Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
This rule identifies outbound network connections to a specific Autonomous System Number (ASN). The rule is designed to detect suspicious network traffic that might indicate command and control activity, data exfiltration, or other malicious communications originating from the monitored environment to an ASN that has been deemed suspicious. The specific ASN to monitor is configured within the rule.
This rule detects DNS queries for domains that contain a specific string (e.g., a company name) and are not registered with an approved domain registrar. It leverages WHOIS data to identify potentially malicious typosquatting domains that have been recently registered or observed. The rule specifically looks for DNS queries where the domain name matches a defined pattern (e.g., 'threatpunter') and the WHOIS information indicates a registrar other than the approved one ('MarkMonitor Inc.'). Additionally, it checks if the domain was first seen in the environment within the last 30 days, indicating a new or suspicious registration.
Detects when an Amazon EC2 AMI (Amazon Machine Image) or Snapshot is modified to be shared publicly. This action can lead to sensitive data exposure or provide adversaries with a way to exfiltrate data by sharing it with an 'all' group, making it accessible to anyone.
This rule detects brute force activity targeting Amazon EC2 or Amazon RDS instances, as reported by AWS GuardDuty. It specifically looks for GuardDuty findings where the product event type contains 'BruteForce' and filters out sample findings.
This rule detects when Amazon GuardDuty identifies an Amazon EC2 instance or a container querying algorithmically generated domains (DGA). DGA activity is often indicative of malware attempting to establish command and control (C2) communication with its operators. The rule specifically looks for GuardDuty findings with the product event type 'DGADomainRequest' and filters out sample findings.
This rule detects when Security Command Center services are disabled in Google Cloud Platform (GCP). Disabling Security Command Center can impair an organization's ability to detect security threats and vulnerabilities, making it a critical security event. The rule specifically looks for 'RESOURCE_WRITTEN' events in GCP Cloud Audit logs where the product event type indicates an update to Security Command Center settings, the target application is 'securitycenter.googleapis.com', and the 'service_enablement_state' label is set to 'DISABLED'.
This rule detects when an Okta end-user reports suspicious activity on their account. This could indicate that the user's account has been compromised or is being targeted by an attacker. The rule specifically looks for the 'user.account.report_suspicious_activity_by_enduser' event type in Okta logs. The risk score is increased if the suspicious activity event type is related to an MFA enrollment notification being sent, suggesting a potential attempt to enroll an unauthorized MFA device.
Detects when a single user successfully logs into Okta from multiple distinct cities within a 24-hour period. This behavior can indicate a compromised account being used by an attacker from a different geographical location than the legitimate user, or a user traveling rapidly between distant locations. The rule also incorporates risk scoring based on Okta ThreatInsight and logins from suspicious countries.
This rule detects multiple failed login attempts from different users originating from the same IP address within a one-hour window in OneLogin. It specifically looks for 'USER_LOGIN' events with a 'BLOCK' security result and a product event type of '6' (user failed authentication). The rule also calculates a risk score, which is increased if the originating IP address is from certain unauthorized geographies (Cuba, Iran, North Korea, Russia, Syria). This behavior is indicative of potential brute-force attacks or credential stuffing attempts against multiple user accounts from a single source.
This rule detects DNS queries for domains that have a very low rolling maximum prevalence (3 or less over a 10-day period). This can indicate newly registered domains, domains used for command and control, or other suspicious activity that has not yet gained widespread legitimate use. The rule correlates DNS events with derived prevalence data to identify these low-prevalence domains.
Page 60 of 76