Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
AWS Backup Plan Deleted
YARA-L
Detects when AWS Backup Plan is deleted.
Detects when an insecure SSL policy is configured for an AWS CloudFront distribution.
Detects when AWS Config Service is updated, stopped or deleted.
AWS Delete VPC Flow Logs
YARA-L
Detects when AWS VPC FLow Logs are deleted.
Detects when an Amazon EC2 AMI or Snapshot is shared publicly.
Detect when an EC2 instance makes high number of API calls.
Detect modifications to user data script on an EC2 instance.
Detects excessive successful events within a 5 minute timeframe from an IAM User.
AWS GuardDuty Disabled
YARA-L
Detects when a GuardDuty Detector is disabled or suspended.
Detects when AWS IAM Access Analyzer is deleted.
Page 71 of 76