Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,181 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
This detects when a 401 Unauthorized status is received on multiple attempts of the same file when attempting to download from OneDrive and may indicate a permissions issue for the user.
This detects when a 401 Unauthorized status code is returned when attempting to download multiple unique files from OneDrive and may indicate a permissions issue for the user.
Identify the use of the GraphRunner recon command Invoke-GraphRecon with the permission enum flag set, providing allowed actions and conditional access data for the current user.
Identify the enumeration of members within groups in Entra ID. This is based on GraphRunner Get-SecurityGroups function behavior so modifications may be needed for other scenarios
This detects when the groups endpoint is called in the Graph API. GraphRunner contains a function called Get-DynamicGroups but other tools may as well.
Identify when mailboxes are being accessed with requests for N number of messages
Identify the use of the user API call to collect a listing of users. This can be chatty due to other commands calling this single API.
Detects when a group is created in Office 365.
Detects when a user is added to a group in Office 365.
Detects when a group GUID in Office 365 has more users added to it by the same user than a defined thresold.
Page 47 of 76