Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects usage of service account key from multiple countries using Chronicle GeoIP enrichment.
Detects when a service account key is created in or uploaded to a monitored Google Cloud project.
Identifies when Google Workspace password policy is changed. Security teams can monitor for changes to password policy configuration that may weaken the organization's security posture.
Detects when an AWS region is enabled or disabled.
Amazon GuardDuty detects penetration testing activity from known offensive security distros such as KaliLinux, ParrotLinux or PentooLinux.
Detect when GCP Compute Image is opened to public by adding allAuthenticatedUsers to the access policy.
Detect when Google Cloud Storage buckets are opened to public by adding allUsers or allAuthenticatedUsers to the access policy.
Suspicious ASN
YARA-L
Identify network traffic based on a specific ASN
Okta provides a platform detection for when a user enrolled in FastPass fails to authenticate via a real-time AiTM phishing proxy.
Okta ThreatInsight detects access requests from known malicious IPs targeting a specific org.
Page 64 of 76