Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,181 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects when the visibility for a GitHub repository is changed to public.
Detects when a secret is found in a GitHub repository. Adversaries may attempt to harvest leaked/exposed secrets to further infiltrate their target's environment, maintain access, or steal data.
Detects when changes are made to a GitHub enterprise or organization's Single Sign-On (SSO) configuration.
Detects when a user is blocked from accessing repositories within a GitHub organization.
Detects when a user is unblocked from accessing repositories within a GitHub organization.
This rule detects the hard deletion of an application within Entra ID (formerly Azure AD). A 'hard delete' means the application is permanently removed without a recovery option, which can indicate malicious activity such as an attacker attempting to remove traces of their presence or disrupt services by deleting critical applications.
This rule detects successful events where a user is added to a group within Office 365. It specifically looks for 'GROUP_MODIFICATION' events with the product event type 'Add member to group.' originating from 'Office 365' by 'Microsoft' where the security action was 'ALLOW'. The rule also identifies the user performing the action, the group name, group GUID, and the user who was added to the group.
This rule detects when an application in Entra ID (formerly Azure AD) is restored. This action implies that the application was previously soft-deleted and is now being recovered. This could be an administrative action to recover a mistakenly deleted application or could indicate an attempt to restore a malicious application that was previously removed.
This rule detects when an application is deleted in Entra ID (formerly Azure AD). This action is a soft delete, meaning the application can still be recovered. Detection is based on specific event types and product names within Azure AD audit logs.
Detects when a group is successfully deleted in Office 365. This rule specifically looks for events where the event type is 'GROUP_DELETION', the product event type is 'Delete group.', the product is 'Office 365', the vendor is 'Microsoft', and the security result action is 'ALLOW'. It also tracks the user responsible for the deletion.
Page 45 of 76