Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
This rule detects a suspicious sequence of events: a process launching with a low prevalence executable (meaning it's rarely seen in the environment) followed by that same process initiating an HTTP connection to a low prevalence domain (a domain rarely accessed in the environment) within a 10-minute window. This combination can indicate the execution of novel or custom malware attempting to establish command and control or exfiltrate data to an unusual destination.
This rule detects when an Amazon EC2 instance or a container attempts to communicate with a black hole IP address, as reported by AWS GuardDuty. Black hole IP addresses are typically used to sinkhole malicious traffic or are unroutable, indicating potentially suspicious or misconfigured outbound communication from a compromised or misbehaving resource.
This rule detects the usage of a Google Cloud Platform (GCP) service account key from more than two distinct countries within a one-hour period. It leverages GeoIP enrichment data from Chronicle to identify the geographical origin of the IP addresses making the API calls. This behavior can indicate a compromised service account key being used by an attacker from multiple locations, potentially to evade detection or perform malicious activities across different regions.
This rule detects successful API executions within Google Cloud Platform (GCP) that originate from an IP address identified as a Tor exit node. It correlates GCP Cloud Audit logs, specifically looking for 'ALLOW' actions, with a GCTI (Google Cloud Threat Intelligence) feed that lists known Tor exit node IP addresses. The rule also calculates a risk score, with additional weight given if the originating IP is from certain high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
This rule detects suspicious connections to the ADFS database via named pipes. It specifically looks for processes connecting to the `\\MICROSOFT##WID\tsql\query` named pipe on ADFS servers, excluding legitimate ADFS-related processes such as `Microsoft.Identity.Health.Adfs.PshSurrogate.exe`, `Microsoft.IdentityServer.ServiceHost.exe`, `AzureADConnect.exe`, `Microsoft.Tri.Sensor.exe`, `wsmprovhost.exe`, `mmc.exe`, `sqlservr.exe`, and `sqlwriter.exe`. Such connections from unauthorized processes may indicate an attempt to access ADFS for malicious purposes.
Detects when an AWS Application Load Balancer (ALB) listener is created or modified to use an insecure SSL policy. Insecure SSL policies can expose communication to vulnerabilities such as weak ciphers or outdated TLS versions, potentially allowing attackers to decrypt sensitive data or perform downgrade attacks. The rule specifically looks for the use of several known insecure or deprecated ELBSecurityPolicy versions during 'ModifyListener' or 'CreateListener' CloudTrail events.
This rule detects when an AWS region is enabled or disabled. Adversaries may enable new regions to create resources in an unmonitored environment or disable regions to disrupt services or evade detection. This activity is captured through AWS CloudTrail events for 'EnableRegion' or 'DisableRegion'.
Detects when a user creates or updates a login profile for another user in AWS IAM and then the newly created/modified user logs in from the same IP address. This behavior can indicate privilege escalation where an attacker gains access to an existing user's credentials, creates a new login profile or modifies an existing one for another user, and then uses that new profile to log in, potentially escalating their privileges or maintaining persistence.
This rule detects multiple failed login attempts from different users originating from the same IP address within a one-hour window in Okta. It specifically looks for events where the login attempt was blocked due to invalid credentials. The rule also incorporates risk scoring based on Okta ThreatInsight detections and behavioral patterns like new geo-location, device, or IP, as well as logins from unauthorized geographies (Cuba, Iran, North Korea, Russia, Syria). The detection is triggered if more than 5 distinct user IDs attempt to log in with invalid credentials from the same IP within the specified timeframe.
Detects a successful attempt to retrieve service API Keys within Google Cloud Platform. This activity could indicate an attacker attempting to gain access to sensitive credentials for further malicious actions.
Page 59 of 76