single IP address and session within a 5-minute window. The detection is based on the behavior of tools like Invoke-GraphOpenInboxFinder in GraphRunner, but is applicable to any tool performing similar inbox scanning. The rule provides outcomes detailing the number of scanned users, successful accesses (HTTP 200), forbidden accesses (HTTP 403), and not found inboxes (HTTP 404).
This rule detects multiple failed attempts (401 Unauthorized status) to download the same file from OneDrive via the Microsoft Graph API. This behavior may indicate a permissions issue for the user attempting the download or could be an indicator of an adversary attempting to access unauthorized files.
This rule detects successful user logins to the "Azure Active Directory PowerShell" application within Entra ID (formerly Azure AD). While legitimate administrative tasks may involve this application, the rule's description highlights that programmatic access to Azure AD should generally occur through other applications. Therefore, direct logins to this specific PowerShell application could indicate suspicious activity, such as an attacker using compromised credentials to gain access to user information or perform administrative actions. The rule focuses on successful login events and groups them by user over a 5-minute window, which can help identify clustered or repeated login attempts by a single user.
This rule detects the use of the GraphRunner tool's Invoke-GraphRecon command to enumerate permissions and conditional access data within the Microsoft Graph API. It specifically looks for a sequence of three API calls: 'estimateAccess', '/me', and 'policies/authorizationPolicy' originating from the same IP address and within a 5-minute window. This activity is indicative of an attacker or red teamer performing reconnaissance on an Azure AD environment.
This rule detects when a user attempts to download multiple unique files from OneDrive via the Microsoft Graph API, and these download attempts result in a 401 Unauthorized status code. This behavior may indicate a permissions issue for the user, potentially due to misconfiguration, revoked access, or an attempt to access unauthorized resources.
Detects when mail items are accessed via API through an Entra ID application that is not explicitly approved. This rule specifically looks for 'MailItemsAccessed' events in Office 365 where the accessing application's ClientAppId does not match known legitimate Microsoft applications like Exchange Online, Substrate Context Service, or Microsoft Office. This could indicate unauthorized access to mailboxes by a suspicious application.
Page 41 of 76