Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
This rule detects a potential Okta push fatigue attack or a mismatch between the source of an Okta Verify push request and the subsequent authentication response. It correlates an Okta push notification event (system.push.send_factor_verify_push) with an Okta authentication event (user.authentication.auth_via_mfa) where both events share the same parent session ID. The rule specifically looks for push requests that Okta has flagged with 'New Device=POSITIVE' and 'New IP=POSITIVE' in the security result description, indicating an unusual access attempt, followed by a successful MFA authentication via Okta Verify Push. The outcome section calculates a risk score based on various security result descriptions from Okta's behavior detection (e.g., New Geo-Location, New Device, New IP, Velocity) and attempts from unauthorized target geographies.
This rule detects suspicious Okta login attempts where a stolen web session cookie might be reused. It specifically looks for a single user (identified by `userid`) attempting to log in from multiple distinct IP addresses AND from multiple distinct browsers or operating systems within a one-hour window. This behavior is indicative of an adversary attempting to bypass authentication mechanisms by replaying a stolen session cookie from a different device or location.
This rule detects when an Amazon RDS Snapshot is shared publicly. This action can lead to sensitive data exposure if the snapshot contains confidential information. The detection is based on AWS CloudTrail logs, specifically looking for 'ModifyDBSnapshotAttribute' or 'ModifyDBClusterSnapshotAttribute' events where the 'Request Parameters Values To Add' includes 'all' and 'Request Parameters Attribute Name' is 'restore'. This indicates an attempt to make the snapshot publicly restorable.
This rule detects when a Google Cloud Storage bucket's access policy is modified to allow public access. This occurs when 'allUsers' or 'allAuthenticatedUsers' are added to the bucket's permissions, granting broad access to its contents. Such a configuration can lead to unintended data exposure and is a significant security risk.
Detects when an AWS Key Management Service (KMS) key is disabled or scheduled for deletion. This activity can indicate an attempt to disrupt services, destroy data, or hinder forensic analysis by making encrypted data inaccessible.
This rule detects when an AWS user successfully authenticates to the AWS console from more than one unique IP address within a 5-minute window. This behavior can indicate a compromised account being accessed from multiple locations, potentially by different attackers, or by an attacker using a VPN/proxy service that rapidly changes IP addresses. The rule also includes an outcome that calculates a risk score based on successful logins originating from specific high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
This rule detects Denial of Service (DoS) activity originating from an Amazon EC2 instance, as identified by AWS GuardDuty. It specifically looks for GuardDuty findings where the product event type indicates a DenialOfService event and filters out any sample findings.
This rule identifies outbound network connections to Autonomous System Numbers (ASNs) that are present in a predefined watchlist named 'suspicious_asn'. It leverages geo-IP enrichment to extract the ASN of the target IP address and compares it against the watchlist. The rule is designed to detect communication with potentially malicious or suspicious network infrastructure.
This rule detects multiple login failures from the same IP address targeting unknown users, as identified by Okta's ThreatInsight. It specifically looks for Okta events categorized as 'USER_UNCATEGORIZED' and 'security.threat.detected' with a summary indicating 'Login failures with high unknown users count'. The rule also incorporates risk scoring based on whether the IP address is deemed suspicious by Okta ThreatInsight and if the login attempts originate from certain high-risk countries.
This rule detects DNS queries to domains that have been created within the last 30 days. This behavior can be indicative of newly registered malicious domains used for command and control, phishing, or other adversarial activities. The rule correlates DNS query events with WHOIS data to identify the domain creation time.
Page 58 of 76