Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,181 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects Kubernetes RBAC Role or ClusterRole creation or update events that grant the 'create' verb on Config Connector (KCC) IAM custom resources (iampolicymembers, iampolicies, iampartialpolicies) by non-approved user identities. This could indicate an attempt to gain unauthorized control over cloud IAM policies through the Kubernetes API.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Detects network activity associated with the KREMLIN browser extension communicating with a known command and control domain (luizestrelhashapr.online). The rule monitors DNS queries, TLS SNI connections, and HTTP WebSocket upgrade requests to identify potential C2 communication.
Detects multiple AWS API calls (Publish, GetCallerIdentity, ListTopics) originating from a specific IP address (23.234.84.102) associated with a Zapier SNS sender. This rule monitors for potentially unauthorized or anomalous API usage patterns by identifying repeated, successful, and non-error events from a known source that may indicate misuse or compromise of an integration account.
Detects instances where a removed GitHub organization member performed bulk repository access (cloning or downloading) shortly before their removal, potentially indicating exploitation of retained access by a departed employee or an adversary using a valid account before deprovisioning. The rule identifies activity occurring more than 24 hours prior to removal involving multiple repositories or multiple access actions.
Detects network communication with known malicious domains and IP addresses, as well as the presence of known malicious file hashes on the system. The rule correlates network connection events, file creation events, and process creation events against predefined lists of C2 infrastructure and malware indicators.
Page 267 of 756