Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects when an IAM user attempts to update or modify the code of an AWS Lambda function. This activity can be indicative of an attacker trying to introduce malicious code, backdoor existing functions, or alter their behavior for persistence, privilege escalation, or other malicious purposes.
This rule detects a successful login to the AWS console after multiple failed login attempts for the same user within a 15-minute window. It specifically looks for at least three failed authentication attempts followed by one successful authentication. The rule also calculates a risk score based on potential country mismatches between failed and successful attempts, and successful logins from unauthorized geographies (Cuba, Iran, North Korea, Russia, Syria).
This rule detects when an Entra ID application has a significant increase in the number of assigned permissions within a short timeframe (5 minutes). This could indicate a "greedy permission grab" by an attacker attempting to escalate privileges or gain broader access to resources. The rule specifically looks for an increase of more than 8 permissions compared to the previous state. It does not compare the specific permissions, only the count.
Detects when an AWS IAM user creates an AWS Access Key for programmatic calls. This action can be used by adversaries to establish persistence or escalate privileges within an AWS environment.
This rule generates alerts based on Google Workspace Alerts Center data and aggregates them by severity. It processes events from 'Google Workspace Alerts' and assigns a risk score based on the severity of the alert (LOW, MEDIUM, HIGH). The rule also extracts various details from the alerts such as event count, event type, product event type, security category details, security category, security investigation tool link, security summary, and alert severity.
This rule identifies when a user shares a file from Google Drive with an email address belonging to a common free email domain (e.g., gmail.com, aol.com, hotmail.com, outlook.com, icloud.com). This activity is flagged as it may indicate an attempt at data exfiltration, where sensitive information is moved outside the organization's controlled environment to personal or untracked accounts.
This rule detects an unusual number of failed authentication attempts from the same IP address targeting valid users within an AWS environment. It specifically looks for 'ConsoleLogin' events from AWS CloudTrail where the security result indicates a 'BLOCK' action due to 'Failed authentication'. The rule triggers if there are more than 5 distinct target users experiencing failed logins from the same IP within a 5-minute window. Additionally, it calculates a risk score based on whether the source IP's country of origin is associated with known high-risk geographies (Cuba, Iran, North Korea, Russia, Syria).
This rule detects when a single user downloads results from multiple BigQuery tables within a one-hour window. This behavior can be indicative of data exfiltration attempts, where an attacker or insider is trying to extract a large amount of data from an organization's data warehouse.
This rule detects when a single user disables multiple Google Cloud Platform (GCP) Service APIs within a short period (1 hour). Specifically, it triggers if a user performs more than 5 'DisableService' actions on 'serviceusage.googleapis.com' within an hour. This activity could indicate an attempt to disrupt cloud services or evade detection by disabling security-related APIs.
This rule identifies when multi-factor authentication (MFA) is disabled for a Google Workspace organization. This change can weaken the organization's security posture by removing an important layer of defense against unauthorized access. Security teams should monitor for such changes to prevent potential account compromise.
Page 53 of 76