Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,181 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
GraphRunner contains a function that forges UA strings. The UA strings below are found in that function. Can be used for other UA strings if desired
Identify the use of the application API call to collect a listing of applications in Entra ID. This can be chatty due to other commands calling this single API.
Identify a 400 bad request to the groups endpoint in the MS Graph API. GraphRunner's Invoke-SecurityGroupCloner function will trigger this if it fails to duplicate a group.
Identify a successful group creation. Triggered through the use of GraphRunner's Invoke-SecurityGroupCloner function.
This detects when the search/query endpoint is called which can be used for enumeration of items like SharePoint site URLs. GraphRunner contains a function called Get-SharePointSiteURLs but other tools may as well.
Identify enumeration of inboxes across the Entra ID tenant. This detection is based on the Invoke-GraphOpenInboxFinder in GraphRunner but the concepts are applicable to other tools that scan for accessible inboxes.
Identify the enumeration of both the users and members of groups in the Entra ID tenant. While these are two separate functions in GraphRunner, they are often run in support of one another.
Detects when a group is deleted.
This rule identifies changes to SAML (Security Assertion Markup Language) provider configurations within Google Workspace. Monitoring these changes is crucial for security teams as modifications to SAML configurations can potentially weaken an organization's security posture, leading to unauthorized access or other security incidents. The rule specifically looks for events categorized as 'SAML2_SERVICE_PROVIDER_CONFIG_SETTINGS' or with product event types matching 'SAML2_SERVICE_PROVIDER_CONFIG'.
Detects API calls originating from AWS accounts that are not part of the organization, based on a reference list of approved AWS account IDs. This could indicate unauthorized access or activity from external entities.
Page 49 of 76