Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detect when GCP Cloud Audit logs are exempted for principals in all services at project or organization level. Audit logging helps organizations maintain security and minimize risk.
Detect when free Google Email addressess are added to IAM Policy such as gmail.com, googlemail.com or googlegroups.com.
Detects when an excessive number of permissions are assigned to an Entra ID application within a time window, potentially indicating a greedy permission grab, as a percentage from old permissions to new permissions
Detects creation and movement of .lnk files to specific folders
Suspicious ASN Watchlist
YARA-L
Identify any network connections to a list of ASNs
Detects multiple user logins with invalid credentials from a single IP.
Detects successfully authenticated user logins based on Okta's Behavior Detection pattern analysis.
An Okta user reports suspicious activity in response to an end user security notification.
Detects a successful login after multiple failed OTP intents
Detects when a user removes an authentication factor or otp device.
Page 66 of 76