Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects when an AWS Backup Plan or Backup Selection is deleted. This activity can indicate an adversary attempting to inhibit system recovery by removing backup configurations, potentially as a precursor to data destruction or encryption for impact.
Detects a successful attempt to retrieve the encrypted Administrator password for a Windows EC2 instance using the GetPasswordData API call in AWS CloudTrail. This action indicates an adversary is attempting to gain access to credentials for a Windows virtual machine.
Detects AWS IAM activities originating from an EC2 instance that could be used to retain access or escalate privileges. This includes actions like creating users, attaching policies, creating/updating login profiles, creating access keys, creating groups, and creating roles.
Detects attempts to disable multi-factor authentication for an AWS IAM user by monitoring AWS CloudTrail events for 'DeleteVirtualMFADevice' or 'DeactivateMFADevice' actions. This could indicate an adversary attempting to maintain persistent access or bypass MFA for compromised accounts.
Detects when the S3 Public Access Block configuration has been removed from an AWS S3 bucket or an entire AWS account. This action can significantly increase the risk of public exposure for S3 objects, potentially leading to data breaches or unauthorized access. The rule specifically looks for `DeleteAccountPublicAccessBlock`, `DeleteBucketPublicAccessBlock` events, or `PutBucketPublicAccessBlock`/`PutAccountPublicAccessBlock` events where all public access blocking attributes (`RestrictPublicBuckets`, `BlockPublicPolicy`, `BlockPublicAcls`, `IgnorePublicAcls`) are set to false or are missing, indicating a removal or weakening of the public access block.
Detects when AWS VPC Flow Logs are deleted. This action can be an attempt by an adversary to impair defenses by removing or modifying logging capabilities to avoid detection of their activities.
This rule detects potential lateral movement within an AWS environment where an IAM session token, obtained via `GetSessionToken`, is subsequently used from a different IP address than where it was initially requested. This behavior can indicate an attacker has compromised credentials and is attempting to use them from a new location.
This rule detects cryptocurrency mining activity within Amazon EC2, AWS Lambda, or Amazon EKS Runtimes, as reported by AWS GuardDuty. It specifically looks for GuardDuty findings related to 'CryptoCurrency', 'CryptoMinerExecuted', or 'BitcoinDomainRequest' and filters out sample findings.
This rule detects when an Okta user fails a number challenge during a push notification for multi-factor authentication. This specific failure occurs when the user provides an invalid response to the number challenge, leading to the authentication attempt being blocked. This could indicate an attacker attempting to gain access to an account by repeatedly sending MFA push notifications, hoping the user will eventually accept or incorrectly respond to the challenge.
This rule identifies when the Google Workspace Marketplace allowlist is configured to allow users to install and run any applications from the Marketplace. This configuration may increase an organization's risk of data exfiltration/leakage and expand its attack surface by permitting the use of potentially malicious or unapproved third-party applications.
Page 56 of 76