Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects user logins for same user from different cities within 24 hours.
Identifies when a user sends multiple files from Google Drive as an email attachment to a free email domain, which may indicate data exfiltration.
Identifies when a user account is unsuspended in Google Workspace.
Detects API Calls from AWS accounts that are not part of the organization.
Detects when AWS API Gateway keys are accessed.
Detects when a CloudWatch log group is deleted.
Detects when a GuardDuty Detector's publishing destination has been deleted which will prevent the exporting of findings.
Detects when a GuardDuty Detector's trusted or threat intel IP lists are deleted or disabled.
Detects when an Amazon RDS Snapshot is shared publicly.
Detect when GCP BigQuery datasets are opened to public by adding allUsers or allAuthenticatedUsers to the access policy.
Page 65 of 76