Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
This rule detects when an AWS IAM Access Analyzer is deleted. Deleting an Access Analyzer can be a defense evasion technique, as it removes a critical security monitoring tool that helps identify unintended external access to resources. An adversary might delete it to obscure their activities or prevent detection of misconfigurations they introduce.
Detects when principals are exempted from GCP Cloud Audit logs at either the project or organization level. This action can significantly impair an organization's ability to monitor security events and maintain compliance, as audit logs are crucial for detecting malicious activity and ensuring accountability. The rule specifically looks for 'SetIamPolicy' events targeting 'cloudresourcemanager.googleapis.com' where audit log exemptions are added for 'allServices'.
This rule detects when free Google email addresses (gmail.com, googlemail.com, or googlegroups.com) are added to an IAM policy in Google Cloud Platform. This activity is suspicious as it could indicate an attempt by an attacker to establish persistence or escalate privileges by granting access to an external, potentially untraceable, account.
This rule identifies when a single user copies a large number of files from Google Drive within a one-hour period. This behavior can be indicative of data exfiltration attempts, where an attacker or malicious insider is trying to move sensitive data out of the organization's control. The rule specifically looks for 'copy' or 'source_copy' events within Google Workspace Drive logs and triggers if more than 10 distinct documents are copied by the same user in an hour.
This rule identifies when a Google Workspace user transfers the ownership of a file within Google Drive. This activity is logged as a 'CREATE_DATA_TRANSFER_REQUEST' event in the Google Workspace admin logs, specifically categorized under 'USER_SETTINGS'. This could indicate an attempt to move sensitive data to a different account, potentially for exfiltration or to obscure ownership.
This rule detects when a Google Cloud Workload Identity Pool is either disabled or deleted. Workload Identity Pools are used to manage external identities (e.g., from AWS, Azure, or on-premises identity providers) that need to access Google Cloud resources. Disabling or deleting a Workload Identity Pool will immediately revoke access for all federated identities associated with that pool, potentially leading to a denial of service for legitimate users or indicating an attempt by an attacker to disrupt operations or remove traces of their access. The rule specifically looks for the 'google.iam.v1.WorkloadIdentityPools.DeleteWorkloadIdentityPool' event or an 'google.iam.v1.WorkloadIdentityPools.UpdateWorkloadIdentityPool' event where the 'req_identityPool_disabled' attribute is set to 'true'.
This rule detects when a new service account key is either created within a monitored Google Cloud project or uploaded to it. This activity is significant because service account keys grant programmatic access to Google Cloud resources and can be used for persistence by adversaries if compromised or maliciously created.
Detects the registration of a new Multi-Factor Authentication (MFA) method for an AWS user. This can be an indicator of an attacker attempting to maintain persistence or bypass existing MFA controls by registering their own MFA device.
This rule detects suspected brute force attacks against Okta accounts. It triggers when Okta ThreatInsight identifies multiple login failures from the same IP address across one or more Okta organizations. The rule also increases the risk score if the IP address is marked as suspicious by Okta ThreatInsight or if the login attempts originate from specific high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
Detects multiple failed requests to access different applications within a short timeframe from the same network session. This could indicate an adversary attempting to bypass authentication mechanisms, potentially using stolen session cookies or brute-forcing access to various applications after an initial compromise. The rule also incorporates risk scoring based on behavioral anomalies (e.g., new geo-location, new device, new IP) and access attempts from high-risk countries.
Page 55 of 76