Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects excessive AccessDenied events within an hour timeframe from an IAM User
Detect when the AWS managed policy AWSCompromisedKeyQuarantine has been attached to a user, role, or group. It is applied by the AWS team in the event that the credentials of an IAM user has been compromised or publicly exposed.
Detects create, update or delete events of a SAML provider in AWS.
Detect when the Amazon Simple Email Service (SES) has been modified where an attacker can modify Amazon SES service to propagate phishing emails campaigns.
Detects unusual number of failed authentications from the same IP for valid users.
Amazon GuardDuty detects an Amazon EC2 instance or a container querying algorithmically generated domains (DGA).
Amazon GuardDuty detects a malicious or suspicious file on an Amazon EC2 instance or a container workload.
Detect when admin privileged roles such as Owner or Editor are added to a Service Account.
Detect a user downloads GCP BigQuery results from multiple tables which might indicate data exfiltration activity.
Detect when GCP IAM Organization Policy is updated or deleted.
Page 68 of 76