Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detect when a user creates or updates a login profile for another user and escalates privileges using this new user from the same IP.
Detect when an AWS S3 bucket is made public using ACL.
Detect when the S3 Public Access Block configuration has been removed from a bucket or an account.
Detect when an AWS security group is opened to the world (0.0.0.0/0) or (::/0)
Detects successful API executions from a Tor exit node.
Detects when an AWS user successfully authenticating from more than one unique IP address within 5 minutes.
Detects successful login after multiple failed attempts
Detects when an AWS IAM user creates an AWS Access Key for programmatic calls.
Amazon GuardDuty detects an Amazon EC2 instance or a container attempting to communicate with a black hole IP address.
Amazon GuardDuty detects a brute force activity in an Amazon EC2 or Amazon RDS instance.
Page 73 of 76