Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
This rule identifies when the password policy configuration is changed within Google Workspace. Monitoring these changes is crucial for security teams to detect potential weakening of the organization's security posture, which could be exploited by adversaries to maintain or elevate access.
This rule detects an excessive number of 'AccessDenied' events within a one-hour timeframe originating from a single AWS IAM user. This behavior can indicate an adversary attempting to discover cloud infrastructure and resources by making numerous API calls that they do not have permissions for. The rule specifically looks for more than 5 'AccessDenied' events, involving more than one target application and more than one product event type, from the same user within an hour.
This rule detects when an AWS S3 bucket's Access Control List (ACL) is modified to make the bucket publicly accessible. Specifically, it looks for `PutBucketAcl` events in AWS CloudTrail where the grantee URI is set to either "AuthenticatedUsers" (meaning any AWS user can access it) or "AllUsers" (meaning anyone on the internet can access it). This action indicates a potential misconfiguration or malicious activity leading to data exposure.
Identifies when a user deletes multiple files from Google Drive within a one-hour period. This activity may indicate an attempt at data destruction or an insider threat activity.
This rule identifies when a Google Workspace user shares a file on Google Drive shortly after a suspicious login event has occurred. It correlates a successful login event flagged as suspicious with subsequent Google Drive file sharing activities (changing user access, document visibility, access scope, or ACL editors) by the same user within a one-hour window. This behavior could indicate an attacker gaining access to an account and then exfiltrating data.
This rule detects modifications to the user data script of an EC2 instance in AWS. User data scripts are executed when an EC2 instance is launched and can be used to perform initial setup, install software, or run other commands. An adversary modifying this script could achieve persistence or privilege escalation by injecting malicious commands that run upon the next instance boot.
This rule detects when AWS CloudTrail logging configurations are modified, stopped, or deleted. Specifically, it looks for API calls such as 'UpdateTrail', 'StopLogging', 'DeleteTrail', or 'PutEventSelectors' that indicate an attempt to tamper with CloudTrail's ability to record events. Such actions could be performed by an adversary to evade detection by hiding their activities.
This rule detects an excessive number of successful AWS API calls related to discovery activities (e.g., Describe*, List*, Get*) originating from a single IAM user within a 5-minute timeframe. This behavior can indicate an adversary attempting to map out the cloud environment after gaining initial access.
This rule identifies when a user account is unsuspended within Google Workspace. Unsuspending an account can be a legitimate administrative action, but it can also indicate an adversary reactivating a previously disabled account to regain access or enable further malicious activity. Monitoring this activity is crucial for detecting potential account takeover or persistence mechanisms.
Detects when an AWS CloudWatch log group is deleted. This activity can be an indicator of an adversary attempting to impair defenses by removing or modifying logging capabilities to hide their actions.
Page 54 of 76