Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects when a user removes an authentication factor or OTP device within OneLogin. This action can weaken security by removing a layer of multi-factor authentication, potentially making the account more vulnerable to compromise.
This rule detects successful user authentications to Okta that occur outside of typical business hours or on weekends. It specifically flags logins on Saturdays and Sundays, and logins between 8 PM and 7 AM UTC on weekdays. The rule calculates a risk score based on the day and time of the login, with higher scores for weekend logins and late-night/early-morning logins.
This rule detects suspicious user login activity where a single user attempts to log in from multiple distinct countries within a 24-hour period. This behavior can indicate a compromised account being used by an attacker from a different geographic location than the legitimate user, or a user attempting to bypass security controls. The rule also assigns a higher risk score if the login originates from specific high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
Domain Prevalence
YARA-L
Detects DNS events querying domains that have a low rolling max prevalence.
Detects excessive PermissionDenied events within an hour timeframe from a user
Detects when an excessive number of permissions are assigned to an Entra ID application within a time window, potentially indicating a greedy permission grab, as a numeric value comparing old permissions to new permissions
DNS query to a recently created domain
Identifies when a Google Workspace user downloads a file from Google Drive after a suspicious login event occurred.
Detect when GCP Cloud Audit logs are removed from all services at project or organization level. Audit logging helps organizations maintain security and minimize risk.
Detect when multiple HMAC authentication keys are deleted from GCP Storage settings.
Page 63 of 76