Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
This rule detects failed authentication attempts in Okta where the security result indicates a "FastPass declined phishing attempt." This specifically targets real-time Adversary-in-the-Middle (AiTM) phishing proxy attacks against users enrolled in Okta FastPass, which is designed to prevent such attacks by checking the origin of the authentication request.
This rule identifies when a single user downloads multiple files from Google Drive within a one-hour window. This behavior can be indicative of data exfiltration attempts, where an attacker or malicious insider is trying to extract sensitive information from the organization's Google Drive storage. The rule specifically looks for 'download' events from the 'Google Workspace' vendor and 'drive' product, and triggers an alert if more than 10 distinct files are downloaded by the same user within the specified timeframe.
Detects when a user deletes multiple secrets or secret versions from Google Cloud Platform (GCP) Secret Manager within a one-hour period. This activity could indicate an attempt to destroy critical data or disrupt services.
Detects when a user's account in Okta is locked out or has reached the lockout limit, indicating potential brute-force attempts or suspicious login activity. The rule specifically looks for 'user.account.lock.limit' or 'user.account.lock' events where the security result action is 'BLOCK'.
This rule detects when an AWS Config Service is modified, stopped, or deleted. Specifically, it looks for CloudTrail events indicating actions such as stopping or deleting a configuration recorder, deleting a delivery channel, or putting (creating/updating) a delivery channel or configuration recorder. These actions can be indicative of an adversary attempting to impair defenses by disabling or modifying cloud logging capabilities.
This rule detects when a Google Cloud Platform (GCP) Compute Engine image's access policy is modified to include 'allAuthenticatedUsers'. This action effectively makes the image publicly accessible to any authenticated Google user, which could lead to unauthorized access or data exfiltration if sensitive data is present in the image.
This rule detects when a user bypasses Chrome Safe Browsing warnings for potentially dangerous content or downloads. It specifically looks for events where Chrome Management reports a bad navigation event, dangerous download event, content transfer event, or unscanned file event, and the security result indicates the event was 'BYPASSED' by the user. The rule also assigns a risk score based on the category of the bypassed threat, with higher scores for malware, dangerous hosts, and social engineering.
This rule identifies when a custom administrator role is created within Google Workspace. Monitoring such events is crucial for security teams to detect and prevent unauthorized access to data that could result from malicious or accidental configuration of administrator privileges.
This rule detects when an AWS account attempts to leave an AWS organization or is removed from an AWS organization. This activity can indicate an adversary attempting to evade detection or disrupt cloud infrastructure by isolating an account from central management and security policies.
This rule detects successful logins to the AWS console where Multi-Factor Authentication (MFA) was not used. It specifically looks for 'ConsoleLogin' events from AWS CloudTrail with an 'ALLOW' action and where 'MFAUsed' is explicitly set to 'No'. The rule also increases the risk score if the login is performed by a 'Root' user.
Page 51 of 76