Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects when a high number of failed authentication attempts occur for unknown users on AWS, indicating a potential brute-force or credential stuffing attack against the AWS console.
This rule detects when a single user disables or destroys 10 or more Google Cloud KMS (Key Management Service) crypto key versions within a one-hour period. This activity could indicate an attacker attempting to destroy data encrypted by these keys, leading to data unavailability or integrity issues. The rule specifically looks for 'DestroyCryptoKeyVersion' events or 'UpdateCryptoKeyVersion' events where the key version state is changed to 'DISABLED'.
This rule identifies when a new application from the Google Workspace Marketplace is added to a Google Workspace organization. Installing certain third-party applications can introduce security risks such as data exfiltration, data leakage, or an expanded attack surface for the organization.
This rule identifies when an encryption key file is accessed (downloaded, viewed, or copied) by an anonymous user in Google Drive. This activity could indicate an adversary attempting to gain access to sensitive encryption keys before moving laterally or compromising data.
This rule identifies a suspicious sequence of events within Google Workspace. Specifically, it triggers when a user successfully logs in under suspicious circumstances (indicated by the 'is_suspicious' label) and subsequently downloads a file from Google Drive. The rule correlates these two events by the user ID and ensures the download occurs after the suspicious login, within a 1-hour window.
Detects when the AWS managed policy 'AWSCompromisedKeyQuarantine' is attached to an IAM user, role, or group. This policy is typically applied by AWS when credentials for an IAM entity are suspected of being compromised or publicly exposed, indicating a potential security incident.
This rule detects successful AWS API calls originating from an IP address identified as a Tor exit node. It leverages a GCTI Feed for Tor exit node IP listings and also calculates a risk score based on the geographical location of the originating IP, specifically increasing the score for connections from Cuba, Iran, North Korea, Russia, and Syria.
This rule identifies when an external user account is added to a group within Google Workspace. This detection helps security teams monitor for unauthorized or unexpected additions of external users to internal groups, which could lead to unauthorized access to sensitive data or resources. The rule works by comparing the domain of the group with the domain of the user being added; if they differ, it indicates an external user is being added.
This rule identifies potential data exfiltration attempts where a user sends multiple files (more than 10) from Google Drive as email attachments to free email domains (e.g., gmail.com, aol.com, hotmail.com, outlook.com, icloud.com) within a one-hour window. This behavior can indicate an adversary attempting to move sensitive data out of the organization's controlled environment.
This rule identifies when a Google Workspace user account is moved between Organizational Units (OUs). This activity can be a legitimate administrative action, but it can also be used by an attacker to move a compromised account to an OU with different policies, potentially granting them more privileges or evading existing security controls. For example, an attacker might move an account to an OU with less stringent multi-factor authentication requirements or different access policies to sensitive data.
Page 52 of 76