Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detect AWS IAM activities associated with the S3 Browser utility.
Detect AWS IAM activities made by AWS EC2 instances to retain access or escalate privileges.
Detects when AWS IAM AdministratorAccess policy is attached to a user, group or role which can be used for privilege escalation.
Detect when a KMS (Key Management Service) key is disabled or scheduled for deletion.
Detects an IAM user attempting to update/modify AWS lambda code.
Detect when an IAM session token is created and used from a different IP.
Detects attempts to disable multi-factor authentication for an AWS IAM user.
Detects the registration of a new Multi Factor authentication method for an AWS user.
Detects when an existing password policy is updated or deleted in an AWS account.
Detect when a user creates a new access key for another user and escalates privileges using this newly created access key from the same IP.
Page 72 of 76