Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,181 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
This rule detects HTTP 400 Bad Request errors when attempting to interact with the Microsoft Graph API's /v1.0/groups endpoint via a POST request. This specific activity can indicate a failed attempt to duplicate a group, potentially by tools like GraphRunner's Invoke-SecurityGroupCloner function. It focuses on identifying issues during group creation or modification operations within Azure AD through the Graph API.
This rule detects attempts to enumerate updatable groups within Microsoft Entra ID (formerly Azure Active Directory) using the Microsoft Graph API. Specifically, it looks for a combination of a GET request to the `/v1.0/groups` endpoint and a POST request to the `/beta/roleManagement/directory/estimateAccess` endpoint within a 5-minute window from the same IP address and session. This activity is indicative of tools like GraphRunner's `Get-UpdatableGroups` function, which adversaries might use to identify groups they can modify for privilege escalation or persistence.
This rule detects successful group deletion events within Microsoft Entra ID (formerly Azure AD). It specifically looks for audit logs where the event type is 'GROUP_DELETION', the product event type is 'Delete group', the product is 'Azure AD Directory Audit', the vendor is 'Microsoft', and the security result indicates the action was 'ALLOW'. The rule also groups these events by user over a 5-minute window.
This rule detects when an excessive number of permissions are changed for an application within Microsoft Entra ID (formerly Azure AD). While adding permissions is a normal activity, a sudden increase in the number of permissions granted to an application, exceeding a defined threshold (currently 5), could indicate malicious activity such as an attacker attempting to escalate privileges or broaden access for a compromised application. The rule specifically looks for 'Update application' events in Azure AD Directory Audit logs where the 'RequiredResourceAccess' attribute changes significantly.
This rule detects requests to the Microsoft Graph API's '/v1.0/users' endpoint with a GET method and a successful 200 response code. This API call is used to enumerate users within an Azure Active Directory environment. The rule is designed to identify potential reconnaissance activities where an attacker might be collecting a listing of users. It notes that this can be a 'chatty' API call, meaning it might generate a high volume of legitimate traffic.
This rule detects when a single user adds more than 4 members to the same Office 365 group within a 5-minute window. It specifically looks for successful 'Add member to group' events in Office 365 audit logs, focusing on the `GROUP_MODIFICATION` event type. The threshold of 4 users added is configurable.
This rule detects when a user is successfully removed from a group within Office 365. It specifically looks for 'GROUP_MODIFICATION' events with the product event type 'Remove member from group.' from Microsoft Office 365, where the action was allowed.
Detects when a GitHub application is installed within an organization. An untrusted application can be installed and granted permissions to access data within a GitHub organization.
Detects when vulnerability alerts are disabled for GitHub Dependabot.
Detects when a GitHub audit log stream is destroyed. An adversary may attempt to destroy audit logs to erase their tracks.
Page 43 of 76