Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
This rule detects when a user is assigned 'Super user' privileges within the OneLogin SSO system. It specifically looks for events where the event type is 'USER_CHANGE_PERMISSIONS', the product is 'ONELOGIN_SSO', the vendor is 'ONELOGIN', the product event type indicates a permission grant (code 72), and the target resource name is 'Super user'. This indicates a significant privilege escalation within the identity provider.
This rule detects penetration testing activity originating from known offensive security distributions like Kali Linux, Parrot Linux, or Pentoo Linux, as identified by Amazon GuardDuty. The detection is based on GuardDuty findings that specifically indicate 'PenTest' activity.
This rule detects when a user in OneLogin reveals another user's application password. This is identified by monitoring 'USER_RESOURCE_ACCESS' events from 'ONELOGIN_SSO' where the product event type is '240' (indicating an actor user revealed a password to an app for another user) and the principal user ID is different from the target user ID. This scenario suggests unauthorized access or disclosure of credentials.
Detects when an Amazon Simple Email Service (SES) configuration is modified, which could indicate an attacker attempting to propagate phishing email campaigns. This includes the creation, deletion, or verification of email identities and domains, as well as enabling sending for accounts or configuration sets.
This rule detects a successful OneLogin login event that is preceded by multiple failed One-Time Password (OTP) attempts within a 15-minute window for the same user. Specifically, it looks for at least four failed OTP challenges followed by a successful OTP verification and then a successful user login. This pattern is indicative of an OTP brute-force attack where an attacker is attempting to guess the correct OTP.
This rule detects when an AWS security group ingress rule is modified to allow traffic from any IP address (0.0.0.0/0 for IPv4 or ::/0 for IPv6). This action, captured via AWS CloudTrail's AuthorizeSecurityGroupIngress event, significantly increases the attack surface of associated resources by making them accessible from the entire internet.
This rule detects when a permission on a pre-defined watchlist is applied to an Entra ID application. It specifically looks for 'Update application.' events in Office 365 logs where the 'NewValue_EntitlementId-' or 'OldValue_EntitlementId-' labels indicate a change in application permissions. The rule leverages a watchlist named 'msgraph_watchlist_permissions' to identify sensitive or suspicious permission changes.
Detects when an excessive number of permissions are assigned to an Entra ID application within a short time window, calculated as a percentage increase from existing permissions. This could indicate a "greedy permission grab" by an attacker attempting to escalate privileges or gain broader access within the Entra ID environment. The rule specifically looks for updates to application permissions where the percentage increase of new permissions over old permissions exceeds a 70% threshold.
This rule detects targeted brute-force attacks against an Okta organization. It specifically looks for events from Okta ThreatInsight where known malicious IPs are attempting to access a specific user account, indicated by multiple failed authentication attempts for the same user within a one-hour window. The rule leverages Okta's security.attack.start event type to identify these activities.
This rule detects when a single user account (principal) assumes the identity of multiple other user accounts (targets) within the OneLogin SSO system. Specifically, it triggers if a user, identified by their `userid`, performs "USER_RESOURCE_ACCESS" events as more than 3 distinct target users within a one-hour window. This behavior can indicate an attacker attempting to gain access to multiple accounts after compromising a single set of credentials, or an insider abusing their privileges.
Page 62 of 76