Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,181 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects when an Okta user rejects more than 2 Push notifications in a 10 minute window. This behavior can indicate an attacker attempting to gain access to an account by repeatedly sending MFA push notifications, hoping the user will eventually accept one (MFA fatigue).
Detects when Google Cloud Audit logs are removed from all services at either the project or organization level. This action can indicate an adversary attempting to impair defenses by disabling logging to hide their activities.
This rule detects when highly privileged administrative roles, specifically 'Owner' or 'Editor', are assigned to a service account within Google Cloud Platform. This activity is significant because service accounts with such elevated permissions can be leveraged by attackers for persistence, privilege escalation, and to perform a wide range of actions within the GCP environment, potentially leading to compromise of cloud resources.
This rule detects when a Google Cloud Platform (GCP) BigQuery dataset's access policy is modified to include 'allUsers' or 'allAuthenticatedUsers'. This action effectively makes the dataset publicly accessible, which can lead to unauthorized data exposure and potential data exfiltration. The rule specifically looks for 'IAMPolicy.SetIamPolicy' events on BigQuery resources where a binding delta adds a role (e.g., 'roles/bigquery.dataViewer') to either 'allUsers' or 'allAuthenticatedUsers'.
This rule identifies when a new domain is added to the list of trusted domains within Google Workspace. An adversary might leverage this capability to establish trusted relationships, potentially manipulating sharing settings to gain unauthorized access to sensitive organizational files and folders.
This rule detects when multiple HMAC (Hash-based Message Authentication Code) authentication keys are deleted from Google Cloud Storage settings within a one-hour window by the same user. HMAC keys are used for programmatic access to Cloud Storage, and their deletion can indicate an attempt to disrupt legitimate access, cover tracks, or impact service availability.
This rule detects when a single user generates an excessive number of 'Permission Denied' events within a one-hour timeframe in Google Cloud Platform (GCP). Specifically, it looks for more than 5 'BLOCK' actions with a severity of 'ERROR' and a status code of '7' (which typically indicates 'Permission Denied' in GCP API errors) from a single user. Additionally, it requires these events to span across more than one target application and more than one product event type, which helps to reduce false positives by indicating broader activity rather than a single, isolated error.
This rule detects a successful Okta login that occurs after multiple failed MFA push notifications within a 15-minute window. It correlates 'system.push.send_factor_verify_push' events (representing MFA push attempts) with a subsequent 'user.authentication.auth_via_mfa' event (representing a successful MFA authentication and login). The rule specifically looks for more than 4 MFA push attempts followed by a successful login, indicating a potential MFA brute-force or push fatigue attack.
This rule detects when a Google Cloud Platform (GCP) Identity and Access Management (IAM) Organization Policy is either updated or deleted. Such actions can indicate an attempt to modify security controls, potentially to facilitate persistence or privilege escalation within the GCP environment. Monitoring these changes is crucial for maintaining the security posture of an organization's cloud resources.
Detects successfully authenticated user logins to Okta based on Okta's Behavior Detection pattern analysis, specifically looking for high-risk indicators such as new geo-location, new device, new IP, new city, new state, new country, or velocity anomalies. It also flags logins originating from unauthorized target geographies like Cuba, Iran, North Korea, Russia, and Syria. The rule only applies to existing users, not newly created ones.
Page 50 of 76