Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,181 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects when a user is removed from a group in Office 365.
Detect mail items accessed via API through an unapproved Entra ID application.
Detects when a user is removed from a group in Microsoft Teams.
Detects and alerts on users bypassing Chrome Safe Browsing warnings and accessing potentially dangerous content or downloads
Application creation can be legitimate but aren't frequently created. Validating application creation may be appropriate to ensure rogue apps aren't being created.
Delete Entra ID application. This is a soft delete, can still be recovered.
Deletion of Entra ID application with no recovery of the application.
Entra ID application was restored. This implies a soft delete was performed at some point but less than 30 days ago.
Adding permissions to an application is expected, however if excessive permissions are changed at one time over a defined threshold, it may be worth validating.
Detects when a group is deleted.
Page 48 of 76