Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects when a low prevalence hash is seen during a process launch event, and a low prevalence domain is accessed within 10m.
Generates alerts based on Google Workspace alerts center and aggregates them based on severity.
Identifies when a Marketplace app is added in a Google Workspace organization. Installing certain apps may increase the organization's risk of data exfiltration/leakage and increase its attack surface.
Identifies when the Google Workspace Marketplace allowlist is configured to allow users to install and run any apps from the Marketplace. Allowing users to install and run any apps may increase the organization's risk of data exfiltration/leakage and increase its attack surface.
Identifies when a user deletes multiple files from Google Drive, which may indicate data destruction.
Identifies when a user downloads multiple files from Google Drive, which may indicate data exfiltration.
Detects when CloudTrail logging is updated, stopped or deleted.
Detect when a user logs into AWS console without MFA.
Detects a successful attempt to retrieve the encrypted Administrator password for a Windows EC2 instance.
Detects when a high number of failed authentication attempts happen for unknown users.
Page 67 of 76